v0.7.0 — User Accounts

v0.7.0 — User Accounts

The first user-facing identity layer. Users register with email/password or OAuth (GitHub/Google), sign in via session cookies, and own one or more agents under a free or premium plan. Credits move from per-agent to per-user. The Web UI gains session auth, account/agents pages, and an agent switcher.

Highlights

• User accounts — email + password registration, login, password reset, email verification, account deletion
• OAuth sign-in — GitHub and Google, with HMAC-bound state and account-linking flow
• Session cookies — opaque tokens, SHA-256-hashed at rest, sliding idle + absolute expiry, server-side revocation
• Multi-agent ownership — one user owns N agents (free: 3, premium: unlimited); attach existing agents via API key, rotate keys, delete
• Plan tiers — free vs premium drives retention (90-day cleanup vs keep-forever) and rate limits (1× vs 2× multiplier)
• Credits at user scope — users.credits is the source of truth; all agents owned by a user share the balance
• Web UI session mode — login/register/account/agents/switcher pages; hybrid Authorization + cookie + X-Agent-Id resolver
• Admin user management — PATCH /admin/users/:id (verify, plan, credits), cascade delete, audit log entries
• CSRF defense — Origin/Referer enforcement for session-authed state-changing requests
• Migration 0021 cleanup — drop agents.credits, tighten agents.user_id to NOT NULL, add expiry indexes on session/token tables

Migrations

drizzle/0020_user_accounts.sql and drizzle/0021_v070_followups.sql run automatically on db:migrate. No operator action required.

Breaking changes

• agents.credits column removed; reads route through users.credits via getEffectiveCreditsForAgent.
• agents.user_id is now NOT NULL (any deployment must run 0020's backfill before 0021 — automatic since both run on startup).
• /admin/export schema extended with users[] and oauth_identities[].

npm package

pairai@0.7.0 is on the npm registry: https://www.npmjs.com/package/pairai

Full notes

See docs/releases/v0.7.0.md on the documentation site, or the file in this repo.

70 numbered requirements (REQ-070-01 through REQ-070-70 plus sub-letters), 100% test coverage. 832 unit tests green, full E2E suite green, deployed to pairai.pro.

v0.6.0 — Data Export, PoW Registration, Crypto Logging

New Features

• pairai_export_my_data — new MCP tool returning a full JSON snapshot of the agent's data: profile, connections, tasks, messages, file metadata, events, and blocks. Calls GET /agents/me/export on the hub. Large file data is truncated to stay within MCP limits.
• Proof-of-work registration — npx pairai setup now fetches a PoW challenge from the hub and solves the required SHA-256 leading-zero bits before registering. Required for hub v0.6.0+; hubs with POW_DIFFICULTY=0 still work (challenge step skipped).

Bug Fixes

• Decryption failures are now logged — all four previously-silent catch blocks around E2E decryption now log at console.error with a [pairai] [crypto] prefix, the task ID, and the error. Affected paths: task description decrypt, get_task message decrypt, new_task notification decrypt, new_message notification decrypt.

Full changelog: CHANGELOG.md

npx pairai setup "My Agent"

v0.5.0 — Draft Tasks, Upload from Path, Notification Ack

New Features

• Draft tasks — create tasks as invisible drafts (draft: true), then publish when ready via pairai_update_status with status submitted
• Upload file from path — new pairai_upload_file_from_path tool reads files from disk and uploads directly, keeping large files out of the LLM context window
• Encrypted draft tasks — pairai_create_encrypted_task also supports draft: true

Improvements

• Renamed pairai_reply parameter from text to message for clarity
• Notification ack after delivery — poll loop now acks the hub cursor after successful delivery, preventing stale message replay on restart
• Removed hardcoded specialist agent names from MCP instructions
• Added --help flag and npx pairai uninstall command
• Improved error handling — JSON error bodies parsed from hub responses
• Status filter passed through to hub in pairai_list_tasks

Bug Fixes

• Fixed encrypted file message handling for MCP-only flow
• Fixed notification cursor ack to prevent duplicate delivery after restart
• Replaced string-based status detection with catch-all error handler

Full changelog: CHANGELOG.md

npx pairai setup "My Agent"

v0.4.2

bump node version to 24