v0.4.0

What's Changed

• Add child workspaces feature by @adeeshaek in #1706
• docs: fix stale references after listReviewRequests refactor by @detail-app[bot] in #1709
• Fix #1712: Fetch all ratchet review comments by @martin-purplefish in #1715
• docs: update Vite version in STACK.md by @detail-app[bot] in #1704
• docs: update CORS and slash command comments after CLI auto-config changes by @detail-app[bot] in #1705
• docs: add child workspaces feature to documentation by @detail-app[bot] in #1708
• Fix #1713: Warn in detail archive dialog by @martin-purplefish in #1720
• Fix #1714: Deduplicate ratchet PR fetches by @martin-purplefish in #1716
• [codex] Show GitHub CLI auth setup warning by @martin-purplefish in #1717
• Fix #1710: Prevent workspace slash command cache bleed by @martin-purplefish in #1719
• docs: add codeql.yml to CI pipeline documentation by @detail-app[bot] in #1696
• Fix #1711: Deliver pending workspace notifications to agents by @martin-purplefish in #1718
• Fix CORS_ALLOWED_ORIGINS env var being overridden by CLI serve command by @adeeshaek in #1721
• Fix #1723: Isolate ratchet review comments by @martin-purplefish in #1773
• Fix #1724: Harden issue start prompts by @martin-purplefish in #1777
• Fix #1737: Recover auto-iteration resume failures by @martin-purplefish in #1774
• Fix #1725: Harden branch rename prompt context by @martin-purplefish in #1775
• Fix #1760: Paginate review and Linear lists by @martin-purplefish in #1776
• Fix #1730: Harden worktree cleanup paths by @martin-purplefish in #1778
• Fix #1732: Prevent ratchet disable race by @martin-purplefish in #1780
• Fix #1726: Restrict executable tRPC mutations by @martin-purplefish in #1779
• Fix #1757: Make user settings first read atomic by @martin-purplefish in #1781
• Fix #1739: Add Codex RPC request timeouts by @martin-purplefish in #1782
• Fix #1743: Prevent orphaned recycle sessions by @martin-purplefish in #1785
• Fix #1734: Bound file autocomplete search by @martin-purplefish in #1786
• Fix #1744: Preserve archive rollback cache state by @martin-purplefish in #1783
• Fix #1735: Bound workspace output buffers by @martin-purplefish in #1784
• Fix #1765: Prevent duplicate PR status sync batches by @martin-purplefish in #1790
• Fix #1756: Block ACP creation during shutdown by @martin-purplefish in #1791
• Fix #1762: Clear workspace activity on delete by @martin-purplefish in #1793
• Fix #1741: Warn on attachment autosave failure by @martin-purplefish in #1788
• Fix #1754: Bound GitHub clone onboarding by @martin-purplefish in #1797
• Fix #1746: Refresh review badge from snapshots by @martin-purplefish in #1789
• Fix #1728: Authorize terminal websocket replay by @martin-purplefish in #1796
• Fix #1766: Clear ratchet teardown state by @martin-purplefish in #1801
• Fix #1750: Bound chat renderer transcript by @martin-purplefish in #1802
• Fix #1770: Clean up ACP shutdown timers by @martin-purplefish in #1794
• Fix #1772: Preserve concurrent workspace order saves by @martin-purplefish in #1803
• Fix #1733: Bound shell command execution by @martin-purplefish in #1806
• Fix #1742: Coalesce rename interceptor prompts by @martin-purplefish in #1804
• Fix #1738: Scan full port range by @martin-purplefish in #1805
• Fix #1763: Stop chat hydration retry loop by @martin-purplefish in #1792
• Fix #1764: Bind backend port before fallback by @martin-purplefish in #1795
• Fix #1751: Bound Codex history lookup by @martin-purplefish in #1800
• Fix #1753: prevent lost periodic task dispatches by @martin-purplefish in #1798
• Fix #1769: Prevent overlapping terminal resource scans by @martin-purplefish in #1799
• Fix #1755: Fail delete on cleanup errors by @martin-purplefish in #1787
• Fix #1821: Clear auto branch flag after rename by @martin-purplefish in #1822
• Fix #1818: Preserve empty tool result content by @martin-purplefish in #1823
• Fix #1814: Detect project default branch by @martin-purplefish in #1824
• Fix #1816: Evict run-script buffers on workspace delete by @martin-purplefish in #1825
