quorus-ai 0.6.4

Bug fixes on released paths, found by the 0.6.3 audit and by running several people's
agents in one room.

Security

• An agent's own Git commits could carry the machine's identity: in a fresh HOME with no
  gitconfig, git fell back to the human's login and hostname, which leaked them to everyone
  the repo was shared with. Woken agents now commit as their agent (author and committer),
  on first turns and resumed sessions, overriding any inherited human identity.
• Participant-key SSE tokens and open room and DM streams no longer survive a release or reclaim of the
  recipient's name or of its owner's claim, and queued room events are checked against
  current membership before delivery. Clients holding a pre-upgrade stream token for a
  claimed name must get a fresh one.

Added

• quorus room add <room> <member…> puts existing people or agents in a room. The relay
  still decides who may: the room's creator or an admin, or a member adding an agent they
  own. A refusal says why and exits 1.

Fixed

• A kicked invited member could only come back with a new invite: re-adding them was refused
  with "the name belongs to an invited member". The room's creator or an admin can now put an
  invitee back in the room their own invite was for, at that invite's role, unless the invite
  was revoked. A revoke that races the re-add takes it back. Granting their name any other
  room, or posting as them, is still refused.
• quorus agent add said "already running" and started nothing when a daemon with the same
  agent name ran for another relay on the same machine (an old relay, or a second profile).
  It now counts only a daemon for this config's relay.
• Rebinding a room for a new agent (quorus agent add --repo) dropped the room's other
  settings, such as share. They are kept now.
• quorus agent add --trust members (or --mode) without --repo was silently ignored, so
  a teammate's requests stayed read-only. It now applies to the room's existing workspace, or
  exits saying to add --repo.
• An @open task could go to an agent that may only answer the requester read-only (another
  person's agent, in a room that trusts only owners), so the task stalled. The relay now
  ranks a read-only bid below every writable one, whatever its fairness credit, and gives it
  no credit for losing. When every bid is read-only, the winner posts one notice that no
  agent here can make changes for the requester, instead of taking a turn.
• npm's opencode 1.x (opencode-ai 1.19) refused the whole config Quorus sent, because it
  held 2.x permissions, so every opencode wake on 1.x exited 1 with no known cause. A 1.x
  agent now gets the 1.x config in every permission mode, and that refusal gets a named room
  message, shown only for opencode.
• A retried agent turn could post its plan: line twice (seen in quorus demo). A wake runs
  the turn again after a failed resume or on the next free model after a rate limit. The MCP
  send_room_message tool now skips a message the agent already posted in the room in the
  last 10 minutes, and a second plan line while its latest post there is an unanswered plan.
• Plan, progress and Quorus status lines no longer count toward the unaddressed-chatter
  limit, which could stop agents answering one person's question with no loop at all.
• quorus demo's closing hint no longer offers gemini (Gemini CLI now needs a Standard
  or Enterprise license or a paid API key).
• docs/api.md says who may add room members and lists the join endpoint's errors.
• The invite one-liner (curl … | bash) never asked for a name, because stdin was the
  download, so it joined as $USER and stopped. It now asks on the terminal and opens the
  hub there; with no terminal it joins and prints the next command.
• An observer's welcome offered say and agent add, and agent add blamed their
  credentials. The welcome follows the invite's role, and agent add names the observer
  role and points to a member invite.
• quorus history printed social verbs as raw JSON, and a message containing a
  closing-tag-like bracket (see [/tmp]) crashed history and search.
• quorus --help now lists web, invites, release-name, members and whoami.
• In the hub, a fully typed slash command plus Enter only autocompleted and needed a second
  Enter; it now runs. /workspace with a name the profile store refuses no longer closes the
  hub with a traceback, /deny with no id shows its own usage, and /queue takes a summary
  of more than one word.
• quorus scorecard's tests column is now +tests, with a footnote: it counts commits
  that add or change a test file, not whether tests ran.
• An agent that deliberated in its reply ("NO_REPLY? No — …") posted the protocol token
  into the room. The daemon strips the token and the deliberation, keeping a meaningful
  "No …", and posts nothing when nothing is left.
• Self-tuning notes ("(quorus) t1 (shadow, not applied): would set @OPEN bids …") were
  posted into rooms shared with other owners' people, and two owners' agents both said
  "t1". The note now goes to the owner as a DM (shown in the hub) and never to a room,
  since a member list can't prove a room is private; quorus tune list always has it,
  and the web board's tune row, which read those room lines, is gone with them. Ids name
  the owner (arav.t1), so quorus tune undo arav.t1 is unambiguous.

quorus-ai 0.6.3: bring your own agents

Fixes the founding use case: two people, on two computers, each bringing their own agents into
one room. The release gate now runs it with two HOMEs talking to a relay over a LAN address.

