v3.1.0

Plugin compatibility limitation (2026-10-04): atlassian-rovo 1.0.6 from openai/plugins cannot currently activate in Jarvis. It requires remote HTTP authorization and host-connector compatibility; a stdio sandbox policy does not resolve this. Skill-fixture and CI success are not evidence that this plugin works. Tracked in SCRUM-55.

This release adds reviewed runtime plugins with immediate activation for Jarvis and agent teams, and fixes team resume, post-deploy navigation, MCP error reporting, and spawned-agent token accounting.

Features

• Plugin source reputation — distinguish known official OpenAI/Anthropic repositories, community entries listed in official marketplaces, and unverified external sources. Labels are derived by the backend from repository identity; publisher names in plugin manifests do not confer trust. Desktop/mobile source review provides an explicit external-source risk acknowledgement. (#172)
• Direct manual plugin review — users review the pinned download source and then package content, target agent and execution policy directly in Settings. Manual installation no longer creates redundant approval inbox requests; agent-managed installation retains human approval. Downloaded packages, awaiting activation review and live Ready states are distinct. (#172)
• Runtime plugin catalog and management — import supported Claude, Codex, and portable plugin components from approved GitHub sources pinned to immutable commits. Settings → Plugins provides source/content review, explicit agent targets, execution policy, version lookup, disable/uninstall, and separately approved global sharing. Packages are fetched at runtime rather than bundled with Jarvis. The UI follows dashboard design tokens and supports desktop/mobile layouts. (#168)
• Use installed plugins immediately — reviewed skills and supported MCP tools attach to existing chat agents and already-running teams at a safe LLM boundary, with an actual runtime acknowledgement before reporting Ready. Activation does not require a backend restart or replacement team; approved bindings are restored when an agent resumes. (#168)
• Agent-managed plugin installation — Jarvis and team agents can request installation for themselves; authorized orchestrators can target their subordinate agents. Installation still requires the applicable human review and execution approval. A subordinate cannot manage its orchestrator's plugins. (#168)

Fixes

• Recover navigation after deployment — when an old browser tab references a removed JS/CSS route chunk, a localized notice offers reload while retaining the current page and unsent text until the user chooses it. Reload restores the requested route/query/hash; repeated failures do not trigger reload loops. SPA entry HTML uses Cache-Control: no-store while hashed assets remain cacheable. Applies to Meeting Room, Settings, Token usage, Scheduler, MCP servers, Approvals, and other lazy routes. (#165)
• Resume idle teams accurately — live idle members receive session/run-scoped inbox messages; dead or terminal members restore their conversation history in the same logical team and workspace. Active/paused members and reserved roles are preserved. Overlapping resume requests are serialized, and partial/queued/not-resumed outcomes are reported accurately instead of claiming success with zero resumed members. (#166)
• Recover unread work and keep coordinators informed — a startup reconciliation wakes the latest scoped team runs with unread messages while preserving pause intent. Injection returns the saved message ID and wake outcome; failed wake no longer emits a false started state. Worker resume events reopen the completion cycle so later results reach the orchestrator, and idle reports no longer declare the goal finished. (#171)
• Correct spawned-agent token totals — account for the producer's per-call usage instead of subtracting it as cumulative totals. Durable event identities prevent duplicate persistence and SSE updates on replay; cache/reasoning counts and model changes remain intact. The dashboard discloses configuration-derived estimates, generic fallback pricing, and historical provenance limits. (#171)
• Report plugin failures correctly — permission and RPC failures carry MCP isError=true, so Team Monitor renders failure rather than a green success. Pending human approval remains a nonerror pending state. (#171)
• Respect isolated databases and shut down cleanly — the meeting bridge uses the application's configured SQLite database. Socket shutdown closes owned clients before waiting for the server, avoiding the Python 3.13 idle-client deadlock; restart and socket ownership protection are preserved. (#171)

Security

• Bound manual activation confirmations — short-lived signed confirmations bind package identity, content digest, target agent and policy revision. Forged, expired or changed confirmations fail closed; signing identity persists in the protected runtime database across workers and restarts. (#172)
• Reviewed source, content, target, and execution policy — plugin downloads are bounded and verified against pinned source/content hashes. Source inspection does not execute plugin code. Unsupported contributions fail closed rather than being silently activated. (#168)
• Optional isolated MCP execution — supported executable plugins use reviewed immutable OCI images with network disabled, a non-root user, read-only package/root filesystem, dropped capabilities, explicit encrypted credential slots, and resource limits. Plugins do not inherit host credentials or the container daemon socket; Jarvis never falls back to host execution. Skills work without this execution profile. (#168)

