ChannelGate 0.6.3

Published on 2026-10-12 from main commit 8937dba, with content identical to the approved candidate 412f701 prepared on 2026-10-11.

The HTTP run API now accepts an optional conversationKey to keep related external events in one persistent Slack thread. idempotencyKey remains separate for event deduplication. Queued events preserve the thread's existing Claude/Codex session; deleted roots are replaced once, while inaccessible roots return an error without starting a separate conversation. Responses expose thread timestamps, reuse flags and permalinks.

This focused stable backport includes additive database migrations 32/33 and the compatible dependency-lock security refresh. It does not promote unrelated beta runtime changes.

Validation: 3,196 automated tests passed with 24 environment-dependent skips; static/security/secrets/DCO/audit and both Node CI legs passed. Real Slack/native-engine API context, process persistence, queueing, deleted-root recovery, aliases/isolation and deduplication passed. Live approved-user Slack continuation/stop and actual bot membership removal/restoration were explicitly deferred by an organization admin and remain unpassed.

The signed release evidence includes checksums, source/build metadata, dependency and runtime-image inventories, model inventory and the exact built runtime-image archive. Verify checksums and GitHub artifact attestations as described in docs/MAINTAINER-RELEASE.md.

The runtime-image archive is published in two byte-preserving parts because it exceeds GitHub's per-asset limit. Follow RUNTIME-IMAGE-DOWNLOAD.md to reconstruct the original signed archive and verify its checksum and attestation. The original complete artifact is also linked from the successful release evidence workflow.

ChannelGate 0.6.1

Highlights

• Dedicated Codex login per channel through ChatGPT device sign-in or an OpenAI API key. Channel settings show the relevant sign-in flow, and the code can be copied with a click.
• Channel-specific Codex credentials now drive that channel's model selection and Cloud MCP discovery and launch. The shared gateway login remains configured in global Settings.
• Automatic Claude/Codex fallback stays with the conversation across later messages.
• Agents can share files from their channel work folder directly into the current Slack thread.
• Fixed nested background agent reports and updated the release dependency lockfile to address the critical proxy-addr advisory.

Upgrade and evidence

Source tag: v0.6.1 at f2f40e309fded987c17b7da06acde51e65b0bfeb.

The release evidence workflow builds and scans the runtime image, records inventories and checksums, and attests the evidence files. Download its release-evidence-* artifact from that run for the image archive and metadata.

Channel-specific Codex account isolation, Cloud MCP, UI, and failover live cases remain open in TEST-PLAN.md under the owner's release decision. This release does not claim those cases passed.

ChannelGate 0.6.0

ChannelGate 0.6.0: secrets never sit in a channel's container any more, and containers reach the network only through the gateway.

Highlights

• Every channel container runs with --network none behind its own egress proxy. Allow network is now enforced, not advisory: with it off, only the engine APIs and the channel's selected MCP servers are reachable. Private, loopback and metadata addresses are always refused.
• Secrets and logins are placeholders.
  • Known tokens (GitHub, Vercel, Supabase, Make, Composio) and variables with Allowed domains are swapped for the real value in flight, only on their servers.
  • The Claude and Codex logins reach containers as placeholders too.
  • Remote MCP credentials stay in the daemon. SSH sessions run on the same placeholders.
• Every variable is hidden by default, and an admin approves each new server once. The first time a program sends a hidden variable somewhere new, the proxy refuses that one request and posts an admin-only card in the thread. Passwords, connection strings, signing keys and configuration values stay readable automatically. Model APIs never receive a swapped value.
• Variables UI. Slack and the admin page say Variables. Adding one asks only "It's a secret" plus optional Allowed domains, and the admin page lists them in a table.
• Fixes.
  • Codex Read-mode channels run commands again.
  • A non-admin turn is read-only while an Admin channel mounts the operator home.
  • The in-container browser works behind the proxy.
  • The Claude model pickers show exact versions.
  • Codex usage metrics are switched off.
• Also included: keyed paging and count_rows for channel database reads, a Slack Settings Automations page, the Files / Variables / Settings menu on every reply, and retries of transient remote-MCP dials.

Full list: CHANGELOG.md.

Upgrade
Run scripts/update.sh (or the Enterprise automatic updater) from 0.5.7.

• Image rebuild: the runtime image is spec 1.6.1 (bubblewrap, per-channel /tmp volumes). The updater (Settings → Update, or scripts/update.sh) rebuilds the default image automatically. Run npm run build:image by hand only if the update reports that the image build failed, or if the host uses a custom image.
• Migration: migration 30 (egress_grants) applies automatically.
• Existing containers are recreated once.
• Variables without a rule become hidden, so each asks once per server it is used on. set_secret_mode readable or Allowed domains change that.

