v2.4.0

Summary

• Sub-Sessions, Recall, and Reminders for Every Agent — Any agent can hand long work to a background sub-session and keep the conversation free. You can list and stop sub-sessions from the console. Every agent can also recall its earlier conversations and set reminders.
• Access Judged by Who Is Asking — Reading or posting in another conversation is allowed when the person asking has access to it, across all platforms. Agents detect people from outside the organization. Conversations the platform marks as external, such as Slack Connect channels, start turned off.
• Memory Layered by Audience — Each agent's memory is split by who can see the conversation, so private content is not recalled elsewhere. The console shows the layers and your own memory.
• What People Can Do in Chat — A new setting replaces "Allow runtime changes in chat": only talk, also approve tool calls, or also change settings. Approval cards now appear on Telegram, Discord, Feishu/Lark, and Google Chat. Where permissions are synced, only the agent's editors can act from chat.
• Files and Images — The console can preview images and download files from sessions, browse and create workspace folders, and show images an agent generates in webchat. The Docker Compose stack and Helm chart now bundle an S3-compatible object store that moves files without passing through the Control Plane.
• More Provider Options — Self-hosted agents can use an organization Anthropic or OpenAI key, Decisions can run on OpenAI (including image input), and Cloud daemons evaluate Decisions through the Cloud gateway. The Billing page shows usage per model.
• Assistant Mode Preview — Behind the assistant-mode console flag, an agent can keep one long conversation per place, track items, patrol them, and draft posts for approval.

This release also lets the owner remove an agent from a multi-agent playground conversation, and fixes many session, approval, and sub-session reliability issues.

Behavior change: Existing agents move to "Also approve tool calls", the new default. New agents start in their runtime's auto or full-access permission mode. The bot no longer joins a public Slack channel automatically; it asks the person behind the turn, and the per-bot auto-join setting is removed. The Agent/Channel memory scope choice is removed in favor of automatic layers.

Upgrade note: The daemon refuses to start if its config still sets sandbox.backend or security.requireSandbox, or if it is started with --require-sandbox. Remove those settings, or use "sandbox": { "host": false } to refuse unsandboxed sessions. Daemons older than v2.0.0 must be upgraded to connect properly.

