v0.1.3

0.1.3 - 2026-10-29

Fixed

• Use GNU release tooling for changelog preparation (#232)
• Repair Work namespaces after repository renames (#230)

Image: ghcr.io/agentscm/agentscm:0.1.3 (digest sha256:00aedf5e10117890109b8963941fdfb463fbb213d8b4a04b2d196c20a9489241)

v0.1.2

0.1.2 (2026-10-29)

• Make local validation comments clearly attributable to AgentSCM and report missing PostgreSQL/S3 coverage only when the repository policy requires it.
• Reduce hook, MCP and Hub memory use by removing repeated scans and bounding retained buffers.
• Bound contributor build storage and consolidate integration-test linking.
• Prepare releases from Cargo versions and Git tags with version-free PR text; keep binary/container qualification and npm approval in the existing publishing workflow.
• Known limits: the software remains alpha. Platform, service and live runtime coverage depend on the release qualification jobs; a passing local suite alone does not establish them.

Image: ghcr.io/agentscm/agentscm:0.1.2 (digest sha256:d4b6be615fac92887d7cfd27cfacc423cb7d92d266a4d526072fe828874efa27)

v0.1.0-alpha.9

0.1.0-alpha.9 (2026-10-28)

• The repository moved to agentscm/agentscm. Installers, npm metadata, container and plugin references and the local-validation bindings now name it; release jobs check the repository and organization by their IDs, and historical releases and attestations are unchanged (#204, #206).
• An agent's first session in a newly connected checkout has every AgentSCM MCP tool: the server lists the full tool list before the checkout is connected, and a call made before the connection exists says why in plain words (connecting, not signed in, repository not on this Hub, computer revoked) (#201).
• agentscm --help lists only the everyday commands; experimental commands still run but are hidden. Quickstart shows --hub-url, --yes, --only, --dry-run and --json; the other flags still work, hidden. The binary itself accepts agentscm --hub-url URL like npx agentscm (#186), and --version shows the build commit (#198) (#202).
• After a first sign-in, client connect, client setup and quickstart mint agent tokens through the computer, so revoking the computer stops that checkout's agents at once (#200).
• Hub UI: layout, link and wording fixes from a visual pass of every page (#185).
• Contributors: tools/windows-check.sh compiles the Windows build from macOS or Linux (#208).
• npx agentscm asks nothing once the Hub is known (--hub-url, the checkout's connection, or the computer's only sign-in); the "Where should AgentSCM run?" choice remains only without one. It sets up every coding agent it finds, by program on PATH or by configuration directory (Claude Code and Codex by program, since their plugins install through their CLIs; Cursor, GitHub Copilot and Gemini CLI by either), for all projects, also from a directory that is not a repository; --agent narrows the list. The "all your projects?" question and its No path, which dropped Claude Code and Codex, are gone (#188), as are "Go ahead?", the auto-connect question (auto-connect is always on), the collision check (--no-collisions is accepted and does nothing), the menu bar question (a closing line names agentscm tray) and the native Hub install confirmation. The closing lines say what was set up, to fully quit and reopen the agents, to trust Codex's hooks with /hooks when Codex was set up, and the undo command, which no longer names a program in a temporary directory.
• Claude Code runs AgentSCM's MCP tools without asking: setup adds mcp__plugin_agentscm_agentscm__* to permissions.allow in ~/.claude/settings.json (or $CLAUDE_CONFIG_DIR), keeping the old file as settings.json.bak, and agentscm uninstall takes out exactly that rule when setup added it. Gemini CLI's AgentSCM server gets "trust": true. Other agents have no documented per-server setting, so they still ask.
• --yes and runs without a terminal sign in: the link is printed on stderr, the browser opens when it can, and quickstart waits; a sign-in that cannot finish there says to run quickstart once in your own terminal (#187). A new local Hub waits the same way for the GitHub App to be created when a browser can open, and exits 3 as before when none can. A GitHub login that gh reports is used without asking.
• Joining a Hub, quickstart says which Hub it joins instead of local-Hub platform and Docker details (#189).
• client setup points the user-wide plugin and hooks at agentscm on PATH or at the stable copy in ~/.agentscm/bin, never at a build directory or npm cache (#190).
• The user-wide hooks no longer add a "coordination unknown" note when an edited file is in no connected checkout (#199). A repository with no connection still gets the one-line hint at session start.

