v2.8.0

Summary

• Capability Requests — Any agent, not only one in assistant mode, can ask for what it lacks: settings, tools, repository access, connections such as MCP sign-ins or code hosts, and secrets. Request cards appear on every chat platform, and a person completes the request in the console. New live secrets reach a running agent on demand through the agentconnect-secrets helper and are masked in output. This remains behind the capability-requests flag.
• Computer Use Updates (Preview) — Agents can run commands and work with files on a Linux Computer instead of only working through screenshots. Approval is now asked once per session and answered by the Computer's allowed members. You can watch and take control of the agent's Computer from the session dock. The desktop image includes Chromium, LibreOffice, and developer toolchains, and the desktop app adds a macOS menu bar and a Windows service with a taskbar menu. Computers remain behind the computer-use flag.
• Webchat Files — Webchat uploads of any size are sent directly to the object store in parts, and message attachments appear as file cards.
• AHP and VS Code — VS Code can connect over the Agent Host Protocol more reliably, and file edits made by the runtime appear as edit results.

This release also fixes interrupted webchat streams after a relay gap and remote MCP grant renewal during long webchat sessions.

Features

• capability: live secrets through agentconnect-secrets, and capability requests for every agent (#3404) (3eed78a), closes #3396
• capability: request repository access, connections and header secrets, with cards on every chat platform (#3402) (826706d), closes #3396
• computer: ask once per session, approved by the people allowed to use the Computer (#3406) (d17b8ed)
• computer: badge the macOS menu bar icon for a pause and for a failing check (#3408) (322b4ff), closes #3403
• computer: explain a failed peer-to-peer attempt in the viewer and the desktop log (#3425) (29926ae)
• computer: macOS menu bar with status and controls for the desktop daemon (#3405) (2b22731), closes #3403
• computer: run commands and work with files on a Computer (#3431) (52600f2)
• computer: ship Chromium, LibreOffice and dev toolchains in the desktop image (#3426) (d9bba09)
• computer: Windows service and taskbar menu, and who answers UAC prompts (#3417) (043e108), closes #3403
• control-plane: let viewers hole-punch with an operator's public STUN servers (#3424) (884d1f6)
• daemon: show runtime file edits as AHP file edit results (#3441) (a98c99b)
• file-transfer: upload webchat files of any size in parts (#3440) (812d8f4)
• web: show the Computer viewer's frame rate, bitrate and latency beside its path (#3421) (5cd2631)
• web: show webchat message attachments as file cards (#3436) (35467ff)
• web: watch and take control of the agent's computer from the session dock (#3409) (5b79b03), closes #3182

Bug Fixes

• computer: add the Windows Firewall rule for WebRTC media and offer it in the taskbar menu (#3420) (17b0c33)
• computer: declare the menu bar helper to the release license scan (#3407) (ad6942d), closes #3403
• computer: drop the remote pointer from the stream while a person drives (#3437) (4ff5e36), closes #3182
• computer: restart after resetting Screen Recording so macOS lists the app again (#3411) (95190df), closes #3403
• computer: send first when hole-punching, so the desktop's NAT keeps its port (#3430) (0118030)
• computer: skip the agent cursor's glide for web viewer clicks, keep it for agents (#3448) (3b2804b), closes #3182
• control-plane: judge an agent's session reads for a user by that user's linked identity (#3438) (5c19053)
• daemon: accept AHP draft and read-state actions from VS Code (#3415) (6096ef4)
• daemon: accept VS Code's AHP turn message shape (#3413) (9684c98)
• daemon: advertise each AHP agent's own model (#3416) (ad3409d)
• daemon: continue a headless cron session without mirroring into its minted channel (#3428) (bcb25d9)
• daemon: discard a closed hook session's VM disk when it closes (#3423) (6cc4927)
• daemon: give AHP turns from non-UUID turn ids a canonical post id (#3442) (1415f1a)
• daemon: renew an open webchat session's remote MCP grant between turns (#3433) (1b20e4f), closes #3429
• daemon: stop only the cancelled session's host when a cancel backstop fires (#3445) (a83da14)
• daemon: stop only the shared host when a cancel backstop fires for a session on it (#3446) (329fa8c)
• object-store: verify stored bytes by checksum when a HEAD omits Content-Length (#3435) (9805664)
• quote the npx package so console and CLI commands run in Windows PowerShell (#3418) (ac7750d), closes #3403
• relay: let VS Code finish restoring before AHP authentication (#3444) (07daf21)
• webchat: renew a remote MCP grant in place instead of rotating its token (#3432) (8379bd6), closes #3429
• webchat: resume a stream whose frames a relay gap dropped (#3422) (1e5d5ef), closes #2621
• web: draw the expanded Computer screen above the whole page (#3410) (d7e8c97), closes #3182
• web: show the agent's managed computer in the session Computer tab (#3419) (17db0b6)
• web: stop hover moves from piling up behind a slow round trip while in control (#3443) (23d7d66), closes #3182

Internal

• deps: upgrade ACP runtimes (#3439) (ce61957)
• runtime: refresh Claude ACP and agent-browser pins (#3447) (4b8e9dc)
• web: lay out the Computer detail as tabs from the console design (#3449) (0b481c7)
• web: link each integration's setup guide in the add dialog (#3434) (05e589b)

Full Changelog: v2.7.0...v2.8.0