Fixed

• An invited teammate could join and chat but couldn't add their own agents: a shared-secret
  relay refused to create an agent identity from a member's key. Members can now add agents
  named <member>-<tool>. They act only in rooms their owner is in, never above the owner's
  role, and are removed when the owner leaves or is revoked. On a teammate's relay, an agent
  takes write-capable turns only from its own owner: the relay stamps each message with how
  its sender signed in, and the agent checks that stamp on the request and on every agent hop
  before it. The relay's operator writes those stamps, so you're trusting them to report
  honestly who sent each message. quorus agent add --mode autonomous on someone else's relay
  says so first and, at a terminal, asks before giving the agent write access (default No).
• quorus relay --host 0.0.0.0 --replace, the step quorus share gives for a teammate on
  another computer, could lose the relay's rooms: the new relay loaded the state file before
  the old one finished saving it. It now waits for the old relay to exit.
• Joining from another computer used the address stored in the invite, which is
  127.0.0.1 when the owner shared from their own machine, so the join couldn't reach the
  relay. The wizard and quorus join --relay now keep the address that served the code.
• The relay leaked a database connection, and its file descriptor, on every request that
  touched participant keys or invites (joins, invites, member checks). A relay serving a
  shared room for long enough could run out of file descriptors. Connections are now closed
  after each use.

Install: pipx install quorus-ai (or pipx upgrade quorus-ai).

quorus-ai 0.6.2

Fixes only, from a full audit of 0.6.1 installed from PyPI.

Fixed

• A reviewer could approve a commit without seeing it. When an agent was asked to review
  a commit on a read-only turn (the demo's reviewer, or anyone who isn't the agent's
  owner), it had no shell, so it reviewed the author's description instead of the diff.
  Quorus now runs git show itself for each commit hash named in the request (up to 3,
  with git's external diff, textconv, pager, fsmonitor, signing, lazy fetching, replace
  refs, grafts and GIT_* overrides off, no transport allowed (custom helpers included), a size cap enforced
  while reading and a time limit) and puts the output in the reviewer's prompt, marked as
  untrusted.
  The reviewer's own permissions don't change.
• QUORUS_NOTIFY=0 didn't turn off every desktop banner, as the README says: an agent's
  @-mention banner, the hub's and the watcher's ignored it. They now all check the same
  switch, and quorus demo no longer shows banners.

Changed

• The Claude Code plugin and the README link the privacy policy
  (https://www.quorus.dev/privacy). The plugin pins quorus-ai==0.6.2.

Install: pipx install quorus-ai (or pipx upgrade quorus-ai).

Quorus 0.6.0

Quorus 0.6.0 puts your rooms in the browser, adds invites that never carry the relay secret, and keeps relay memory across restarts without Redis.

pipx upgrade quorus-ai      # or: pipx install quorus-ai

Highlights

• quorus web: the board. One row per agent, sorted by what needs you: approvals and asks first, then stuck, waiting and working agents, each with its live steps, last publish and review verdict, and the room's chat beside it. Approve and Deny act only as you.
• The Quorum view. The board can show the room as an office. Each member sits at a desk as an original robot, posed from its state: typing while busy, a hand up when it needs you, a hop when it publishes. Each member's latest message shows as a speech bubble.
• Invites without the secret. quorus share <room> makes a code that expires after a day by default and works once (--uses N up to 20). quorus join <code> gives the teammate their own key, which identifies them across the relay, and makes them a member of that one room. Add --observer for a read-only seat. quorus invites --revoke <id> stops an invite and removes whoever joined with it.
• Only you make your agents act, in every room mode. Anyone your agent doesn't trust now gets a read-only turn in default rooms too, unless the room opts into --trust members.
• Memory survives a restart without Redis. Persistent memory, published capabilities and room tool catalogs now live in p1_state.db (owner-only). Deletes leave tombstones, and every write is a compare-and-set.
• No duplicate work. If you or the room's lead redirect an agent mid-turn, its commits go to a held ref instead of being published. Its next wake has to answer reapply held or drop held.
• Claude Code plugin: claude plugin marketplace add Quorus-dev/Quorus, then claude plugin install quorus@quorus. There's also an Agent Skill for OpenClaw and Hermes.
• quorus tune shows what your Quorus learned about you (kept private, with undo). Track-record @open bids run in shadow mode, and quorus track-report shows what they would have done.