Image: ghcr.io/agentscm/agentscm:0.1.0-alpha.9 (digest sha256:166ec585dd6215a6e4100866a763ebfbf3afc105d4e2c95f068d133cbe8e74c9)

v0.1.0-alpha.8

0.1.0-alpha.8 (2026-10-27)

• Fixed: the Hub in a quickstart-managed Docker container never became healthy, because quickstart sets AGENTSCM_SLACK_FILE to an empty value and the Hub tried to load Slack settings from that empty path. An empty value now means no Slack file (#181).
• Fixed: the Linux (musl) binaries did not compile, because the date formatting named libc::time_t, which is deprecated on musl. 0.1.0-alpha.7 was never released for that reason (only its container image was published); this release is everything listed under alpha.7 plus this fix.

Image: ghcr.io/counterbranch/agentscm:0.1.0-alpha.8 (digest sha256:f2e0420cb6040be2c6f76b688666b6668673854a97738bcc604698500e719915)

v0.1.0-alpha.6

0.1.0-alpha.6 (2026-10-25)

• 0.1.0-alpha.5 was not released: its Linux musl binaries failed to link after its container image was pushed, so it has no GitHub release, npm package or attestations. Use 0.1.0-alpha.6, which contains everything listed below.

• Fixed: the static Linux (musl) binaries link again. Local change capture's no-replace export rename now calls the renameat2 system call directly instead of a libc wrapper that musl does not provide.

• Optional macOS menu-bar companion in the existing binary: npx agentscm tray, or --tray after successful quickstart setup. It shows saved checkout connections, recent Hub checks and observed hook/MCP activity, configures coding-agent integrations with visible results, and opens a short-lived read-only Hub session. Start at Login is opt-in and its owned setting is removed when uninstall removes the program. The tray is an unsigned, unnotarized alpha; native UI and OS login/logout acceptance remain incomplete. See install options.

• Fixed: client setup and connection release the shared lifecycle lock while waiting for Hub sign-in or repository access, then recheck local state before applying changes. Tray recovery commands use the running executable's full path. Platform-specific activity imports no longer break Windows test builds.

• Hub UI: a feature walkthrough with per-page tours, search pickers instead of pasted IDs, one shared pager that keeps its cursor in the URL, and a top bar and rail set apart from page content.

• agentscm init-repo now writes only the shared agent instructions (AGENTS.md and the files that point each agent at it), with no hook, MCP server or token. Each developer connects a checkout with agentscm client setup, the command the instructions name.

• Experimental, Unix, GitHub App connections, fake-tested only: the opt-in agentscm/workflow/<target> status is also posted on GitHub merge queue groups, success only when the queue branch still points at the group commit, the queued pull request's head is the published candidate, the group's base is the candidate baseline and the group tree equals the qualified native revision's tree. Stacked multi-entry groups stay pending. Named Hub migration merge_groups; the publication API adds forge_check.merge_queue. See GitHub merge queues.

• agentscm setup is now a hidden contributor helper; new users run agentscm quickstart. Its guide moved to native installation, and the install guide asks first whether the hub is local or hosted.

• Update tokio to 1.53.3 and ctutils to 0.4.5 (RUSTSEC-2026-0385 and RUSTSEC-2026-0386).

• The Hub UI gains Landed changes, Templates and Timeline pages; Templates and Timeline read a local agentscm serve through its /v1/local routes.

• Experimental: work insights. GET /v1/hub/standup/insights and /v1/hub/standup/work/{id}/insights, MCP agentscm_work_insights and agentscm_work_insight, and agentscm work insights|insight report bounded timing, coordination signals, usage reports and stored publication observations; agentscm work usage and MCP agentscm_work_usage record immutable usage reports, and agentscm client reporting on|off controls completion reporting (off by default). See work insights.

• Experimental, Unix: local workspace snapshot timelines. workspace capture|timeline|entry|diff record and inspect bounded observations of a native workspace without checkpointing it, an earlier observation can be forked into another Change, and workspace-client mcp exposes the same operations as a local stdio MCP server. See workspace timeline.

