v0.5.0

A big one — v0.5.0 is anchored by a major security-hardening pass (an unauthenticated RCE closed, the whole control plane moved off the public port onto a Unix socket, per-agent tokens), a brand-new keyboard-shortcut system, Codex and multi-provider support maturing into first-class territory, and a lot of reliability and cleanup throughout.

🔒 Security hardening

The headline theme this release. Several defects — including one that composed into remote code execution — are closed, and the agent control plane is now locked down by construction.

• 🚨 #281 — Require auth on /mcp, closing an unauthenticated RCE. /mcp matched no auth prefix, so any host on your network could open an MCP session and create_agent with bypass — arbitrary code execution as you. Auth is now enforced at the transport boundary (ADR-054).
• 🔌 #284 — Move /mcp + the hook relay onto an internal Unix socket. The orchestration tools no longer sit on the network port at all. Breaking change: an external MCP client pointed at http://host:3100/mcp now needs a tunnel or local forwarder — on-box clients are unaffected (ADR-055 PR A).
• 🪪 #293 — Gateway onto the control socket + per-agent identity. Completes the socket move and gives each agent its own identity on the gateway rather than a shared fleet token (ADR-055 PR B).
• 🔑 #297 — Per-agent tokens in a 0600 file. Consolidates token delivery to a per-session owner-only file, fixing a Codex argv leak and wiring up Gemini outbound in the process (ADR-055 follow-up).
• 🕵️ #274 — Stop leaking the auth token in a URL. The post-install connect panel surfaced the token on stdout instead of in a shareable link that could land in shell history or browser logs.
• 🧼 #301 — Security hygiene bundle. Owner-only (0700) config directories, config validation, a link-scheme filter on terminal hyperlinks, and dependency bumps — defense-in-depth with no live exposure open.
• 🚪 #288 — Deprecate the agent capabilities field. It was bypassable (a restricted agent still held the token and could call the REST API) and misleading (the system prompt advertised tools that weren't registered). Removed from the create_agent schema; restrict workers via their system prompt instead (ADR-058).
• ⏱️ #298 — Remove the scheduler's isolated target. It was the last execution path that could grant autonomy outside the permission-mode system — a schedule created without an explicit flag ran with full access. Schedules now send a prompt to a running agent, which acts under its own permission mode (ADR-062).

⌨️ A real keyboard-shortcut system

CMUX-style quick navigation, built on a central registry so shortcuts are consistent, discoverable, and can't fight the terminal.

• 🔢 #300 — Keyboard shortcut registry + mod+digit pane switching. One table drives both the app dispatcher and xterm's key handler, so the app-vs-terminal key-capture boundary is defined in one place (ADR-063).
• 🔀 #305 — mod+digit jumps to the Nth sidebar agent, with hold-to-reveal badges. Hold the modifier and each agent row shows its digit, so the hint can never lie about what the shortcut will do (ADR-066).
• ↕️ #306 — mod+↑/↓ to move between agents. Relative previous/next navigation with neighbor hint chips on the active agent during the hold.
• 🧯 #304 — Free the dead ctrl+d/w/b reservations + route Escape through the registry. A LIFO escape stack replaces dead document-level Escape listeners (which never fired under terminal focus); mod+w stays deliberately declined to the browser (ADR-065).

🤖 Codex & multi-provider

Codex inbound gets more reliable, and a new env-preset mechanism lets you run alternative model backends through the real Claude Code binary.

• 📨 #287 — Stop losing Codex inbound messages silently + kill a false boot alarm. Codex has no hook relay, so the prompt-delivery receipt fired a bogus "may have failed to boot" warning on every prompted Codex agent; that tracking is now capability-gated.
• ⚡ #294 — Inject Codex inbound immediately. Removes an idle gate that duplicated Codex's own mid-turn safety and deadlocked agents blocked in wait_agent (ADR-060).
• 📊 #276 — Codex usage tracking plugin. Live usage from the ChatGPT backend with a rollout-file fallback, shown as status-bar items alongside the Claude usage bar.
• 🎛️ #308 — Per-provider, per-tab, per-runtime usage-queue auto-Enter. The auto-submit that resumes a capped session when its window resets now covers Codex too, and one tab's reset no longer fires another tab's queued prompt (ADR-068).
• 🧩 #302 — Model-override env presets. Named, human-keyed presets run an alternative backend (e.g. Kimi via its Anthropic-compatible endpoint) through the real Claude Code binary — no new provider, hooks/MCP/permissions all keep working. Secrets are masked on read and keyed in by a human (ADR-067).

🔄 Resume & reliability

Sessions survive restarts, statuses recover on their own, and "sent" now means "delivered."

• 📂 #283 — Resume any external Claude Code session. Click a terminal-started claude session in the Projects panel (or via MCP) and autonomOS adopts it into a managed agent with its conversation intact (ADR-056).
• 💾 #270 — Keep Claude Code agents across a server restart. A provider-parity resume fallback stops never-conversed CC agents from vanishing on restart.
• 🌀 #278 — Recover agent status after compaction. Status resolution is now order-independent, so an agent no longer gets stuck showing "compacting" when the hook events arrive out of order (ADR-053).
• 🎚️ #296 — Permission mode: the record follows the process; default → ask. A resume with an explicit mode no longer leaves the record disagreeing with what's actually running, and the enum value is renamed to match what it does (behavior-preserving) (ADR-061).
• ✅ #299 — send() acks delivery, not routing. You're no longer told "sent" for a message injected into a dead daemon or a closing socket. broadcast:// and the stub slack:// are removed (ADR-064).

🚀 Install & operations

The operator path drops pm2, first-run install gets a real smoke test, and the Electron app is retired in favor of the always-on server.

• 🧰 #271 — Retire pm2 from the operator path. launchd/systemd-user supervision with a server-owned rotating log, auto-migrating existing pm2 setups.
• 🎁 #272 — First-run install UX. A post-install smoke test that waits until the daemon is actually responsive, then a connect panel with the dashboard URL + token.
• ✂️ #273 — Cut the Electron desktop app. The real need was an always-on remote server, not a local desktop wrapper; the PWA covers the thin-client role at zero Electron maintenance cost (ADR-051).

🧹 Dashboard polish & cleanup

• 🗑️ #289 — Remove the broken markdown file preview. It had regressed to tearing down the dock when you clicked a .md link; removing it also drops the dashboard's entire dangerouslySetInnerHTML surface and ~70MB of deps (ADR-059).
• 🩹 #282 — Eliminate layout/terminal/store stuck-states. An audit sweep across the dockview layout, terminal, and store closing a cluster of ways the UI could wedge.
• 🔦 #269 — Distinct highlight for co-visible sidebar rows. Agents shown side-by-side are now easy to tell apart in the sidebar.
• 📖 #307 — Rewrite MCP_INSTRUCTIONS + add a drift-guard. Clearer inter-agent messaging guidance and a peer-discovery note, with a test that pins the instructions to the actual registered tools so they can't drift.
• 📝 #309 — Complete the v0.5.0 changelog. Retroactive changesets for five PRs that had merged without one, so nothing in this release ships undocumented.

---

📦 Install / upgrade: curl -fsSL https://raw.githubusercontent.com/aterrylu/autonomOS/main/scripts/install.sh | sh && autonomos start
💾 Manual download: grab autonomos-<os>-<arch>.tar.gz for your platform from the assets below (verify against SHA256SUMS)

Thanks for using autonomOS! 💛