Features

• a place the platform marks as external starts closed for every agent (#2980) (f0d73c6), closes #2879
• approval cards on Feishu/Lark and Google Chat, and synced Feishu/Lark editors (#2967) (838ec53), closes #2810
• assistant: derive the responsible user, drop the fallback conversation, move the panel to Configuration (#3001) (3927f4a), closes #2979 #2810
• assistant: recall lists the asker's own DMs and webchat conversations (#3009) (171b5e1), closes #2979 #2810
• daemon: add assistant item tools and the standing summary (#2831) (14b23c2), closes #2810
• daemon: add assistant-mode recall and the place read and write rules (#2833) (cb5c94b), closes #2810
• daemon: add assistant-mode remind (#2908) (74f2622), closes #2810
• daemon: ask a person before the bot joins a public channel (#2992) (d209221), closes #2979 #a
• daemon: close the assistant-mode memory bypass (#2835) (c2a5ffa), closes #2810
• daemon: detect people from outside the organization for every agent (#2993) (44e783e), closes #2979
• daemon: draft assistant-mode posts for an internal member's approval (#2842) (8fab458), closes #2810
• daemon: give assistant-mode turns the people's local time (#2951) (ace9862), closes #2810
• daemon: give every agent sub-sessions (#3019) (d99a9f5), closes #2979 #2810
• daemon: judge every cross-conversation read by who is asking (#2986) (9cde293), closes #2979 #2810
• daemon: judge every platform write by who is asking (#2988) (884791d), closes #2979 #2810
• daemon: layer every agent's memory by audience (#2989) (1a4cc3c), closes #2979
• daemon: let the main conversation stop a sub-session it opened (#2939) (8b53a08), closes #2810
• daemon: offer recall and reminders to every agent (#3004) (621fa04), closes #2979 #2810
• daemon: patrol an assistant-mode agent's items when their next check is due (#2887) (a071b69), closes #2810 Array#findLast
• daemon: post permission cards on Telegram and Discord (#2964) (4ea1fdb), closes #2810
• daemon: put a patrol's proposal in the conversation its item belongs to (#2935) (92c673d), closes #2810
• daemon: reply directly in conversations shared with another organization (#3000) (81341ef), closes #2979
• daemon: report failed sub-sessions and cap how many run at once (#2873) (1d698f9), closes #2810
• daemon: resolve credentialed skill refs per agent without a bucket (#2846) (7f097da), closes #2733
• daemon: route sub-session permission requests to their conversation (#2913) (82d8b0a), closes #2810
• daemon: scope assistant-mode recall to the asker in their own DM (#2901) (18a484e), closes #2810
• daemon: tell every agent the people's local time (#2997) (0c55162), closes #2979
• decide assistant-mode drafts from the console's Activity view (#2880) (22efa8d), closes #2810
• decisions: add OpenAI Decisions provider (#2848) (8254b28)
• decisions: evaluate current message images with OpenAI (#2849) (0b1dd55)
• decisions: run managed-daemon Decisions through the Cloud gateway (#2872) (a55297e)
• default an assistant-mode agent to its runtime's auto permission mode (#2952) (5d2f849), closes #2810
• default every runtime's new agents to its auto or full-access mode (#3020) (fae3bb5), closes #2979
• deploy: bundle an object store for file transfer and the Source Cache (#2941) (ce3d33e)
• downgrade assistant-mode places on guests and Slack Connect shares (#2843) (40fa9ef), closes #2810
• file-transfer: sign console transfers in the control plane for any daemon (#2889) (d135df6)
• gate assistant-mode agents and keep one session per place (#2832) (8740fe3), closes #2810
• gitcred: mint private skill tokens only inside a skill credential window (#2847) (c4d7799), closes #2733
• give assistant-mode agents the ordinary conversation defaults (#2998) (cc88a48), closes #2979
• let a webchat conversation's owner answer its approvals (#2959) (9e3cc60), closes #2810
• let an assistant-mode patrol propose a task for approval (#2895) (b1b56bb), closes #2810
• list and stop a conversation's sub-sessions in the session dock (#2885) (b1781e4), closes #2810
• memory: name place layers and show each only to who can see its conversation (#3012) (c79a54e), closes #name #2979 #2810
• memory: name the layer a memory write landed in (#3006) (00a0a53), closes #2979 #2810
• open a background sub-session when an assistant-mode agent delegates to itself (#2869) (575543e), closes #2810
• providers: support agent API keys on self-hosted daemons (#2930) (7f6f6ab)
• relay: let a bot-applied filtered label trigger a GitHub hook (#2861) (47cb3f9)
• replace "allow runtime changes in chat" with what people can do in chat (#2946) (0ed23f2), closes #2810
• sessions: show retained model selection evaluations (#2855) (00c264b)
• shim: accept Git skill plan sources in the cluster skill handler (#2853) (aca77d3), closes #2733
• shim: shim-internal Git skill acquisition module (#2850) (15d99d3), closes #2841 #2733
• shim: skill-git-in-pod-v1 capability and Git plan wire schemas (#2844) (963e766), closes #2733
• show Activity and sub-sessions for every agent, and preselect an unattended permission mode (#3017) (45b7fa3), closes #2979 #2810
• show an assistant-mode agent's activity on its console page (#2876) (4eb3cd1), closes #2810
• skills: install Git skill sources in the pod on skill-git-in-pod-v1 images (#2857) (c7bd920), closes #2733 #2733
• skills: write in-pod Git skill clones back to the Source Cache (#2858) (8d7e2c5), closes #2733 #2733
• source-cache: transfer webchat uploads and workspace downloads through the bucket (#2878) (76cd3e2)
• take chat actions only from linked editors where permissions are synced (#2961) (c01c932), closes #2810
• webchat: publish agent-generated images as shared-image cards (#2910) (68c10c3)
• webchat: remove a member from a multi-agent playground conversation (#2915) (4ddbd7f), closes #2865
• web: preview images and download files in the session viewer (#2851) (51cadce), closes #2779 #2748
• web: put the model picker and chat actions on one row, with tooltips (#2958) (0e4b028)
• web: show a patrol's proposal in its webchat conversation (#2938) (cfdf9cc), closes #2810
• web: show memory layers and your own memory in the console (#2990) (b5c0a72), closes #2979
• web: show per-model usage on the Billing page (#2994) (c190aa0)
• web: show Stop on the session composer only while it is empty (#2971) (2d0ae44)
• workspace: navigate folders and create empty folders in the workspace browser (#2875) (a08d3de), closes #2864