Evidence

• Release evidence workflow: https://github.com/makeitfutureDev/channelgate/actions/runs/36421072994
• Release PR with the gate results: #115

ChannelGate 0.5.7

ChannelGate 0.5.7 — the HTTP run API now works like an admin's message in its channel.

Highlights

• API runs work like an admin's message. The run API key is an admin credential. Every POST /api/runs turn acts as one fixed api principal. It gets the channel's mode like an admin's message would, including Auto and, in an Admin channel, the permission bypass for a Full run. It also gets channel memory (search, read, save and the post-reply memory review), the organization's and channel's skills and secrets, the channel folder, MCP connections, and the gateway tools, including the admin ones. Before this release every gateway tool was refused to API runs, so Auto mode, memory and approvals never applied.
• No personal scope. An API run uses the channel's shared agent Composio account only. It gets nobody's personal Composio or Toolbox token, secrets, skills or SSH keys. The author a request names is attribution only, and naming a real admin never lends that admin's rank. Background work and schedules an API run starts are owned by api too.
• API runs join their thread's queue. A Slack follow-up in a channel-backed API thread gets the usual Steer / Queue / Cancel choice instead of running concurrently on the same session, and a Slack stop or steer stops the API run.
• A per-run mode no longer rebuilds the channel's container. On an Admin channel with host-home sharing on, a read/worker/auto/lean API run dropped the home mount, waited for every run inside, and recreated the container, killing detached jobs. The next ordinary turn then recreated it back. The mode now narrows tools only.
• resumeCommand from the API opens the session inside the channel's container, like the Slack Resume control.

The runtime image is unchanged from 0.5.6. Full list: CHANGELOG.md.

Upgrade
scripts/update.sh (or the Enterprise automatic updater) from 0.5.6. No migration and no image rebuild are needed. Automations that call /api/runs now run with admin rank in the target channel. Keep the run API key as secret as the admin password.

Evidence

• Release evidence workflow: https://github.com/makeitfutureDev/channelgate/actions/runs/36180787351
• Verify downloaded artifacts: sha256sum -c SHA256SUMS and gh attestation verify <artifact> --repo makeitfutureDev/channelgate
• Automated gate on the exact candidate: 2906 tests passed, 0 failed; static, secret-scan, security-coverage, npm audit and DCO clean; CI green. The live Claude/Codex acceptance cases for the API changes (TEST-PLAN.md, "HTTP run API channel parity") had not run at the cut.

ChannelGate 0.5.6

ChannelGate 0.5.6 — file handoff to Composio that actually works, whole-folder Google Drive sync, Codex over SSH, and Slack Settings as tabs.

Highlights

• Send generated files to Drive, Gmail and other Composio tools. stage_file_for_composio now stages through the hosted MCP's workbench when the stored token is a consumer (ck_) key, which the REST upload rejects — so personal Composio tokens work. The file is read from the descriptor the gateway proved, never re-opened by path. Every run's Composio notice now carries the handoff rule, so Codex stages instead of relaying base64.
• Google Drive sync covers the whole channel folder, not a Drive/ subfolder. Agent instructions and skills, channel memory, secrets and key files, .git and dependency trees never sync; .driveignore adds your own exclusions; symlinks are never followed; and rclone now runs in a throwaway container that sees only the channel folder, its sync state and the key. A folder that was empty when linked no longer stops syncing forever, and a folder that contains the home or the gateway's data is refused.
• Codex over SSH gets what a chat turn's Codex gets: the gateway tools, your own and the channel's Composio accounts, the channel's MCP servers and your channel secrets, starting in the channel folder. with-secrets <command> runs any other command with those secrets. VS Code over SSH opens its folder dialog in the channel folder.
• Slack ⚙️ Settings pages are a row of tabs again (General · Resume · MCP · Skills · Secrets); an unset model now names the channel's own harness default. The managed instructions forbid recommending a blanket container prune.

The runtime image is unchanged from 0.5.5. Full list: CHANGELOG.md. Signed release evidence: the Release evidence workflow run for v0.5.6.

ChannelGate 0.5.5

ChannelGate 0.5.5 — everything since 0.5.1 (0.5.2–0.5.4 had no release page), and the first signed release since 0.5.2.

