v3.1.0

Plugin compatibility limitation (2026-10-04): atlassian-rovo 1.0.6 from openai/plugins cannot currently activate in Jarvis. It requires remote HTTP authorization and host-connector compatibility; a stdio sandbox policy does not resolve this. Skill-fixture and CI success are not evidence that this plugin works. Tracked in SCRUM-55.

This release adds reviewed runtime plugins with immediate activation for Jarvis and agent teams, and fixes team resume, post-deploy navigation, MCP error reporting, and spawned-agent token accounting.

Features

• Plugin source reputation — distinguish known official OpenAI/Anthropic repositories, community entries listed in official marketplaces, and unverified external sources. Labels are derived by the backend from repository identity; publisher names in plugin manifests do not confer trust. Desktop/mobile source review provides an explicit external-source risk acknowledgement. (#172)
• Direct manual plugin review — users review the pinned download source and then package content, target agent and execution policy directly in Settings. Manual installation no longer creates redundant approval inbox requests; agent-managed installation retains human approval. Downloaded packages, awaiting activation review and live Ready states are distinct. (#172)
• Runtime plugin catalog and management — import supported Claude, Codex, and portable plugin components from approved GitHub sources pinned to immutable commits. Settings → Plugins provides source/content review, explicit agent targets, execution policy, version lookup, disable/uninstall, and separately approved global sharing. Packages are fetched at runtime rather than bundled with Jarvis. The UI follows dashboard design tokens and supports desktop/mobile layouts. (#168)
• Use installed plugins immediately — reviewed skills and supported MCP tools attach to existing chat agents and already-running teams at a safe LLM boundary, with an actual runtime acknowledgement before reporting Ready. Activation does not require a backend restart or replacement team; approved bindings are restored when an agent resumes. (#168)
• Agent-managed plugin installation — Jarvis and team agents can request installation for themselves; authorized orchestrators can target their subordinate agents. Installation still requires the applicable human review and execution approval. A subordinate cannot manage its orchestrator's plugins. (#168)

Fixes

• Recover navigation after deployment — when an old browser tab references a removed JS/CSS route chunk, a localized notice offers reload while retaining the current page and unsent text until the user chooses it. Reload restores the requested route/query/hash; repeated failures do not trigger reload loops. SPA entry HTML uses Cache-Control: no-store while hashed assets remain cacheable. Applies to Meeting Room, Settings, Token usage, Scheduler, MCP servers, Approvals, and other lazy routes. (#165)
• Resume idle teams accurately — live idle members receive session/run-scoped inbox messages; dead or terminal members restore their conversation history in the same logical team and workspace. Active/paused members and reserved roles are preserved. Overlapping resume requests are serialized, and partial/queued/not-resumed outcomes are reported accurately instead of claiming success with zero resumed members. (#166)
• Recover unread work and keep coordinators informed — a startup reconciliation wakes the latest scoped team runs with unread messages while preserving pause intent. Injection returns the saved message ID and wake outcome; failed wake no longer emits a false started state. Worker resume events reopen the completion cycle so later results reach the orchestrator, and idle reports no longer declare the goal finished. (#171)
• Correct spawned-agent token totals — account for the producer's per-call usage instead of subtracting it as cumulative totals. Durable event identities prevent duplicate persistence and SSE updates on replay; cache/reasoning counts and model changes remain intact. The dashboard discloses configuration-derived estimates, generic fallback pricing, and historical provenance limits. (#171)
• Report plugin failures correctly — permission and RPC failures carry MCP isError=true, so Team Monitor renders failure rather than a green success. Pending human approval remains a nonerror pending state. (#171)
• Respect isolated databases and shut down cleanly — the meeting bridge uses the application's configured SQLite database. Socket shutdown closes owned clients before waiting for the server, avoiding the Python 3.13 idle-client deadlock; restart and socket ownership protection are preserved. (#171)

Security

• Bound manual activation confirmations — short-lived signed confirmations bind package identity, content digest, target agent and policy revision. Forged, expired or changed confirmations fail closed; signing identity persists in the protected runtime database across workers and restarts. (#172)
• Reviewed source, content, target, and execution policy — plugin downloads are bounded and verified against pinned source/content hashes. Source inspection does not execute plugin code. Unsupported contributions fail closed rather than being silently activated. (#168)
• Optional isolated MCP execution — supported executable plugins use reviewed immutable OCI images with network disabled, a non-root user, read-only package/root filesystem, dropped capabilities, explicit encrypted credential slots, and resource limits. Plugins do not inherit host credentials or the container daemon socket; Jarvis never falls back to host execution. Skills work without this execution profile. (#168)