Tests

• WebSocket authentication tests avoid starting a real speech-recognition worker, preventing unnecessary STT child-process hangs during test teardown. (#164)
• Added actual SDK serialization, SQLite migration/deduplication, socket ownership/shutdown, production-build route recovery, desktop/mobile UI, and real-LLM team resume/recovery coverage. Acceptance reports and screenshots are included in the relevant PRs. (#165, #166, #168, #171)

Upgrade notes

• Update the repository and pinned submodules together, back up persistent data and encryption keys, then restart the backend. SQLite migrations add plugin state and a nullable unique token-event identity; existing historical token rows are preserved.
• The fast-agent dependency is pinned to 8ac92274186d3db25fa4da6f49bb5fa3c3491032. Use the repository's pinned revision rather than independently advancing the submodule during this upgrade.
• Plugin compatibility covers supported skills and sandboxed stdio MCP components, not complete Claude/Codex host emulation. Hooks, commands, LSP and unknown private host connectors remain unsupported and blocked. Reviewed native Atlassian Rovo remote MCP is supported by #174; this does not enable arbitrary remote MCP or full host emulation.
• Executable plugin MCP is opt-in: the standard Docker Compose deployment does not enable the required container execution profile. Follow the sandbox operator guide and review each package's policy before activation. The networkless profile cannot run remote API integrations; packages requiring additional runtimes need a separately reviewed image.
• Pricing remains an estimate from configured model rates, not a provider invoice. Generic model aliases may use unverified fallback prices. Older undercounted spawn records are not silently rebuilt without validated source traces; this accounting correction is not a token-saving claim.
• Team recovery reuses durable inboxes and framework launch guards; external effects and provider calls are not guaranteed exactly once across arbitrary crashes. Authentication remains single-tenant, and human review remains necessary for third-party instructions.

Known limitations

• Agent-requested plugin installation still needs explicit retry after source approval. Durable continuation and pending request visibility in Settings remain tracked in SCRUM-53; manual Settings installation uses the direct review flow above.
• Team Monitor may require a page refresh to show resumed runs after a backend restart; automatic reconciliation remains tracked in SCRUM-47.
• The optional finance MCP's dependency incompatibility with MCP SDK 2.x remains tracked in SCRUM-44.

Full changelog: v3.0.0...v3.1.0

v3.1.0 retag (2026-10-03): updated to merged commit 6585710023d8a581a314c1a98202a63101fffe3a to include #172. Previously published tag pointed to 8b96706340fbb5945babb3247e04fa5f1e3c8637.

Plugin activation UX — #173

• Select All available agents to activate a plugin for the current runtimes. The confirmation lists each target; agents created later are excluded.
• See readable compatibility blockers and guidance when activation is unavailable, with a distinct Activation blocked state.
• Review each runtime using signed confirmations and see individual activation results. Partial failures remain visible without automatic retries or polling. Changed package content or permissions abort the review before activation.
• Validation: 2,529 backend tests and 131 frontend E2E tests passed in CI; direct localhost UI testing confirmed three real runtimes could immediately read an activated skill. Source acquisition used a self-authored fixture.
• Plugin-defined agents and host connectors remain unsupported; adapter work is tracked in SCRUM-55.

v3.1.0 retag (2026-10-04): updated from 6585710023d8a581a314c1a98202a63101fffe3a to merged commit b88258a3aa67aefe276d217324de765740829bcd to include #173.

Native Atlassian Rovo — #174

• Install the official OpenAI atlassian-rovo package using the reviewed native HTTP MCP/OAuth adapter. Encrypted credentials and serialized rotating refresh work across agent runtimes and restarts.
• Reject anonymous HTTP-200 catalogs as disconnected, invalidate rejected credentials safely, and push accurate account readiness to Settings; disconnected accounts cannot appear Ready or activate from stale bindings.
• Agent plugin inventory returns authoritative current runtime identity after resume. Actual localhost UI acceptance covers Jarvis/PM self-install, PM-to-Dev installation, immediate real Jira reads, permission denial and official Anthropic skill use.
• Protect OAuth callback code/state from proxy logs and cover callback privacy/cache behavior with actual Docker tests.
• Final PR HEAD CI: 2,566 backend tests passed (7 skipped, 5 deselected, 1 xfailed); frontend E2E, production build and Docker proxy tests succeeded. Acceptance evidence and limits.

Deployment requirement: configure the exact HTTPS JARVIS_PUBLIC_URL in the persistent production environment before using browser OAuth, then perform a deployed consent/callback smoke test. Local TLS regression is not proof of production OAuth acceptance. Approval continuation remains explicit (SCRUM-53); generic connector/agent compatibility and capability-aware delegation remain limited as documented.

v3.1.0 retag (2026-10-05): updated from b88258a3aa67aefe276d217324de765740829bcd to merged commit dc9ef1379792eb210d6b11da9b0a75a55d063d96 to include #174.