v0.2.0

Added

• ACP agents (ADR-47): the daemon drives agents that speak the Agent Client Protocol (v1), such as OpenCode, Gemini CLI, Goose, Kimi Code, Qwen Code, Cursor, GitHub Copilot, and Pi, through one adapter. Each one is its own entry in the agent list and is configured under [agents.acp.<name>]; the agents above have built-in commands, and any other ACP command can be added. An agent counts as installed when its command is on the daemon's PATH; npx / uvx launches are never run. One process serves all of an agent's sessions, and sessions resume with session/resume or session/load when the agent supports them. Models, thinking levels, modes, and other options come from the agent's configOptions; mark risky modes with dangerous_modes. The daemon does not offer file system or terminal access to ACP agents: they use their own tools and ask through the usual permission cards.
• Web UI: full-text search of session content. The ⌘K palette searches user messages and assistant replies on every selected online node through the daemon's index, next to the local title matches; picking a hit opens the session at that message and highlights it, loading older history if needed. Snippets are shown as plain text with only the matched words highlighted, and the daemon no longer keeps the control characters its snippet markers use in indexed text.
• Web UI: read-only file browser at /n/:node/files/…, opened from a project page (Files) or from a session's working directory in the info panel. It has a lazily loaded tree, highlighted source, rendered Markdown (relative links and images open files on the node and are never requested from the hub), and image previews; text files show their first 1 MiB. Protocol: fs.read takes encoding: "base64" and offset, and returns raw bytes in chunks of at most 512 KiB (data_base64, with the offset echoed), so a large image does not hold up other messages to the device.
• Remote node settings (ADR-43): node.get_config / node.set_config read and change a whitelist of hot-reloadable settings: concurrent sessions, idle and permission timeouts, notifications, log level, worktree defaults, and the preview ticket lifetime. permissions.allow_dangerous_modes and preview.enabled can only be turned off remotely. Agent commands, directories, session env, preview ports, and the hub address can only be changed on the machine, and a setting fixed by an ANYCON_* environment variable is read-only. A request is checked as a whole, written with the file's comments kept, and audited per key. node.logs returns the tail of the daemon log, leaving out lines that may quote agent output. Web UI: Node settings → Limits is an editable form, and About has View logs.
• Device token rotation: control.rotate_token / token_rotated. The hub issues a new device token and accepts the previous one for 60 seconds. A device rotates at most once a minute, and only from a connection that authenticated with its current token, so a leaked older token cannot be used to take the device over. The daemon, the Web UI, CLI devices, and the TS SDK (for identities it stores) rotate a token once it is 30 days old. SDK: client.rotateToken(), the tokenRotated event, and onTokenRotated. Database: migration 0004_token_rotation.sql.
• Hub: Postgres storage (ANYCON_DATABASE_URL=postgres://…, ADR-12). It behaves like SQLite, with row and advisory locks where SQLite relied on having a single writer; both backends share one test suite, and their migrations share numbers. docker/compose.postgres.yml is an example setup. Keep the /data volume with Postgres too (Web Push keys, admin token) and back up the database with pg_dump. The hub still runs as a single instance. See docs/deploy.md § 3.2.
• Multiple workspace roots (ADR-45): workspace.extra_roots adds folders whose subfolders are projects, next to workspace.root (the primary root, which keeps .scratch). Project names stay unique across roots: linked projects win, then the primary root, then the extra roots in order. Overlapping roots, or a root inside the data directory, stop the daemon from starting; a root that is missing (an unplugged disk) is skipped with a warning and reported by anycon doctor. Each root has its own trash. Changing the roots needs a restart. Protocol: node.info.workspace_roots, Project.root, TrashEntry.root, and an optional root on workspace.create / workspace.clone. Web UI: a Location choice when creating or cloning a project. CLI: anycon projects create|clone --root.
• anycon export / anycon import (ADR-46): back up session history and attachments to a zip file, or move them to another machine. Only the local daemon does this; remote clients cannot. A plain anycon export includes everything, archived sessions too; --project, --since, --session, and --exclude-archived narrow it. The file is written with owner-only permissions and contains conversation content in plain text. Import checks the archive strictly, skips sessions that already exist, imports each session in one transaction, and rebuilds the search index. It does not keep the agent's own session id, so the next message in an imported session starts a new agent conversation while the history stays. --dry-run checks without writing. The file format is specified in docs/spec/daemon.md § 20.
• Attach any file, not just images (ADR-44). Images still go to the model as images when the agent takes them natively. Every other attachment is copied by the daemon into the session's working directory (<cwd>/.anycon/attachments/<session_id>/, owner-only, created through directory file descriptors on Linux and macOS so a symbolic link swapped in by the agent cannot redirect the write), and the agent gets the relative paths, types and sizes at the end of the message text. So every agent can use every file type, and none has to ask for permission to read outside the workspace. /.anycon/ is added to the repository's info/exclude, so the files never show up in git status. The conversation history keeps what you wrote, without that list. If the copy fails (disk full, a symbolic link in the way), the turn ends with an attachment_failed error and nothing reaches the agent; fix the cause and send again. Deleting a session removes its directory. Protocol: blob.put_begin accepts any mime (lowercased, parameters dropped; an empty or malformed one is recorded as application/octet-stream); only the four image types get a header check and width / height. capabilities.attachments lists the mimes an agent takes natively. node.info reports capabilities.file_attachments and attachment_limits. The per-file, per-message, and quota limits are unchanged. The Web UI adds files through the "+" menu, paste, or drag and drop (a file over the node's per-file limit is refused before it is read; against an older node it still takes images only). Files show as chips that download on click and are never rendered inline. CLI: anycon send --file <path> and anycon new --file <path>. SDK: node.uploadFile() and acceptsAttachment(node, agent, mime); uploadImage() refuses a non-image mime locally. A title or preview built from attachments says [file] when any of them is not an image. On Windows the write is still checked first and then done by path, so a link swapped in at that exact moment is not caught.
• Windows support for anycon (daemon and CLI, x64, Windows 10 1809 / Server 2019 or newer; ADR-42). The local CLI channel is a named pipe owned by and restricted to the current user, and the CLI checks the pipe's owner before talking to it. Agents and the processes they start run in a Job Object, so stopping a session or the daemon leaves nothing behind. ~/.anycon gets an owner-only ACL. anycon service install registers a per-user scheduled task that starts the daemon at logon without a console window (through the new anyconw.exe launcher) and needs no administrator rights; service stop asks the daemon to shut down cleanly first. Release archives include anycon-x86_64-pc-windows-msvc.zip, installed with irm …/install.ps1 | iex. Environment variables are matched case-insensitively on Windows, so a session env key like path can no longer stand in for PATH. Windows-specific system and profile directories (AppData, PowerShell profiles, Program Files, …) are on the linking deny list. Preview port detection uses the system's TCP table and the agent's job instead of lsof; a dev server started outside a session needs preview.allow_ports there.
• Web UI: the setup wizard has a Windows tab with the PowerShell installer.
• Background tasks, notices, and transient activity in the event stream (ADR-41). Protocol: new task, notice, and activity events. task is a snapshot of a workflow, background subagent, or background command (a later snapshot with the same id replaces the earlier one); a workflow lists its phases and each agent's state, tokens, last tool, and error. The daemon sends at most one snapshot per task per second (status changes are never delayed) and marks tasks that were still running when the agent process went away as cancelled. notice carries non-error messages from the agent (model fallback, context compacted, rate limit, local command output such as /context, config and hook warnings, …) and never raises a push notification. activity shows what the agent is doing between outputs (retrying an API request, compacting context) until conte...