Tests

• WebSocket authentication tests avoid starting a real speech-recognition worker, preventing unnecessary STT child-process hangs during test teardown. (#164)
• Added actual SDK serialization, SQLite migration/deduplication, socket ownership/shutdown, production-build route recovery, desktop/mobile UI, and real-LLM team resume/recovery coverage. Acceptance reports and screenshots are included in the relevant PRs. (#165, #166, #168, #171)

Upgrade notes

• Update the repository and pinned submodules together, back up persistent data and encryption keys, then restart the backend. SQLite migrations add plugin state and a nullable unique token-event identity; existing historical token rows are preserved.
• The fast-agent dependency is pinned to 8ac92274186d3db25fa4da6f49bb5fa3c3491032. Use the repository's pinned revision rather than independently advancing the submodule during this upgrade.
• Plugin compatibility covers supported skills and sandboxed stdio MCP components, not complete Claude/Codex host emulation. Hooks, commands, LSP and unknown private host connectors remain unsupported and blocked. Reviewed native Atlassian Rovo remote MCP is supported by #174; this does not enable arbitrary remote MCP or full host emulation.
• Executable plugin MCP is opt-in: the standard Docker Compose deployment does not enable the required container execution profile. Follow the sandbox operator guide and review each package's policy before activation. The networkless profile cannot run remote API integrations; packages requiring additional runtimes need a separately reviewed image.
• Pricing remains an estimate from configured model rates, not a provider invoice. Generic model aliases may use unverified fallback prices. Older undercounted spawn records are not silently rebuilt without validated source traces; this accounting correction is not a token-saving claim.
• Team recovery reuses durable inboxes and framework launch guards; external effects and provider calls are not guaranteed exactly once across arbitrary crashes. Authentication remains single-tenant, and human review remains necessary for third-party instructions.

Known limitations

• Agent-requested plugin installation still needs explicit retry after source approval. Durable continuation and pending request visibility in Settings remain tracked in SCRUM-53; manual Settings installation uses the direct review flow above.
• Team Monitor may require a page refresh to show resumed runs after a backend restart; automatic reconciliation remains tracked in SCRUM-47.
• The optional finance MCP's dependency incompatibility with MCP SDK 2.x remains tracked in SCRUM-44.

Full changelog: v3.0.0...v3.1.0

v3.1.0 retag (2026-10-03): updated to merged commit 6585710023d8a581a314c1a98202a63101fffe3a to include #172. Previously published tag pointed to 8b96706340fbb5945babb3247e04fa5f1e3c8637.

Plugin activation UX — #173

• Select All available agents to activate a plugin for the current runtimes. The confirmation lists each target; agents created later are excluded.
• See readable compatibility blockers and guidance when activation is unavailable, with a distinct Activation blocked state.
• Review each runtime using signed confirmations and see individual activation results. Partial failures remain visible without automatic retries or polling. Changed package content or permissions abort the review before activation.
• Validation: 2,529 backend tests and 131 frontend E2E tests passed in CI; direct localhost UI testing confirmed three real runtimes could immediately read an activated skill. Source acquisition used a self-authored fixture.
• Plugin-defined agents and host connectors remain unsupported; adapter work is tracked in SCRUM-55.

v3.1.0 retag (2026-10-04): updated from 6585710023d8a581a314c1a98202a63101fffe3a to merged commit b88258a3aa67aefe276d217324de765740829bcd to include #173.

Native Atlassian Rovo — #174

• Install the official OpenAI atlassian-rovo package using the reviewed native HTTP MCP/OA...

v3.0.0

This release adds live per-agent model selection and durable requirement changes for independent agent teams, with fixes for child MCP startup, team recovery, and hands-free voice sessions.

Features

• Live per-agent model selection — choose models for built-in, dynamic, and team agents from the dashboard or through authorized MCP tools. Changes take effect at the next LLM call; the current call finishes on its captured model. Revision checks prevent stale edits, and a gateway probe rejects models that cannot complete a request. The selector supports searchable suggestions, light/dark themes, and mobile layouts. (#161)
• Change team requirements while work is running — Jarvis can track independent team sessions in a conversation and send numbered, persisted requirement changes to the intended orchestrator. Monitor shows the revision, and unread changes are recovered after a backend restart. (#159)
• Selective Jira and Confluence reads — opt into Jira brief results or Confluence metadata, compare page versions, and read selected attachments. Full output remains the default. An explicitly empty Jira description is preserved so agents can distinguish it from an omitted field. (#159)

