v2.13.0

Summary

• Azure DevOps — Connect Azure DevOps organizations, grant agents access to Azure Repos, review pull requests with run statuses, and trigger agents from service hooks, with Azure DevOps triggers in the console.
• Credential Proxy — Agents' code-host access, and the API keys of every supported runtime in sandboxed and VM sessions, now go through a daemon credential proxy. The agent's runtime holds only placeholders; the proxy swaps in the real token or key on the way out.
• Coordinator Threads — Webchat coordinator conversations have real threads: messages handed to a task join its thread, you can reply in a thread from the console, and other members of a published coordinator can write there. A Slack coordinator's page is drawn in Slack's thread shape.
• New-Channel Default — Each agent can choose whether new channels start in Auto, respond to @-mentions only, or stay Off.
• Computer Form Filling (Preview) — An agent on a Linux Computer can ask a person to fill a website form through a Fill card in webchat or the console, without the agent seeing the values. Computers remain behind the computer-use flag.
• Personal WeChat (Preview) — Connect your personal WeChat to an agent by scanning a QR code in the console, behind the wechat flag.
• Messages and Webchat — Messages can carry up to ten attachments, any message can be shared by link, and Telegram replies render Markdown.

Behavior change: New self-hosted daemons need an organization owner's approval before they receive agents, data, or credentials; existing daemons are approved during the upgrade. Only organization owners can change daemon groups, and issuing extra daemon keys is limited to owners and the daemon's creator. The credential proxy is always on, and the features.credentialProxy setting is removed.

Upgrade note: Upgrade self-hosted daemons that host deployment-level Teams or Google Chat integrations to v2.13.0 alongside the services. These integrations now require daemon support for relay egress and cannot run on older daemons.