• Experimental: reusable skill workflow templates. skill-workflow library inspect and, on Unix, library configure bind one strict versioned manifest with a packaged SKILL.md, stored in immutable native source, to a Change's exact revision and review context; skill-workflow mcp exposes them as a local stdio MCP server. There is no mutable catalog or latest. See reusable workflows.

• Hub listener: requests other than workspace source publication end with 408 after 30 seconds, and one client address may hold at most 8 pending browser and 8 pending device sign-ins (429 too_many_logins). Behind a loopback or private-network proxy the last X-Forwarded-For entry is used as the address.

• Experimental: supported skills. agentscm skill list|show|add|remove browses a catalog of versioned workflows and pins them in a committed agentscm-skills.lock.json. The first skill, pr-gate v1, runs on any GitHub or GitLab repository (branch, tests, independent review, fixes, CI, approval, merge, post-merge check), with parameters for the CI label, merge method and stacked pull requests. Agents record self-reported evidence per gate (agentscm skill evidence, MCP agentscm_skill_evidence), and every gate it satisfies is labelled self-reported in the CLI, MCP and Hub. The opt-in agentscm skill stop Stop hook keeps an author session from finishing at the tests, review and fix gates. The Hub reads the lock from the default branch when a forge is connected and shows a Skills library and per-branch runs. See the design.

• agentscm quickstart now sets up coding agents through agentscm client setup instead of writing its own Claude Code hooks, token file and hub.json. --agent claude|codex|cursor|copilot|gemini (repeatable) and --no-agents replace --hook, --ttl and --agent-name. Agents set up by quickstart appear on the Connect agents page. Client tokens last 30 days (was 8 hours). client connect and client setup wait at a terminal for the hub's GitHub App to be installed on the repository. client remove now undoes client setup fully (entries, plugin, connection, token file, token), and agentscm uninstall runs it for each checkout quickstart connected. agentscm intent reads the checkout's client connection before hub.json. With --yes or no terminal, quickstart never starts a sign-in; with no agent found, hub setup still succeeds and prints each agent's client setup line. uninstall leaves a connection quickstart found rather than made. New DELETE /v1/hub/token lets an agent token revoke itself; client remove uses it and exits non-zero, keeping the connection for a retry, when the token can't be revoked. See the setup guide.

• Optional Slack app (AGENTSCM_SLACK_FILE, agentscm hub slack ..., quickstart --slack-config-file): a direct message to each person involved when an agent edits a file again after AgentSCM refused it (edit_repeated), when a handoff is declined, and when new work reads like work already under way (task_overlap). The holder's message has buttons that answer the handoff for their own agent. Bot scope chat:write only; no channels, history, Home tab, slash command or Slack-side work forms. Handoff answer events now carry the requester's token in from.token. New store method latest_event_seq.

• Experimental, Unix/Claude Code: add configure-once local change capture
  with a bounded private spool, current-Work resolution on each hook, replay-safe Hub event/action
  receipts and typed Git/native source bindings. Ordinary execution outcome is separate from an
  exact-recipe verification result. Read one concise transcript-free intent/source/decision/next
  action handoff through HTTP, agentscm_change_record, agentscm change-capture show or the Hub
  UI. Existing Work versions retain declared intent/decision provenance; bounded observed setup
  facts and opt-in, session-bound Claude history reads supply partial usage coverage through Work
  Insights. Request usage and session totals remain separate. Conversation/tool bodies, captured
  source bytes and command output stay local. See local change capture
  and qualification limits.

• Fixed: an agent whose hook refuses contested edits (Claude Code, Codex, Copilot) was never refused when it had first named the file in agentscm_start or agentscm_check, because that MCP call already held the file and only new files were checked (#83). The hub now records which held files no refusing edit has checked yet and checks each on the session's first refusing edit, in either order of MCP call and first hook. Hub migration 20 adds that list to the session row. See warn once.

• CI: ordinary same-repository pull request updates no longer run the hosted test suites. CI is split into static (always) and tests, and tests, Windows, container, hub end-to-end and live execution run for same-repository pull requests only with the ci-extended label or workflow_dispatch; forks, pushes to main and the security checks are unchanged. See local validation.