• Fix #1819: Use localhost for 0.0.0.0 CORS default by @martin-purplefish in #1827
• Fix #1815: Sync Kanban cache on workspace transitions by @martin-purplefish in #1828
• Fix #1809: Skip non-file slash commands by @martin-purplefish in #1834
• Fix #1740: Repair session startup rollback by @martin-purplefish in #1835
• Fix #1812: Persist failed session exits by @martin-purplefish in #1831
• Fix #1817: Recover ACP history from metadata session id by @martin-purplefish in #1826
• Fix #1820: replay missed rejected messages by @martin-purplefish in #1829
• Fix #1813: restart ratchet fixer sessions safely by @martin-purplefish in #1830
• Fix #1807: Guard stale session prompt timeouts by @martin-purplefish in #1832
• Fix #1811: Stop ACP clients during pending creation by @martin-purplefish in #1833
• docs: fix session exit status description in auto-iteration-resilience by @detail-app[bot] in #1837
• docs: correct service names and paths in chat-message-flow.md by @detail-app[bot] in #1838
• docs: update workspace-activity service signatures after generation tracking addition by @detail-app[bot] in #1839
• Bump claude-agent-acp to 0.55.0 for Fable model support by @adeeshaek in #1845
• Add Fable to Default Claude model options by @adeeshaek in #1846
• docs: update @agentclientprotocol/claude-agent-acp version in STACK.md by @detail-app[bot] in #1847
• Fix #1841: Restore workspace slash command precedence by @martin-purplefish in #1848
• Fix #1843: Make branch rename metadata atomic by @martin-purplefish in #1849
• Fix #1840: Bound GitHub review request pagination by @martin-purplefish in #1850
• Fix #1808: Resolve nested config path variables by @martin-purplefish in #1852
• Fix #1842: Handle IPv6 wildcard serve CORS origins by @martin-purplefish in #1854
• Fix #1844: Deduplicate JSONL workspace notifications by @martin-purplefish in #1851
• Fix #1767: Retry terminal PID cleanup by @martin-purplefish in #1855
• Fix #1810: shut down on unhandled rejections by @martin-purplefish in #1853
• Fix #1761: Persist run-script exit state reliably by @martin-purplefish in #1856
• Remove dead ratchet review-poll subsystem and relocate reconciliation by @martin-purplefish in #1858
• Fix #1748: Block queued dispatch during session stop by @martin-purplefish in #1857
• Fix #1859: Replace inferred ratchet retry state with explicit dispatch record by @martin-purplefish in #1863
• Fix #1860: Filter resolved review threads out of ratchet dispatch by @martin-purplefish in #1864
• Fix #1861: Flatten ratchet delegation plumbing and consolidate decision/disable logic by @martin-purplefish in #1865
• Cancel timed-out ratchet checks and cap concurrency by @martin-purplefish in #1866
• Fix #1867: Guard WebSocket fan-out sends with safeSend helper by @martin-purplefish in #1875
• Fix #1868: Apply trusted-local validation to all WebSocket channels by @martin-purplefish in #1876
• Fix #1869: WebSocket correctness fixes for delivery ordering and silent failures by @martin-purplefish in #1877
• Migrate UI icons to Phosphor by @martin-purplefish in #1878
• Fix #1870: Consolidate backend WebSocket handler boilerplate by @martin-purplefish in #1879
• Enforce coverage minimums by @martin-purplefish in #1880
• Add backpressure handling to WebSocket output by @martin-purplefish in #1882
• Fix #1871: Consolidate client WS consumers; rebuild SetupTerminalModal on shared transport by @martin-purplefish in #1881
• Fix #1872: Introduce TopicBroadcaster and decouple session domain from WebSocket transport by @martin-purplefish in #1883
• Fix #1884: Carry re-read workspace row in WORKSPACE_STATE_CHANGED by @martin-purplefish in #1891
• Fix #1887: Add explicit transition table and CAS on fromState to ratchet state machine by @martin-purplefish in #1894
• Fix #1885: Persist-first delivery for parent/child workspace messages by @martin-purplefish in #1892
• Fix #1889: Unify snapshot cache merge strategy and session-status derivation by @martin-purplefish in #1893
• Prepare 0.4.0 minor release by @martin-purplefish in #1895

Full Changelog: v0.3.21...v0.4.0