Features

• a webchat message handed to a task joins its thread, shown as "Replied to a thread" (#3868) (ee6274c)
• an agent's default for new channels (Auto, @-mentions or Off) (#3721) (ddc4209)
• answer a webchat coordinator's messages in their threads, and open its tasks on them (#3716) (0b032eb), closes #3680
• azure-devops: support managed Git across execution environments (#3928) (9cadaee)
• computer: fill a Slack-asked form from the console (#3913) (985b06e), closes #3849
• computer: fill website forms from a webchat Fill card (#3909) (bfbc677), closes #3849
• computer: install form filling on a Linux desktop's browser (#3926) (563b314), closes #3849
• computer: report form fill browser health and survive restarts (#3929) (ed7a7cc), closes #3849
• connect personal WeChat from the Console by QR login (#3925) (ae3e4f0), closes #1833
• control-plane: connect Azure DevOps organizations and serve repository credentials (#3791) (e9280a7), closes #3720
• control-plane: manage Azure DevOps service hook subscriptions (#3816) (dd12dc7), closes #3720
• daemon: exchange a GitHub placeholder for the repository's token in a daemon credential proxy (#3749) (12dfc5e), closes #3382
• daemon: exchange GitLab and Gitea placeholders in the credential proxy (#3763) (fb1ef98), closes #3382
• daemon: give Azure DevOps agents pull-request tools (#3812) (be47eeb), closes #3720
• daemon: keep a proxied runtime from minting code-host tokens (#3785) (9408f7e), closes #3382
• daemon: make the credential proxy the only code-host credential path (#3792) (c1aaf43), closes #3382
• daemon: protect Claude's and Codex's key variables in microsandbox VMs (#3805) (16aea0e), closes #3382
• daemon: protect Cline, GitHub Copilot and Antigravity API keys in srt and VM sessions (#3801) (c07636a), closes #3382
• daemon: protect every runtime's host API keys in srt sessions with the credential proxy (#3800) (f8058ed), closes #3382
• daemon: route code-host traffic of srt sessions placed on an executor through the credential proxy (#3786) (f1d4eba), closes #3382
• daemon: route code-host traffic of VM sessions placed on an executor through the credential proxy (#3787) (69d0818), closes #3382
• daemon: route executor-placed sessions' code-host traffic through the credential proxy (#3769) (2ed4827), closes #3382
• daemon: route the credential proxy's upstream through the daemon's own outbound proxy (#3784) (5df6686), closes #3382
• daemon: route VM and pod sessions' code-host traffic through the credential proxy (#3770) (c71c607), closes #3382
• daemon: run Azure DevOps hook turns (#3817) (9fc5ef7), closes #3720
• daemon: send a host's own provider keys through the credential proxy in srt sessions (#3780) (92695de), closes #3382
• daemon: send a self-hosted install's static provider keys through the credential proxy in pool pods (#3793) (0fe9a21), closes #3382
• daemon: send organization provider keys through a provider tunnel for executor and VM sessions (#3779) (fd8d211), closes #3382
• daemon: send organization provider keys through the credential proxy (#3778) (1dae869), closes #3382
• daemon: serve Azure DevOps repositories through the credential proxy (#3799) (106bb1d), closes #3720
• daemon: submit Azure DevOps reviews and run statuses (#3819) (89af0de), closes #3720
• default Azure DevOps triggers to reviews and fill their turn facts (#3821) (b617197), closes #3720
• draw a Slack coordinator's page in Slack's shape, from the platform module's thread-shape declaration (#3748) (5054251), closes #3680
• draw a webchat coordinator's threads on its page: footers under roots, Reply in thread, the thread composer and ?thread= (#3745) (9409cdc), closes #3680
• dream: show why a dream changed each memory file (#3873) (70eeaee)
• dream: verify notes and keep files the model did not remove (#3809) (95e9305)
• grant all Azure DevOps projects, including ones created later (#3837) (af108c8), closes #3720
• infra: require owner approval for new daemons (#3855) (c537250)
• let other members of a published coordinator write in a task's thread (#3735) (2f7b0e9), closes #3680
• messaging: support source-qualified attachments and webchat uploads (#3841) (6a74af3), closes #3823
• open Azure DevOps project access on what is already granted (#3834) (04bdad7), closes #3720
• relay: accept Azure DevOps service hook deliveries (#3815) (4fac964), closes #3720
• reply from the console in a Slack thread no task holds, through the continued coordinator (#3788) (3e883f0), closes #3680
• slack: read Plan comments on the next Code channel turn (#3930) (a67fea1)
• web: a coordinator's work on a thread is drawn in that thread, above a Replies divider (#3860) (56e8ca8)
• web: a root's task card is the coordinator's message on the left, and time lines show the date (#3870) (24a3301)
• web: a runtime task row opens to its whole command and its times (#3747) (9b680ee)
• web: an agent's name in its turn's header links to its page, as its icon does (#3927) (f9e2b1d)
• web: attachments read as same-size cards, and files drop anywhere on the page (#3847) (b4c47b0)
• web: Azure DevOps triggers in the console (#3820) (3c8cd58), closes #3720
• web: connect Azure DevOps from the console (#3806) (2aa30f4), closes #3720
• web: list Azure DevOps after GitLab (#3826) (ab30dbb), closes #3720
• web: message actions in a smaller hover menu, and redirected messages marked in their thread (#3884) (fc3ad18)
• web: one replies line for every thread, a title-and-summary card, and Share in the thread's header (#3864) (6f9285a)
• web: restyle the computer detail, screen card and list rows (#3890) (1d9cab5)
• web: share any message by a link that lands on it (#3891) (b5e727d)
• web: simplify the Azure DevOps rotation dialog and repository rows (#3833) (de6cd6a), closes #3720
• wechat: add personal WeChat chat behind a feature flag (#3908) (8387faf)