Fixes

• Child-agent MCP startup — fixes the event-loop failure that left spawned agents unable to connect to most configured MCP servers. Teams can connect their tools and retain skills when resumed. (#160, #159)
• Team message routing and recovery — communication, prompt injection, history, and live events use session identity. Ambiguous name-only controls return a conflict. Inbox acknowledgement and restart recovery reduce lost directives, and lifecycle events preserve the PM's name so worker completion wakes the correct orchestrator. (#159)
• Monitor and notification updates — live turns survive a slower initial-history response, and chat/notifications share the global activity stream to reduce competing browser connections. (#159)
• Hands-free session ownership — only one voice session can own the shared speech recognizer. A second tab or device receives a busy message without disturbing the first; startup failures release ownership for a later connection. (#158)
• Generated MCP verification — the latest test result for each tool wins, so an earlier success cannot hide a later failure. (#157)

Security

• Content-bound generated MCP approval — approval and verification are tied to the reviewed candidate. Changed code requires a new review, forbidden-pattern findings block verification, and approval gates cover installation and execution. This continues to operate within the trusted internal shell/OS-user boundary; it does not add per-agent sandboxing. (#159)

Upgrade notes

• Update the repository and its pinned submodules together, back up persistent data, and restart the backend. New SQLite tables persist team bindings, requirement revisions, and model overrides.
• Live model switching supports openai.<model> IDs through the configured OpenAI-compatible gateway. Switching provider families is not supported by this release.
• A requirement marked delivered has been queued in the team's inbox; this does not mean it has been completed. External side effects are not guaranteed exactly once after a crash. Agent display names remain globally unique.

Full changelog: v2.15.0...v3.0.0

v2.15.0

Features

• Telegram slash-command menu — gateway commands (/new, /agent, /whoami, /help) are now published to Telegram via setMyCommands, so they appear as / autocomplete in the bot chat (Zalo's Bot API has no command registration, so it's off there). The gateway enable toggle also persists instantly now — flip-to-save, reverts on failure — instead of silently requiring a separate "Save changes". (#128)

Performance

• Faster TTS pre-generation — pre-gen chapter status is tracked in SQLite as the single source of truth, dropping a full-disk scan on every tick. (#125)

Fixes

• Memory-index self-heal — LadybugDB corrupt-WAL recovery now clears every WAL sidecar (incl. .wal.checkpoint), so the disposable graph reliably rebuilds after an ungraceful shutdown. (#126)
• Roborock session persistence — the IoT login session is stored encrypted in the DB instead of a git-cleaned file, so 2FA no longer recurs on every deploy. (#127)
• Knowledge-graph language — memory-graph triples were hardcoded to Vietnamese; the extraction prompt is now English-anchored / language-following, so the graph matches the chat language. (#132)

Docs

• New "See it in action" README section with demo GIFs: the agent team (orchestration tree), durable memory (teach → recall across conversations), direct sub-agent chat + real IoT vacuum status, and the self-extending agent building its own MCP tool live. (#131, #133–#136)

Dependencies

• Frontend bumps: js-yaml 5.2.1, @types/node 26.1.0, npm-minor group. (#122–#124)

Full changelog: v2.14.1...v2.15.0

v2.14.1

Aggregates everything shipped since the last published release (v2.12.1): four merged PRs across agent memory, compaction, and frontend dependencies. The headline fix resolves a production regression where saving a memory stalled the chat turn and surfaced "Unknown error".

Features

memory: dense-index fail-loud health and one-click repair; conflict-aware recall — #120

• The LadybugDB dense/graph index now reports its health explicitly instead of failing silently, with a one-click repair to re-project from SQLite.
• Recall is conflict-aware: when two memories contradict on the same attribute, the newer one wins.

compaction: spawned agents self-compact — #119

• Spawned sub-agents now compact their own context at the configured threshold, reaching parity with in-process agents.

Bug fixes

memory: conflict gate no longer stalls the chat turn — #121

• Root cause: the conflict-resolution gate re-embedded the entire memory slot on every save (a single batch padded to the longest fact, cost O(N × max_len) ≈ 150s of CPU) and ran on the main asyncio event loop. The synchronous embed froze the loop for its full duration, hanging the live chat turn's SSE stream and surfacing "Unknown error" (the memory was still persisted).
• Change: the gate now embeds only the new fact and scores candidates against their already-stored LadybugDB vectors, running off the loop via asyncio.to_thread. Candidates outside the dense-query window are embedded individually so a same-slot conflict is never silently missed.
• Impact (measured on production): memory_remember dropped from 133,460 ms to 2,477 ms; /api/health from 71 s to 0.004 s; duplicate supersede still correct.