v0.1.1

Added

• Subagent tool calls are grouped under the subagent that made them, with its description, call count, state, and result. Claude Code only for now.
• The session panel shows an Agents card: the main agent and every subagent in the loaded history, with state, tokens, and tool-call count. It replaces the Options card (the same controls sit under the input) and the Files changed card (the Changes view covers it).
• Protocol: tool_call.parent_id, tool_result.detail.background, tool_result.detail.total_tokens, and background_tasks on SessionSummary / SessionChanged. All are optional, so older clients and daemons keep working.
• Web UI: drag the desktop sidebar's right edge to resize it (double-click resets it).
• Web UI: a "Block page zoom" switch under Settings → Appearance on iOS and Android. It is off by default.

Changed

• The default sessions.idle_timeout is now 20m (was 10m). A config.toml written by 0.1.0 has idle_timeout = "10m" in it and keeps that value until you edit it.
• A turn the agent starts by itself (Claude Code processing finished background tasks) arrives as turn_start with an empty message_id. The Web UI marks it with a divider line.
• Web UI: on wide screens the branch chip sits above the input, on the right.
• Web UI: an option changed while a turn is running is shown in a muted color until the turn ends, instead of a hint line that shifted the layout.
• Faster connect: the Web UI sends its initial sync requests concurrently, and the hub and daemon record last-seen times off the handshake path.