• Experimental, Unix and GitHub only: agentscm local-validation run|show|post|verify records a maintainer's local gate as a signed attestation; the repository now carries .github/local-validation/ (recipe, policy and an issuer registry with one enrolled maintainer key) and a local-validation workflow that verifies signed local validation attestations posted as PR comments and publishes an agentscm/local-validation commit status on the exact head, without building PR code. The verifier was qualified before merge by running this workflow under act against live GitHub (pull request #86: a signed failure, then a fix and a signed pass, each with a status on its exact head); the first run on GitHub-hosted Actions happens after merge. The status is not a required check. See [local validation](docs/advanced/local-valid...

v0.1.0-alpha.4

0.1.0-alpha.4 (2026-10-21)

• Experimental Unix-only attached Git worktrees can capture and qualify exact native Changes, then publish a separate branch and GitHub PR through an owned mirror. Qualification uses synthetic checkouts, real local Git, loopback authenticated HTTPS and fake GitHub; live forge is not qualified and attached SSH identities are unsupported. Hub migration 15 preserves integrated publications but is not downgrade-safe for older binaries reading candidate rows. See attached Git worktrees for unsupported operations and recovery limits.

• Update rustls-webpki to 0.103.16 and webpki-roots to 1.0.10 to reject distrusted emSign intermediates (RUSTSEC-2026-0382 and RUSTSEC-2026-0381).

• Live CLI qualification of the local Stop hooks (2026-10-20, one macOS machine, synthetic fixture, local native store). Claude Code CLI 2.1.304 print mode: claude-stop blocked with the failing test's output, passed after the fix with a current receipt confirmed independently, and an always-failing requirement stopped after 8 blocks. Codex CLI 0.163.0 codex exec: codex-stop blocked once and then passed, but hooks fired only with --dangerously-bypass-hook-trust and a native workspace also needs --skip-git-repo-check; the bound was not live-tested on Codex. Interactive sessions, desktop/IDE surfaces, hosted remote-* stops and agent-owned task-* stops are not live-tested. The capability matrix is now version 2 and notes vendor documentation for Cursor (stop can only continue via followup_message), Copilot (agentStop blocking, documented, not verified) and VS Code agent hooks (preview). See the capability matrix.

• Thin instruction entrypoint: init-repo's managed block gains a short "Workflow tasks" section (discover with capabilities, fetch one reference on demand, never run feedback as a command), schema_mismatch from instructions and reference adds server_schema_versions and a fixed action, and install-stop task modes print an instructions pointer. No background updater is added.

• skill-workflow task-stop and task-codex-stop: read-only Stop hooks for agent-owned tasks. They call the facade qualification operation (30 second limit) and pass only when it is current and qualified and the clean native workspace base is the qualified revision; otherwise, including on network, auth or malformed-response errors, they block with typed failures and next data and never claim, collect, upload, finalize or checkpoint. install-stop accepts both. Fixture-tested, not live-qualified. See agent workflow tasks.

• Agent-task capabilities (schema discovery) and read-only qualification (is this exact subject currently qualified, with typed next data) over the workspace HTTP and MCP facade. A reference request with an unsupported expected_schema_version now returns a typed schema_mismatch instead of a generic invalid-request error.

• Stop triggers for Codex CLI and a bounded, installable Stop loop. skill-workflow codex-stop and remote-codex-stop are Codex CLI Stop hooks with the pass/block behavior of claude-stop and remote-stop. All four share a handler that reads at most 64 KiB, requires a Stop event, tolerates vendor fields, and allows at most 8 consecutive automatic continuations per agent, session, workspace and change (a runaway-loop guard, not crash-durable; counted under <data-dir>/agent-stop/; stop_hook_active is required and an explicit false resets the count and a pass does not; once exhausted or unreadable it allows the stop and says nothing was qualified). A payload cwd disjoint from --workspace is a no-op, and Stop subcommand parse errors exit 1 so they do not block. The local Stop pass predicate is tightened (workspace_changed_during_run must be false) and local concurrent-checkpoint detection is fixed (generation, base revision and pending operation are compared between the state and status reads). skill-workflow install-stop previews by default and, with --apply, adds or removes only its own entry for the same workspace (--remove [--workspace PATH]) in an operator-local Claude Code or Codex hook file, refusing files inside the workspace and symbolic links. The hooks are tested with fixture payloads built from vendor documentation, not live-qualified; omitting or bypassing them does not bypass native landing policy. See Stop hook guide and the capability matrix.