Dependencies

frontend: bump the npm-minor group, 10 packages — #111

• vue 3.5.35 → 3.5.38, vite 8.0.16 → 8.1.0, dompurify 3.4.7 → 3.4.11, marked 18.0.4 → 18.0.5, @playwright/test 1.60.0 → 1.61.1, @codemirror/view 6.43.0 → 6.43.3, @codemirror/state 6.6.0 → 6.7.0, @tanstack/vue-virtual, @tailwindcss/vite.

Pull requests since v2.12.1

PR	Title	Author	Merged
#121	fix(memory): conflict gate reuses stored vectors + runs off the event loop	@omnigentx	2026-07-02
#120	feat(memory): dense-index fail-loud health + one-click repair; conflict-aware recall	@omnigentx	2026-07-01
#111	build(deps): bump the npm-minor group (10 updates)	@dependabot	2026-07-01
#119	feat(compaction): spawned agents self-compact (parity with in-process)	@omnigentx	2026-06-30

Full changelog: v2.12.1...v2.14.1

v2.12.1 — Memory recall reflects settings changes

Fix: agent-memory recall now reflects settings changes immediately.

Fixed

• Memory recall ignored settings changes until the index happened to change. The retrieval cache was keyed only by query + memory-index revision, so editing a recall-affecting setting left already-cached queries returning the old result. Most visibly: enabling the reranker (or changing the relevance gate / rerank knobs) appeared to do nothing — a repeated query kept serving its pre-rerank, fusion-only result until an unrelated memory write bumped the index revision. The cache key now embeds a fingerprint of the recall-affecting settings, so any such change invalidates the affected cached queries at once and the next recall reflects the new configuration. (#118)
• deep and balanced recall could share a cache entry. request.mode is now part of the cache key, so a deep query (which escalates a corrective round and gets a larger evidence budget) is never served a balanced cached result, and vice-versa. (#118)

Internal

• services/retrieval/cache.py: add settings_fingerprint() + _RECALL_AFFECTING_KEYS; cache_key() gains mode and settings_fp (both additive, backward-compatible).
• services/retrieval/orchestrator.py: pass mode + settings fingerprint into the key.
• Capture / curator / retention / approval settings are intentionally excluded from the fingerprint — they don't affect the recall read path, so they don't bust the cache.
• Tests: 35 passed (retrieval core + orchestrator + recall e2e + reranker), ruff clean.

Upgrade notes: none. No config, schema, or API changes. On restart the in-process recall cache is empty as usual; the fix only makes the cache key more specific (more correct misses, never a wrong hit). No model re-download.

Full changelog: v2.12.0...v2.12.1

v2.10.0

This release adds Telegram & Zalo messaging gateways and fixes a significant memory-recall latency regression.

✨ Features

Messaging Gateways — Telegram & Zalo (#113)
Chat with a Jarvis agent directly from Telegram and Zalo.

• Long-polling Bot APIs — no public domain or webhook required.
• Inbound images are passed to the agent as multimodal input.
• In-chat slash commands: /new (/reset, /clear), /agent <name>, /whoami (/id), /help.
• Secure onboarding: unauthorized senders never reach the agent — the bot replies with only their user id, so you can allow-list it without ever opening access to everyone.
• Configurable live from Settings → Messaging Gateways (no restart); the UI warns when the allow-list is set to *, and bot tokens are always redacted from logs.

Memory — retrieval telemetry (#108)

• Real retrieval-latency measurement and a redesigned "Recent searches" panel.

⚡ Performance & Fixes

Memory — reranking latency on CPU (#112)

• Fixes a multi-second recall stall when reranking the top 20 candidates. The previous default reranker (Qwen/Qwen3-Reranker-0.6B, a 600M causal LM) measured ~0.87 s/candidate on CPU — about 17 s to rerank the top 20 for a one-line query. The default is now BAAI/bge-reranker-v2-m3, a multilingual (VI + EN) cross-encoder roughly 10× cheaper on CPU, and rerank_top_k is reduced from 20 → 5 (each candidate is a forward pass, so latency scales with it). Recall now stays well under ~1 s.
• Reranker-model switches now stream real-time download progress in Settings instead of hanging silently on the first recall.
• The chat "tools used" panel now shows each tool's own result.

🔧 Maintenance

• Bump actions/checkout 6 → 7 (#110) and actions/cache 5 → 6 (#109).

Full changelog: v2.9.0...v2.10.0

2.8.2 First Release