Fixed

• Claude Code background subagents and commands are no longer killed when idle_timeout reclaims the agent process. Reclaim, session_idle, and the turn_finished notification wait until they finish.
• Re-pairing a revoked device no longer fails with "the code is wrong or has expired". The browser no longer sends the old node link's IK into the new pairing handshake.
• Pairing no longer stalls when the hub bounces a handshake envelope under backpressure. The daemon now resends it.
• Codex: the model set in ~/.codex/config.toml shows up as an option even when model/list omits it (common with a custom model_provider).
• Question cards show a single submit button, and it sends the collected answers.
• The SDK no longer matches an agent-started turn to a send().

Install

Hub image (linux/amd64, linux/arm64):

docker pull ghcr.io/anycon-ai/hub:0.1.1

anycon CLI and daemon (macOS arm64 / x64, Linux x64 / arm64 with glibc 2.35+):

brew install anycon-ai/tap/anycon
# or
curl -fsSL https://github.com/anycon-ai/anycon/releases/download/v0.1.1/install.sh | sh

npm: @anycon/protocol@0.1.1, @anycon/sdk@0.1.1.

Each archive contains THIRD-PARTY-LICENSES.txt. Verify an archive with sha256sum -c SHA256SUMS or gh attestation verify <file> --repo anycon-ai/anycon.

v0.1.0

First public release.

Hub (anycon-hub)

• Single-tenant (single) mode with admin-token login and invite links. It runs as one container and one SQLite file, with an embedded Web UI.
• Device authentication, routing, and pairing / enrollment matchmaking. The hub only relays end-to-end encrypted envelopes and sees metadata.
• Web Push, email-code login for accounts with a bound email, and SMTP email notifications.
• /healthz, /readyz, strict CSP, and rate limiting. Ready-made reverse-proxy configs for Caddy, nginx, Traefik, and Cloudflare Tunnel.

Daemon and CLI (anycon)

• Outbound connection to the hub, with reconnect, sleep recovery, and launchd / systemd user services.
• Noise XX+psk3 pairing with locally generated codes (Argon2id-stretched) and Noise IK reconnects.
• Account enrollment: node password, QR approval, and one-time enrollment codes (CPace).
• Claude Code and Codex adapters, agent detection, and per-session model / reasoning / permission-mode settings.
• Permission requests answered from any paired client, with a local audit log.
• Workspace: every folder is a project. Create, clone, rename, trash and restore projects, or link existing directories.
• Per-session git worktrees: diff, sync with base, archive / delete handling, PR status, and auto-archive.
• Image attachments.
• CLI clients: connect, new, send, attach, approve, diff, sync, worktrees, and more.

Web UI

• Streaming chat with tool-call rendering, thinking blocks, diffs, permission cards, and image attachments.
• Worktree workflow: changes tab, branch chip, base sync, and PR status.
• Node and account settings, notifications, IndexedDB cache, installable PWA, English and Chinese.

SDK

• @anycon/protocol (generated types, envelope and JSON-RPC codecs, Noise wasm) and @anycon/sdk (client direction, image upload).

Distribution

• Hub image ghcr.io/anycon-ai/hub for linux/amd64 and linux/arm64.
• anycon binaries for macOS (arm64, x64) and Linux (x64, arm64, glibc 2.35+), installable with brew install anycon-ai/tap/anycon or the release's install.sh, with SHA-256 checksums and build provenance.
• @anycon/protocol and @anycon/sdk on npm, published with provenance.
• Every artifact ships its third-party license notices.

Install

Hub image (linux/amd64, linux/arm64):

docker pull ghcr.io/anycon-ai/hub:0.1.0

anycon CLI and daemon (macOS arm64 / x64, Linux x64 / arm64 with glibc 2.35+):

brew install anycon-ai/tap/anycon
# or
curl -fsSL https://github.com/anycon-ai/anycon/releases/download/v0.1.0/install.sh | sh

npm: @anycon/protocol@0.1.0, @anycon/sdk@0.1.0.

Each archive contains THIRD-PARTY-LICENSES.txt. Verify an archive with sha256sum -c SHA256SUMS or gh attestation verify <file> --repo anycon-ai/anycon.