Highlights

• SSH into a channel's container instead of the gateway host, including VS Code Remote-SSH on one VS Code server shared by every channel. Interactive claude over SSH is the same Claude a Slack turn runs: same lockdown, gateway and Composio tools, secrets, and a signed-in account. Setup: docs/SSH-ACCESS.md.
• Claude Opus 5.5 and GPT-6 Sol / GPT-6 Luna (Claude Code 2.1.281, Codex CLI 0.156.1), with GPT-6 rates in the Codex cost estimate.
• Failover keeps a conversation's tools when one engine runs out of quota, and the gateway's own notices (failover, license, skipped MCP) now appear in streamed answers.
• Usage you can trust: usage outside chat is counted, one Claude response is no longer charged several times, per-model Claude rates, and charts stacked by model.
• Secrets in three scopes (organization, personal, conversation), with one tool per verb.
• Slack ⚙️ Settings, reworked: five pages behind one dropdown. Access, engine/model and the skill template are edited in place, and the VPN sits under the network switch. The admin reset all channels asks whether to include existing threads' pins and now resets effort too.
• Files leave Slack when asked: "just send me the file" sends it, plus temporary public file links for APIs that ingest by URL.
• A second Anthropic-compatible harness (Qwen EU), on-demand Google Drive sync, the channel-VPN health-check fix, and more. Full list in CHANGELOG.md.

Security: the runtime image no longer carries SSH host private keys. Installing openssh-server generated /etc/ssh/ssh_host_*_key. Nothing used them (each channel has its own key), but every channel container on a host held the same three keys. They are now deleted in the step that installs sshd.

Upgrade: npm run update (or scripts/update.sh). It rebuilds the runtime image itself (spec 1.3.0 → 1.5.1), and channel containers are recreated on their next run; if that step warns, run npm run build:image. Three additive database migrations (v27–v29: SSH keys and sessions, external usage, public file links). No dependency changes. SSH access is optional and needs the root installer scripts/install-ssh-access.sh.

Tags without artifacts: v0.5.3 and v0.5.4 exist, but their signed build stopped at the image secret scan (the host keys above), so they have no release artifacts. Use 0.5.5.

Evidence: full regression suite, static analysis, secret scan, security coverage, dependency audit and DCO passed on the exact candidate; CI green. Signed build evidence (runtime image archive, SPDX inventory, model hashes, checksums, GitHub attestations) is in the release workflow run. Its image scan waived 31 reviewed public look-alikes, each pinned to its official upstream archive in scripts/reviewed-artifact-fixtures.json, and found nothing else. Verify with sha256sum -c SHA256SUMS and gh attestation verify <artifact> --repo makeitfutureDev/channelgate. Live acceptance covered Claude for the SSH, failover and file-delivery work. Codex live acceptance, the later Settings changes and the full live campaign were not run for this release (see docs/RELEASE-ACCEPTANCE.md).

ChannelGate 0.5.1

ChannelGate 0.5.1 — the first update after the 0.5.0 public release.

Highlights

• Qwen (Claude Code) harness (optional): the Claude Code CLI driven against QwenCloud's Anthropic-compatible endpoint, with its own key, base URL and live model list. Off until an admin enables it; no Anthropic credential ever reaches a Qwen run; outside automatic failover; tokens recorded with no invented cost.
• Admin-only /sudo threads: an organization admin can switch one Slack thread to direct host execution; everyone else is rejected before anything runs.
• Interactive Slack question cards for Claude and Codex, durable across restarts.
• Channel VPNs on OpenVPN 3 with chat, web and Slack controls, plus bounded read-only channel database queries.
• Unusable Cloud MCP selections are dropped from a run (with the reason shown) instead of failing the turn.
• Personal quiet-thread reminders, native Slack image attachments and previews, host rclone provisioning, Codex capacity and pricing fixes, and more. Full list in CHANGELOG.md.

Upgrade: npm run update (or scripts/update.sh). Adds one database migration (v26, a new table); no dependency or runtime-image changes.

Evidence: full regression suite, static analysis, secret scan, security coverage, dependency audit and DCO passed on the exact candidate; CI green. Signed build evidence (runtime image archive, SPDX inventory, model hashes, checksums, GitHub attestations) is in the release workflow run. Verify with sha256sum -c SHA256SUMS and gh attestation verify <artifact> --repo makeitfutureDev/channelgate. Live acceptance covered Claude and Qwen; Codex live acceptance and the full live campaign were not run for this release (see docs/RELEASE-ACCEPTANCE.md).