Bug Fixes

• assistant: ask the platform whether a draft's asker is a full member, for every agent (#3003) (74d5f4e), closes #2979 #2810
• collab: report messageAgent dispatch failures to callers (#2999) (4274b3a)
• connectors: surface expired authorization and reconnect actions (#2996) (80664b8)
• control-plane: a DM session on an unsynced platform is visible to the organization (#2978) (5f702ac), closes #2879
• control-plane: start existing agents at "also approve tool calls" (#2957) (e587c80), closes #2810
• daemon,web: report source-mismatched hook turns and clarify sub-session Stop (#2911) (5acc23d)
• daemon: allowlist git config keys in the shim exec policy (#2894) (93249bc), closes #2841
• daemon: ask which sub-session to stop only when it is unclear (#2947) (d6ff0bf), closes #2810
• daemon: bind a session row its failed first turn created (#2909) (085538b)
• daemon: cancel the runtime probe sweep when the daemon stops (#2902) (2321e64), closes #2900
• daemon: close shared-host ACP sessions when they go idle (#2925) (e0b5fd5), closes #2923
• daemon: confirm a place is not shared before output no event triggered (#2973) (950c1e9), closes #2810
• daemon: draft an assistant-mode post to a private place instead of refusing it (#2933) (b440434), closes #2810
• daemon: drop the console link from a synced platform's approval refusal (#2972) (eae9c0a), closes #2810
• daemon: fail closed on undetermined places in the assistant memory bypass (#2836) (28291e6), closes #2810
• daemon: hold a sub-session's failure report until it is admitted (#2920) (787e764), closes #2810
• daemon: judge an identified person by the chat account they linked on the target platform (#2991) (ca66cae), closes #2979
• daemon: keep a report turn's synthetic id off Slack threads (#2928) (5cb4b4f), closes #2810
• daemon: keep assistant-mode agents from promising checks they cannot make (#2852) (93b24aa), closes #2810
• daemon: keep chat answers out of closed and external conversations (#2955) (d4cd68c), closes #2810
• daemon: keep patrol reports from promising a later message (#2921) (6710aee), closes #2810
• daemon: keep private conversations out of the item ledger's wording (#2934) (19e8362), closes #2810
• daemon: keep the Source Cache connectivity check inside a shim frame (#2839) (2650e84), closes #2838 #2732
• daemon: let the send tool post to Google Chat (#2962) (78507c7), closes #2942
• daemon: list Source Cache bundle refs without a bare show-ref (#2838) (5879ab4), closes #2732
• daemon: mark a parent report dropped from the queue as failed (#2871) (7dadda2), closes #2862 #2862
• daemon: name the cause of an ambiguous GitHub review write (#2834) (80e6190)
• daemon: name what keeps a long-quiet runtime host from being reclaimed (#2931) (5d4af08), closes #2780
• daemon: name who decided an assistant-mode card clicked through the relay (#2936) (f111ae4), closes #2810
• daemon: never cut the console link in a Telegram refusal alert (#2965) (45f3ace), closes #2810
• daemon: one session that never settles no longer holds every rowless session directory of its agent (#2984) (56e8e15), closes #2283
• daemon: preserve Claude model selection when resuming sessions (#2914) (bdb6609)
• daemon: prompt a report into a Slack parent past its read cursor (#2929) (cf5aa74), closes #2810
• daemon: reply to a join decision in the thread that asked (#3011) (f7a2f8f), closes #2979 #2810
• daemon: reply to background-task and pull request wakes in the thread that started the work (#3014) (16c5510), closes #3011 #2979 #2810
• daemon: report a sub-session nothing runs any more, freeing its slot (#2944) (a24a4f4), closes #2810
• daemon: resolve a channel named by its name before the place rules judge it (#3008) (9591c14), closes #2979 #2810
• daemon: run a replayed cut turn instead of coalescing it away (#2948) (a458f2a), closes #2810