• Add staged product usage telemetry with inspectable coarse feature/day events, a pseudonymous random installation identifier, persistent on/off controls and environment or per-command overrides. Transmission remains inactive without a configured HTTPS endpoint and data-handling profile; consent-required profiles wait for an affirmative choice. No production endpoint is configured. See telemetry.

• Workspace capture honors exclusion rules. Status, checkpoint and the other workspace scans leave out untracked paths matched by .gitignore, a root .agentscmignore, the private .agentscm-workspace/exclude and, with a root .git, Git's global and info/exclude rules; base-revision paths are always captured. A root .git is skipped as metadata but needs a working git that accepts the repository. agentscm workspace preview lists included and excluded paths with the deciding rule, and workspace status reports excluded_total. Undo, merge application and refresh block rather than overwrite an excluded local file. Local backup still copies ignored files. See source selection.

• A hosted laptop check counts as changed if the workspace base moves during the run.

Image: ghcr.io/counterbranch/agentscm:0.1.0-alpha.4 (digest sha256:13b421b043f0e681149fe9d0c10bbe15409432f85b690d135eb50bc5db75314b)

v0.1.0-alpha.3

0.1.0-alpha.3 (2026-10-17)

• agentscm demo ends with the next step, agentscm quickstart (or npx agentscm), and the status page's demo banner says the same.

Image: ghcr.io/counterbranch/agentscm:0.1.0-alpha.3 (digest sha256:eb009ef6709776c511411f767bcf83c36b7d4b439deefcdce18e0641d2758ce8)

v0.1.0-alpha.2

0.1.0-alpha.2 (2026-10-17)

• npx agentscm --version and --help reach the binary instead of the setup guide.

Image: ghcr.io/counterbranch/agentscm:0.1.0-alpha.2 (digest sha256:79866076c5c79baf91637dc1c0e7343a36317a6a5d1624f30b7f7d628d78553e)

v0.1.0-alpha.1

0.1.0-alpha.1 (2026-10-17)

First alpha. Not for production. No scale, high-availability or security audit yet.