Bug Fixes

• attribute an organization App agent's commits to its own App bot (#3757) (9fe8e21)
• azure-devops: check repository access for the acting user (#3871) (ca26c48)
• azure-devops: recheck repository authorizers on credential leases (#3877) (6fdb594)
• azure-devops: verify guest identities in the resource tenant (#3880) (a5a795e)
• azure-devops: verify tenant access with official Logto (#3895) (0f04798)
• codehost: attribute agent-created changes to task initiators (#3822) (6145ac3)
• codehost: attribute Azure DevOps tasks to linked Microsoft users (#3838) (c44e778)
• codex: refresh worktree permissions per session (#3940) (607e6f9)
• computer: restore the pinned ARM64 FFmpeg download (#3857) (8568af3)
• computer: show a coordinator task's Fill card in its thread (#3920) (a370f74), closes #3912 #3849
• connectors: hide the native Teams bot provider by default (#3896) (28a25d7)
• control-plane: admit Azure DevOps contributors when the root ACL is unreadable (#3828) (c416b71), closes #3720
• control-plane: defer move credentials until placement commits (#3840) (bf69648)
• control-plane: hand a provider key only to an agent that uses that provider (#3807) (7e86ab2)
• control-plane: only organization owners change daemon groups (#3803) (244ddf6)
• control-plane: restrict daemon key issuance and read-access scope (#3831) (634f0a5)
• control-plane: write no Azure DevOps status for a delivery without a turn (#3830) (356879f), closes #3720
• daemon: a console reply into a Slack thread keeps its writer's name when Slack refuses the avatar (#3795) (ca32bec)
• daemon: a coordinator hands a message with an attachment to a task (#3879) (1cb3de0)
• daemon: an untracked file's diff shows its whole content as added (#3862) (7e6ee2b), closes #3703
• daemon: bound in-flight tunnel frames from the shim side too (#3775) (2288892), closes #3382
• daemon: bound in-flight tunnel frames per stream and log shim close codes (#3762) (fb07f9c)
• daemon: drop a code-host token the upstream rejects with 401 in the credential proxy (#3782) (6e6e380), closes #3382
• daemon: honor a GitHub placeholder only over its own agent's srt route (#3760) (72761cf), closes #3382
• daemon: keep a checkout's own credential helper from overriding the proxy placeholder (#3772) (3694ec7), closes #3382
• daemon: keep proxied CLI state in private runtime homes (#3937) (0dfef4d)
• daemon: keep the machine's git helpers from storing the proxy credential (#3777) (a4c485c), closes #3382
• daemon: let the Azure CLI resolve a remote and its API locations through the proxy (#3808) (5dca563), closes #3720
• daemon: move a waking managed computer onto the pool's current image (#3900) (e3e18cd)
• daemon: refuse a git push through the credential proxy below write access (#3767) (1576fc9), closes #3382
• daemon: remind tasks to write a summary in the first turn (#3866) (c57dac4)
• daemon: respect VM mounts during workspace replacement (#3941) (8e070e8)
• daemon: rewrite a retained VM credential copy to its placeholder instead of refusing the launch (#3818) (4223dba), closes #3382
• daemon: run a cron or hook fired into an append-mode room in the room's session (#3761) (d44c522), closes #3639
• daemon: send Basic proxy auth from git in a proxied session (#3756) (c5b8bc1), closes #3382
• daemon: split microsandbox TCP relay writes under agentd's 4 MiB message limit (#3758) (8b8dc1d)
• github: choose App ownership and default new Apps to public (#3924) (35f2206)
• github: enable organization selection with the existing App (#3938) (a223152)
• github: select custom App owners from GitHub accounts (#3932) (cf8f4be)
• googlechat: keep the deployment app's key off tenant daemons (#3813) (b6db274)
• messaging: allow ten attachments per message (#3842) (643be69)
• msteams: keep the deployment app's secret off tenant daemons (#3810) (8bd18c8)
• read a conversation's tasks from the daemon holding its store (#3774) (7bcc66d)
• route Azure DevOps service hooks through the gateway and ignore merge attempts (#3825) (2eb0e14), closes #3720
• runtime: retain Codex permission profiles across turns (#3854) (3ce47ce)
• runtime: update Codex ACP to restore permission profile startup (#3851) (537ebba)
• seo: exclude console pages and clarify API descriptions (#3861) (fcd7f88)
• session-access: retain a live conversation checker (#3914) (ffb973d)
• show failed tasks and clarify Azure repository access (#3885) (05d0f3c)
• slack: align thread author names and avatars (#3892) (f12c6ce)
• slack: limit canvas support to explicit tool calls (#3935) (476417e)
• support HTTP proxy forwarding and Google Chat member reads (#3827) (38cf1c9)
• telegram: render agent Markdown replies as Telegram HTML (#3824) (0eae993)
• web: a list in a message no longer leaves a blank line between its items (#3867) (5cc3037), closes #3773
• web: a person's hover menu sits on their bubble's left corner (#3889) (e6dfaeb)
• web: a task's question can be answered from its thread's side panel (#3906) (57e5e8d)
• web: a thread card's toolbar no longer covers its text, and a root's replies line drops its hover text and Reply (#3874) (44064bb)
• web: a thread whose task is still starting says so instead of "a task you can't open" (#3872) (bfa7c26)
• web: a thread's card under a person's message sits on the right, however long its reply line runs (#3858) (cdb9cf8)
• web: a thread's Share is its task session's, and the card toolbar and tooltips stay out of each other's way (#3869) (e45135c)
• web: a thread's side panel answers its task's question on the conversation's own socket (#3912) (66bb297), closes #3910
• web: a thread's side panel answers its task's question on the task's own conversation (#3910) (7bdf5b6), closes #3906
• webchat: allow members to continue shared coordinators (#3882) (fa5aa43)
• webchat: keep a coordinator task's admin MCP when the coordinator idles out (#3921) (46a3222), closes #3609
• web: draw the thread panel's turns with the session page's own turn code (#3753) (16809fc), closes #3680
• web: handle session link copy failures (#3844) (f427ada)
• web: hide session isolation on coordinator pages (#3850) (d427160)
• web: hide settled task indicators in chat messages (#3878) (cbe657b)
• web: keep hidden live steps out of the AHP store's live tail (#3755) (f8973dc)
• web: keep workspace source names readable (#3939) (e2655e4)
• web: lead a channel's settings with its session mode (#3771) (c9b12ab)
• web: line up the thread header with the session header, show list markers in messages (#3773) (c0634c9)
• web: make copying the primary session share action (#3893) (0b2baee)
• web: make task rows clickable across their full width (#3863) (70e4707)
• web: one hover menu for every message, on its bubble's edge, with Copy for people too (#3887) (a7edfac)
• web: parse attachment markers whose file names contain brackets (#3853) (40bb4ed)
• web: polish attachment lightbox, hover and session drop target (#3852) (a06956d)
• web: remove redundant panel sizing controls (#3859) (3e147fe)
• web: restore session share audience cards (#3902) (be285c4)
• web: retry initial chat connections with backoff (#3846) (9880791)
• web: set an agent's new-channel default from its Integrations card (#3764) (e87062e)
• web: show sender label on your own messages (#3897) (b008a5c)
• web: stop the computer detail tab bar from scrolling vertically (#3898) (784158c)
• web: the runtime picker names the entry a reported model id belongs to (#3746) (5581469)
• web: the turn map marks the turn at the top of the pane, so a jump lands with its tick marked (#3839) (d0b17e5)
• web: the turn map scrolls smoothly to its turn without being pulled back, and names the tick under the pointer at once (#3835) (ad0187c)
• web: the turn map's ticks sit closer with a shorter centred active one, and an agent's tick names its last sentence (#3832) (8ac1774)
• web: unify compact session header controls (#3856) (d009e18)
• web: wait for relay handshake before sending (#3843) (98bc031), closes #3823
• wechat: keep the feature flag limited to console entry points (#3936) (5bbb9e6)
• wechat: resume interrupted QR login installations (#3931) (bdf8519)

