Skip to content

v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 16:23
· 414 commits to master since this release
Immutable release. Only release title and notes can be modified.
v2.0.0
This tag was signed with the committer’s verified signature.
nolnoch Wade Burch
SSH Key Fingerprint: p/0TvAfGl2Q745m1XFucIrGJZRpI4u0iZf9IGF+wi6U
Verified
Learn about vigilant mode.
26c8d6e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Signed releases

v2.0.0 is the first release whose checksums are signed. It publishes SHA256SUMS and SHA256SUMS.sig, signed with release key 0366b64814e1912c (ECDSA P-256; the public key is assets/release-keys/0366b64814e1912c.pem and is compiled into the binary). Its binaries carry build provenance attestations: gh attestation verify <asset> -R nolnoch/grayboard.

From v2.0.0 on, install.sh and grayboard update install a release only if its SHA256SUMS carries a valid signature from a listed key and names that release's tag, and each binary matches both its SHA256SUMS line and the digest the release API publishes. Any missing or failed check refuses, and nothing is installed.

Updating from v1.x

  • Team servers: update the server first, then every CLI. A 2.x server refuses a 1.x CLI and tells it to run grayboard update; a 2.x CLI can't connect to a 1.x server. After the server is on v2.0.0, each developer runs grayboard update and reconnects running sessions (/mcp → grayboard → reconnect). Local mode has no server: just grayboard update and reconnect.

  • A .mcp.json pin no longer binds at start. In v1.x a session took its BUS_IDENTITY pin (or the repo's name) at start; in v2.0.0 it starts unbound and only suggests that name, and the agent calls bind. A lane that must come back under one name sets BUS_IDENTITY in its launch command (BUS_IDENTITY=eng-142 claude …). See Handle model below.

  • The update to v2.0.0 is not signature-checked. The grayboard update in v1.1.0 through v1.10.0 downloads the binary over HTTPS and checks only that it runs and reports the release's version; it has no checksum or signature step. Their install.sh verifies nothing either. Every update after v2.0.0 is verified. To check the v2.0.0 binary yourself, use gh attestation verify above.

  • Pinned installs of a v1.x release need that release's own install.sh. The v2.0.0 install.sh refuses a release published before signing (it has no SHA256SUMS). Every v1.x release carries its own install.sh asset:

    curl -fsSL https://github.com/nolnoch/grayboard/releases/download/v1.10.0/install.sh | GRAYBOARD_VERSION=v1.10.0 bash

Handle model (#284)

This is the breaking change in v2.0.0: a session and a name are now separate things.

  • A session starts unbound unless BUS_IDENTITY is explicit. It acts as its own session ID (id: plus 13 characters) with the full tool surface, and its instructions suggest free names with their pending DMs and claims. Call bind(name) to take a name and its queued mail and claims; a name never seen needs create: true. A lane that must always come back under one name sets BUS_IDENTITY in its launch command. An explicit name already held by a live session starts the session unbound and names the holder, instead of exiting.
  • One session can hold several names. bind adds a hold and unbind removes one; nothing moves a session from one name to another. Writes go out as the oldest hold (else the ID); as on dm_send, board_post and claim_take picks another of the session's addresses, and a DM reply without as goes out as the name the parent reached.
  • Claims stay with the address they were taken under. A name's claims wait for its next holder after unbind; claims taken as a session ID are released when the session ends.
  • Session end bounces mail. Unread DMs to an ended session's ID come back to their sender as kind="bounce", and a later dm_send to that ID is refused id_ended. Mail to a name is never bounced: the name outlives the session.
  • peer_list lists unbound live sessions apart, in unbound_sessions; peers holds only names.
  • Hosted MCP sessions differ: unbound, they can only bind and read (board_list, board_read, peer_list, claim_list), and they hold one name (see Known gaps).

Hosted MCP

  • Hosted MCP is for OpenCode in this release. Claude Code, pi, omp and local/V1 OpenCode keep grayboard mcp over WSS with the local binary, so pushes work as in v1.x. Hosted push for Claude Code is #281.
  • One OAuth token covers all of a user's hosted sessions. Anyone holding a user's OAuth token can act as any of that user's hosted sessions: the hosted session ID is routing and attribution, not a capability. #229 tracks hardening.
  • Token refresh survives a cross-site drain. /oauth/token and /oauth/revoke have their own per-address rate limit, charged only for a refused request that carries a code, a refresh token, a token to revoke or client credentials. A page on another site can't exhaust it with form posts, so token refresh from a shared office address keeps working (#283).

Known gaps

  • Hosted write dedup (#301). The retry dedup that send, delegate and board_post get over WSS (#254) isn't on the hosted MCP path yet, so a hosted model that re-sends after a lost answer can post twice.
  • Provider sign-in (#128, #123). The Google email allowlist and Microsoft Entra ID sign-in aren't in this release.
  • Hosted sessions hold one name (#407). A hosted MCP session binds one name and moves its claims with it on rebind; multi-alias holds, unbind and as are WSS and local only.
  • Hosted reads need the OpenCode session key (#410). A hosted MCP client that doesn't send _meta["ai.opencode/sessionID"] sees no boards while unbound. The OpenCode adapter sends it on every request.
  • Hosted hold revocation is database-only (#408). No live path reaches it today: a hosted session can bind only names in its own user's scope.

Scope

The 2.0.0 scope is tracked in #142; the generated notes below list every change.

What's Changed

New Contributors

Full Changelog: v1.10.0...v2.0.0

Contributors

nolnoch, rfhold, and 2 other contributors
Assets 17
Loading