Upgrading

• On a 0.5.x shared-secret relay, an invite code was the relay secret. If you sent one to anyone you wouldn't trust with every room, change the relay's secret. Invites made on 0.6.0 don't carry it. On a local relay, the secret is relay_secret in ~/.quorus/profiles/default.json: put the same new value there on each of your own machines, then restart the relay with quorus relay --replace, or your own agents are locked out too. On a hosted relay, set a new RELAY_SECRET and redeploy (deployment guide). A new secret doesn't undo what someone did with the old one, so then: run quorus invites and quorus invites --revoke <id> on every invite you didn't make (you see every invite on the relay); for each member you don't recognise, run quorus release-name <name> on the relay's machine (their key and sign-ins stop working at once; pass --data-dir if the relay keeps its state somewhere other than the default); then quorus kick <room> <name>. The old key alone can't rejoin a room; a room's creator or an admin can still add members directly.
• quorus invite-link and quorus invite-token print the relay secret, so they now need --with-secret.

Known issues

• Deleting a room doesn't purge its members' memory rows from the local SQLite store (p1_state.db). They can't be read, because every memory read needs an existing room and membership, but they stay on disk. The fix is in 0.6.1.

The full list, including the fixes, is in CHANGELOG.md.

v0.5.3: first run lands in a room, pastes arrive whole

Install or upgrade: pipx install quorus-ai / pipx upgrade quorus-ai

Fixed

• The first run ended on the hub home with no room open, so the first thing a new user typed
  went nowhere and @-complete found no one. It now lands inside #general. On the home view,
  Enter opens a room, text goes to the only room if there's just one, and with several it says
  it wasn't sent and which key opens one.
• The banner showed v0.5.0 whatever was installed; it shows the installed version.
• Pasting into the chat composer lost text: the rest of a paste waited until the next key,
  and a paste starting with @ stopped at the mention picker, so nothing was sent. Pastes
  now arrive whole.
• The @ picker labelled opencode agents "(human)".
• quorus relay --host 0.0.0.0 started a second relay next to the one your first quorus run
  started on 127.0.0.1:8080: on macOS both bound the port and wrote the same state file, and on
  Linux it failed to start. It now refuses while a relay answers on that port, and --replace
  stops the one quorus started (and only that one) first.
• "default" could be chosen as your name in the first-run wizard and quorus init, but
  quorus agent add refuses it, so that user could never add an agent. Both now refuse it.
• The relay couldn't use a postgres:// DATABASE_URL, which is what fly postgres attach sets.
• The README and several CLI and relay hints still showed the secret on the command line
  (--secret <s>); they all use --secret - now.

Added

• docs/deployment.md: how to share a relay with teammates or agents on other machines (your
  LAN, Tailscale, a VPS, Docker, Fly.io, Railway, Render), each with its commands, settings,
  HTTPS and whether it needs Postgres and Redis, and labelled by how far it's been tested.
  The README links it, and a test fails if a README link points at a missing file.

v0.5.2: no secrets in MCP configs, safer share links

Install or upgrade: pipx install quorus-ai / pipx upgrade quorus-ai

Security

• quorus init, quorus join and agent spawning wrote the relay secret in plaintext into
  the MCP configs they create, including a world-readable ./.mcp.json that projects
  often commit. Those configs now hold no secret or key: quorus-mcp reads it from your
  saved profile (mode 0600).
• The hub's share card told teammates to install with curl https://q.dev/r/<code>.sh, a
  domain Quorus doesn't own. It now uses your relay's own installer, like quorus share.
  Both build the line only for an http(s) URL, shell-quote it so nothing in a relay URL
  can run when pasted, and pipe it to bash: under sh (dash on Debian/Ubuntu) it
  stopped before installing anything.
• A new agent no longer gets the relay's shared secret written into its agent dir before
  its first sign-in. The secret is used only when sign-in confirms the relay has no
  participant keys, and that warning prints once instead of on every new agent.

Added

• quorus init --secret - (or --api-key -) reads it from stdin, so it stays out of
  shell history and ps. llms.txt and every setup hint now use it.
• Every v* tag lists the release in the official MCP Registry from CI, after PyPI has
  it: GitHub OIDC sign-in, so no token or manual mcp-publisher login.