What is in it

• Collision warnings. agentscm collisions and GET /v1/collisions report which branches and worktrees touch the same files, with a git merge-tree conflict check; read-only. See collisions.
• Autopsy. agentscm autopsy counts, from your own Claude Code logs, how often two sessions edited the same file while one still held it; local and read-only. See autopsy.
• Merged branches skipped. agentscm collisions skips branches the default branch already has through a squash or rebase merge; --include-merged restores the old scan.
• Readable output. On a terminal agentscm collisions prints a short summary; --json and --text choose the format, and --git-dir defaults to the current directory.
• Coordination hub. agentscm hub serve on SQLite or PostgreSQL with local or S3-compatible storage, GitHub or GitLab sign-in, expiring agent tokens and an append-only event log. See hub.
• Work intents. Agents announce the files they are about to edit and get attributed notices when others overlap, through the hub API, agentscm intent and a Claude Code hook example. See work intents.
• Warn once. On Claude Code, Codex and Copilot pre-edit hooks the hub refuses the first edit in a session to a file another session holds; a repeat passes and nothing is locked. See warn once.
• MCP and hook endpoints. POST /mcp (six tools) and POST /v1/hub/hook/{claude,codex,cursor,copilot,generic} give agents the same coordination with nothing installed; the hook endpoints always answer 200 and fail open. See agent sessions.
• Handoff (experimental). A refusal asks the holder to hand the file over, and the holder answers with agentscm_handoff. See handoff.
• Status page. The hub serves a read-only page at /ui/ (in the container image and release binaries) showing live agents, contested files, overlapping pull requests, recent activity and handoffs; it signs in only with a read-only token (agentscm hub token create --read-only). See status page.
• Demo. agentscm demo (or npx agentscm demo) runs a throwaway hub with three simulated agents in any Git repository and opens the status page; the agents and the handoff grant are scripted. See the demo.
• Forge sync. The hub observes open pull and merge requests and recent branches on GitHub and GitLab, and can post an opt-in comment and commit status. Tested only against in-process fakes.
• Publish to GitHub. agentscm hub publish turns a native revision in an exported mirror into a branch and pull request, resumably and without forcing.
• Agent wiring. agentscm init-repo writes committed config for Claude Code, Codex, Cursor and Copilot in VS Code, plus AGENTS.md and Gemini's pointer file; agentscm hook <agent> is the thin client for command hooks and fails open. See supported agents.
• Guided setup. npx agentscm / agentscm quickstart walks through a first install; agentscm uninstall undoes it.
• Native ledger. Immutable revisions, review contexts, approvals, conditional integration, workspaces, merges and offline exchange. Experimental; see advanced.
• Isolated command checks. Run a declared command against an exact revision in a locked-down container and bind the result to approval. Experimental; see execution.
• Git bridges. Snapshot capture, reconcile and export between Git and the native ledger, for a local shadow workflow. Experimental; see advanced.
• Compose. A single-host trial profile and a PostgreSQL profile (postgres, service hub-postgres; a volume from the old profile name is not reused). See hub.
• Windows x86_64 binary. Checksummed and attested like the others, installed by npx agentscm, with a subset of commands. See install.
• Container image and docs. The release workflow publishes ghcr.io/counterbranch/agentscm:<version>, and CI covers formatting, clippy, tests, a container smoke test and a two-client hub end-to-end test. See deployment.

Known limits

• Nothing is locked. Intents and collision warnings are advice; the only refusal is the warn-once refusal of one edit, and a repeat passes. Notices are collected by polling, not pushed, and none arrives when an intent expires. Revoked or expired tokens do not release their intents.
• Overlap means the same path or a path under an announced dir/**. Semantic conflicts are not detected, and work that is not announced is invisible. Only edit and write tool calls are announced, not shell writes.
• Hub sessions live in memory: a restart signs everyone out.
• The hub does not terminate TLS; put it behind a proxy. Plain http is accepted only for loopback addresses. The PostgreSQL connection has no TLS.
• GitHub and GitLab sync and GitHub publishing have been tested only against in-process fakes, not live forges. GitLab merge requests cannot be created. Publishing handles one parent, at most 1,000 paths and 64 MiB.
• Command execution is not a sandbox for arbitrary hostile code. The container-boundary tests qualify only the runtime they run on; there is no unattended recovery after a controller crash, and records are unsigned. Linux and Unix hosts with Docker only.
• Git export and reconcile refuse executable and symlink entries. Snapshot capture is one commit at a time with no history import. The hub is not yet joined to the native ledger, so there is no multi-user landing admission and no cutover from Git.
• One writable authority per data directory; the hub uses one serialized database connection per process. Nothing is measured at tens or hundreds of agents, and overlap lookup was measured only on a synthetic 1,000 intents.
• The read-only serve API is unauthenticated and meant for loopback; serve refuses a non-loopback --bind without --public, and exposing it needs an authenticating proxy you operate.
• Claude Code is the reference integration; the Codex, Cursor and Copilot hooks follow their vendors' documented formats. Claude Code cannot use an HTTP hook for SessionStart, and Cursor's pre-edit hook cannot carry a warning, so Cursor is warned just after the edit. Windows is not yet supported by quickstart.
• Schemas and storage may change between alpha releases without migration, and the authority database cannot be downgraded.
• The Windows binary is not code-signed, and the macOS binaries are not notarized. The Windows binary supports a subset of commands (setup guide without the collision check, hook, init-repo, hub client and hub, intents; not collisions, the native ledger, Git bridge, command checks, team service or recovery commands) and is x86_64 only.
• No automated model review.

Image: ghcr.io/counterbranch/agentscm:0.1.0-alpha.1 (digest sha256:4e87e161705ee232346aab7f54cf5b320254f11b5c3368b6f2fe4a6c88d6eb53)