• daemon: scope a Linear token renewal by its integration's org (#2977) (0730e4a), closes #2976
• daemon: scope a place's downgrade interrupt to that place (#2970) (09328fe), closes #2810
• daemon: select a runtime by decision for agent- and schedule-started sessions (#2845) (017d214)
• daemon: send patrol and task reports first, to the current session (#2919) (5c46cb8), closes #2810
• daemon: settle a sub-session's permission notice and name it by its task (#2927) (4d4d50e), closes #2810
• daemon: stop a turn whose permission request nobody answers (#2932) (4a2d312), closes #2780
• daemon: tell dream and distillation models plan mode does not forbid writeMemory (#2859) (b366871), closes #2854
• daemon: tell only the clicker about a refused chat action, and name who answered (#2954) (a7a40c4), closes #2810
• daemon: title a self-delegated sub-session by its task (#2950) (ae395d5), closes #2927 #2810
• daemon: use native instructions advertised by ACP runtimes (#2953) (17fa5f3)
• daemon: write assistant reports in the conversation's language (#2949) (801115f), closes #2810
• deploy: reach the bundled store in-network so a localhost host works (#2960) (c2749d8), closes #2941
• file-transfer: queue a steer carrying uploads and mark files in peers' context copies (#2969) (5784f92), closes #2884
• memory: restore a cleared place layer's identity on its next write (#3013) (22bfcb1), closes #2979 #2810
• providers: simplify agent credential selection (#2937) (2591d8b)
• relay: let Slack redeliver an event no daemon took (#2945) (9bb9010), closes #2164
• runtime: preserve wrapper PATH in login shells (#3002) (ca162a6)
• shim: skip re-cloning Git skill sources already installed at the planned commit (#2867) (b7daf85), closes #2733
• skills: key anonymous Git skill sources with a short or default ref in the Source Cache (#2868) (aee38d0), closes #2733
• slack: use a consistent HTTP transport on Node 26 (#3007) (ad31b74), closes #3005
• web,cp: keep a merged conversation's representative session stable (#2907) (116a756)
• web: align placement and credentials fields (#2956) (d747646)
• web: clarify saved credential loading and save failures (#2987) (b1b5b27)
• web: close three assistant-mode gaps in the console (#2982) (c1b4c9e), closes #2979 #2810
• web: format next-intl dates in the viewer's time zone (#2904) (62a95de)
• web: hold a fresh playground's runtime changes for its first turn (#2981) (f7bc69e)
• web: keep an unconfirmed draft decision's row and warning (#2881) (0f53c6b), closes #2810
• web: keep the knowledge editor open on drag-out and stash its draft on close (#2916) (fa2be78), closes #2896
• web: keep the pending-requests strip polling after a failed read (#2943) (26ba44f), closes #2810
• web: make a sub-session's page read-only (#2893) (bf6fa21), closes #2810
• web: size the form model picker like its sibling inputs (#2963) (99f6322)
• web: unify conversation agent picker appearance (#2983) (6cb5993)

Internal

• add OSS Scanner build and threat model (#2888) (0e25e71)
• daemon: remove the retired orchestration tools (#3015) (3186c68), closes #2979
• deps: bump actions/setup-go from 6 to 7 in the github-actions group (#2891) (e348ec4)
• deps: bump next from 16.3.7 to 16.3.8 (#2890) (1165887)
• deps: bump next from 16.3.8 to 16.4.0 (#2912) (6b5320a)
• deps: bump the npm-minor-and-patch group with 31 updates (#2892) (64bd28a)
• drop the unused correlationId from sendMessage and the agent wire (#3018) (b1008ac), closes #2979
• execution: retire runInSandbox, sandbox.backend and security.requireSandbox (#2886) (4887dd4), closes #2463
• runtime: bump Claude ACP to 0.87.0 (#2837) (64463ef)
• runtime: bump Claude and Codex ACP sandbox pins (#2924) (1f32e1d)
• runtime: pin Claude ACP 0.88.0 (#2866) (7a4d6cc)
• runtime: refresh Claude ACP and agent-browser pins (#2905) (44aec62)

Full Changelog: v2.3.0...v2.4.0