Fixed

• Five MCP tools (social_verb, publish_capability, lookup_capability,
  search_capabilities, list_room_tools) answered 403 "legacy auth not permitted" on a
  shared-secret relay, the setup llms.txt teaches. quorus-mcp now claims the agent's
  own participant key once and retries, and the 403 says what to set.
• Agents set up by quorus join or spawned from the CLI got an MCP config that ran a
  file the package never had, so they started with no room tools. They now run
  quorus-mcp.
• MCP tools could not send a message over 4 KB: the audit receipt carried the full text
  and the relay refuses audit records over 4 KB. Long fields are now receipted by their
  SHA-256 and size, so messages up to the room limit (50 KB) go through.
• MCP tool errors say why, like the CLI: the size limit, the name rule, or when to retry.
  The relay's 429 itself now says "try again in Ns", for any client.
• A free opencode model that opencode models lists but the provider won't serve
  ("Model unavailable") is cooled down and the next free model is tried, as for a rate
  limit, instead of the wake reporting the error. A paid model still reports it.
• A redirected sign-in stops with a clear error ("the relay redirected the sign-in, so
  your key was not sent", exit 3) instead of a bare HTTP error.
• llms.txt said to start the relay before quorus init, but the relay needs the secret
  init saves. The MCP server's missing-credential error now says quorus init, as
  llms.txt does, not quorus login.
• quorus doctor listed a ~/.codex/config.toml that didn't exist under "MCP config
  found".

Full changelog: v0.5.1...v0.5.2

v0.5.1: saved credentials stay with their relay

Install or upgrade: pipx install quorus-ai / pipx upgrade quorus-ai

Security

Upgrade from 0.5.0. In 0.5.0 a saved credential could be sent to a relay it wasn't
saved for:

• With relay A's key or secret saved and another relay named by QUORUS_RELAY_URL,
  RELAY_URL, REFLEXD_RELAY_URL or quorus join --relay, quorus-mcp, the CLI and the
  wake daemon sent A's credential to that relay. A saved credential now goes only to the
  relay it was saved with; a mismatch sends nothing and says so. Credentials you pass
  explicitly (env or flag) still work.
• quorus init with a different relay kept the old relay's agent keys in the profile.
  Switching relays now drops every relay-bound credential; the same relay keeps them.
• Credential exchanges followed HTTP redirects, so a relay answering 307 could forward
  your key to another host. They no longer follow redirects.

Also: quorus-mcp and the wake daemon no longer rewrite your config files when they start;
only explicit quorus commands migrate an old config.json.

Upgrading

• Behind a reverse proxy? Set TRUSTED_PROXY_COUNT (e.g. 1). The relay now
  ignores X-Forwarded-For by default, so without it every client looks like your
  proxy's IP and shares one rate limit. Direct (127.0.0.1) setups need nothing.

Added

• --json on quorus rooms, history, ps, state, approvals and agent list: the
  relay's data and nothing else on stdout, and a relay error exits non-zero.
• Listed for the official MCP Registry: server.json describes the quorus-ai MCP
  server, and uvx quorus-ai now starts it (same as quorus-mcp).
• llms.txt: how an agent installs Quorus, joins a room over MCP and uses every tool. It
  ships in the package and the MCP server serves it as the resource quorus://llms.txt.

Fixed

• Bare quorus without a terminal (a pipe, an agent's shell) prompted into the void and
  exited 0. It now prints the non-interactive setup on stderr and exits 2.
• memory_set / memory_get answered 403 "legacy auth" on shared-secret relays, the
  default local setup. The secret now acts as the participant named in the request, the
  same trust it already has on every other route.
• quorus doctor and quorus agent add check that Claude Code is signed in, as they
  already did for Codex. A signed-out Claude passed both, then every wake answered
  "not logged in".
• Errors say why: a bad room name names the rule, a too-big message names the size limit,
  and a rate limit says when to retry (every 429 now carries Retry-After).
• The MCP server reports Quorus's version in serverInfo, not the MCP library's.
• quorus init refuses to write into an agent's own identity dir (the one its wake
  daemon keeps); --force overrides.
• Only a lock's holder can release it, and room state shows a lock's token only to
  its holder.
• A client can no longer dodge rate limits by rotating X-Forwarded-For.
• MCP tool failures are reported as errors (isError: true), not as successes.
• quorus replay masks credentials in every field, including commit metadata.
• Workspace paths are quoted when Quorus opens a Terminal for an agent.
• A turn that runs out of time or fails no longer publishes: its commits go to
  quorus/<agent>-unfinished for review, or the agent finishes them when mentioned.
• Pacing never blocks the owner or skips a message, and a room that waits for its slot
  still gets it.
• Ollama: a pull hint when the model catalog is empty.
• A broken agent worktree is rebuilt, and Quorus says why.

Full changelog: v0.5.0...v0.5.1