Internal

• carry a webchat thread on the wire, and have the relay forward and announce it (#3701) (4041a76), closes #3680
• computer: add the form fill browser extension (#3903) (535510a), closes #3849
• computer: default the image's Chromium to Google (#3886) (59e25e8)
• computer: install the form fill extension in the computer image (#3905) (d5d6ebd), closes #3849
• computer: let a chat-asked Fill card open in the console (#3911) (847bc0f), closes #3849
• computer: run computer_fill_form through a Fill card (#3907) (952c3c3), closes #3849
• computer: serve and package the form fill extension on the desktop (#3904) (f4caec0), closes #3849
• computer: settle the form fill tool and wire contract (#3901) (4594531), closes #3849
• daemon: decide a provider key's endpoint in one place (#3796) (8ef48d1), closes #3382
• daemon: exchange provider API key placeholders in the credential proxy (#3776) (5d47ba9), closes #3382
• daemon: give the runtime and the daemon separate git credential capabilities (#3783) (e20f81e), closes #3382
• daemon: rename the gitcred channel to the agent channel (#3797) (5aa8b71), closes #3382
• daemon: share the private-copy key check between Kimi and OMP (#3811) (93c3185), closes #3382
• deps: update ACP runtimes and microsandbox (#3916) (a3ccc6b)
• deps: update npm dependencies and preserve compatibility (#3737) (75012e9)
• generalize the task thread panel and card into ThreadPanel and ThreadFooter, reading the thread record (#3741) (6726d75), closes #3680
• keep the observations of threads agents took part in (#3718) (15e59f5), closes #3680
• protocol: add Azure DevOps as a code-host provider (#3781) (863311a), closes #3720
• recognize a webchat coordinator's task by the task index, and keep the current-session pointer on the coordinator (#3705) (ec35aba), closes #3680
• record webchat coordinator posts in their thread, and refuse a thread that names no root (#3710) (2ac48e0), closes #3680
• runtime: pin Codex ACP 2.6.0 fork (#3845) (4d6c186)
• runtime: refresh Claude ACP and agent-browser pins (#3881) (80f025c)
• serve webchat thread reads to the console, and keep a held thread's content to its task's audience (#3729) (cfc959c), closes #3680
• serve webchat thread summaries, the roots view and session/thread (#3727) (7becfd7), closes #3680
• web: build a session's turns in a pure buildTurns() (#3750) (7226dad), closes #3680
• web: draw a session's turns through UserTurnView and BotTurnView (#3752) (cd2d8e6), closes #3680
• web: one MessageMenu for every message and card, one menu at a time, and a redirected message links back (#3894) (76d3d44)
• web: remove task composer summary hint (#3865) (58a8748)
• web: reveal additional chat platforms with More (#3915) (8ef0954)
• wechat: align the connector catalog and README (#3917) (323283f)

Full Changelog: v2.12.0...v2.13.0