v2.3.8

Added

• agents: track + reap stale/failed Agent-tool subagents (heimdall-agents + who + statusline count)
• agent-pool: reap stale-idle (alive-but-hung) agents via heartbeat threshold
• resilience: self-heal claude 529/overload across session-fork + autonomous loops (backoff+jitter+cap)
• team: heimdall-team-converge — converge-forward migration (dry-run, idempotent, preserves enrollments) (wave 3)
• statusline: show branch under every same-repo teammate (not only cross-branch)

Fixed

• team-converge: fail-closed on cross-repo-shared team_ids (no ambiguous repoint)
• team-converge: firestore preflight — ADC/urllib3 checks + hard query timeout (no more silent hang)
• team-converge: print resolved backend + guard against silent local runs
• team: /team/auto is the sole team authority for github repos — converge same-repo teammates (wave 2)

Documentation

• listings: defer OpenAlternative — <10 stars + full-app gate
• listings: §3 web-listing paste-sheet — expanded /ghost pitch, pre-fit per site
• submissions: §2.1 — 497-char form-safe description (awesome-claude-code 500-char limit)

Tests

• team: red convergence test — same repo_slug splits into two team_ids (wave 1 remainder)
• oracle: AT7 same-repo-one-team convergence gate (23/23, falsifiable)

Maintenance

• release: v2.3.8

Full changelog: v2.3.7...v2.3.8

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.8/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.7

Added

• glama: glama.json manifest + Dockerfile.mcp for ledger-MCP indexing
• statusline: show same-repo teammates on other branches + branch line

Documentation

• submissions: mark §2.1 awesome-claude-code SUBMITTED (issue #2364)
• submissions: expand §2.1 pitch — cross-machine team orchestration, shared triage, checkpointing, /dream, design-match

Maintenance

• release: v2.3.7

Other

• session-end checkpoint (docs)

Full changelog: v2.3.6...v2.3.7

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.7/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.6

Added

• cp: enforce HAID key-possession on /team/auto (AT6 hardening)

Tests

• oracle: INV-AUTOTEAM AT6 — haid key-possession (hardening gate)

Maintenance

• release: v2.3.6

Full changelog: v2.3.5...v2.3.6

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.6/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.5

Added

• team: hmd team auto — GitHub zero-touch join/initiate; secret path is fallback
• presence: first-run auto-team via GitHub (replaces solo-mint; W3 client)
• cp: cp_autoteam — POST /team/auto zero-touch join/initiate (W2, oracle 21/21)
• cp: cp_ghverify — server-side gh identity + repo-access strata (W1 of auto-team)
• cp: cp_repoteam — server-side repo->team registry (W1 of auto-team)

Fixed

• god: fall back to plain identity token for user accounts (--audiences fails)

Tests

• oracle: INV-AUTOTEAM — gate zero-touch auto-team-formation (AT1-AT5)

Maintenance

• release: v2.3.5

Full changelog: v2.3.4...v2.3.5

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.5/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.4

Added

• presence: network ON by default; opt out with 'sever' (RJ-approved, re-signed)
• god: hmd god CLI (owner-only cross-team roster+logs) + owner-grant at boot
• chat-ops P2: Telegram verb core — bounded verbs + wired identity binding
• chat-ops P1: context-sync — orphan hmd/context branch, secret-gated
• go-live: STEP 0 preflight — self-heal gcloud auth + project + network

Fixed

• go-live: STEP 0 network check is a connect-test incl. oauth2

Documentation

• specs: commit the chat-originated design specs to docs/specs/ + Layer 0/1 index
• submissions: lock RJ's per-item decisions + verification-first framing

Maintenance

• release: v2.3.4

Other

• launch: presence-wall outreach assets (wall.png/svg/json/txt + regen)
• session-end checkpoint (2 files)

Full changelog: v2.3.3...v2.3.4

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.4/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.3

Added

• cp: god-mode IAP auth bridge — owner web access via Google IAP (G5 gated)

Fixed

• install: claude-mem gate + doctor presence-beat scoping + team assert
• version: render the 2 out-of-marker README pins on every bump (durable)
• hud: restore swarm block dropped in the v2 statusline rewrite
• haid: derive machine from stable device name, not IP-shaped hostname
• ship: run all guards BEFORE the version bump (no dangling bump on failure)

Documentation

• version: sync 2 stale v2.2.6 prose/URL pins to 2.3.2 (outside renderer regex)

Tests

• share-card: pin identity in interactive-install check (hermeticity)
• cp: fix 3 pre-existing reds — all test-side, shipped code correct
• presence: fix 3 pre-existing failing suites + the watchdog fixture

Maintenance

• release: v2.3.3

Other

• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)
• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)
• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)
• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)

Full changelog: v2.3.2...v2.3.3

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.3/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.2

Added

• cp: abuse caps on public /dashboard/session/* (DoS gate before deploy)
• cli: hmd dashboard login — local HAID+gh device-flow signer
• cp: dashboard session routes public + CORS (god stays gated)
• cp: dashboard login sessions + god-mode aggregates (enforce L1-L5, G1-G4)
• presence: auto-connect CP behind one-time opt-in consent
• ship: auto-sync Netlify /install redirect to release tag

Fixed

• ship: relocatable heimdall-site fallback path ($HOME, not baked absolute)
• ship: npm readback tolerates registry lag; §3 notice silent once decided

Tests

• oracle: INV-LOGIN — gate dashboard team-login sessions (L1-L5)
• oracle: INV-GOD — gate god-mode cross-tenant reads (G1-G4)

Maintenance

• release: v2.3.2

Full changelog: v2.3.1...v2.3.2

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.2/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.1

Fixed

• ship: npm publish via browser auth (TTY), not command-substitution

Documentation

• hosting: runheimdall.dev is served from heimdall-site, not the plugin repo

Maintenance

• release: v2.3.1
• npm: §3 positioning A — 'Nothing ships unproven' + 12 discovery keywords

Full changelog: v2.3.0...v2.3.1

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.1/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.3.0

Added

• cleanup: honest reboot advisor — say when high memory pressure is NOT heimdall
• reap-idle: reap finished background claude --agent processes (RAM leak)
• cleanup: wire heimdall-cleanup --auto into Session hooks + surface in skill
• cleanup: heimdall-cleanup — unified memory+disk health CORE
• ship: npm publish stage — end the 2.0.5-vs-2.2.6 registry drift
• geo: GEO scorecard harness with provisional candidate queries
• ship: real GitHub Releases + orphaned-version recovery
• ci: public-repo-no-secrets gate — sha256-pinned gitleaks on push + PR
• ship: heimdall-git-guard — self-heal stale index.lock from interrupted git writers

Fixed

• statusline: wire orphaned update_notice() back into the composite render
• cc-update: stop hmd racing Claude's updater; reap retired versions safely
• statusline: target CC's real statusLine region ($COLUMNS - 4), not $COLUMNS
• docs: correct stale README finding in SUBMISSIONS.md
• geo: correct stale README claim — bare telemetry line already removed
• npm: drift-proof runheimdall npm README, add npm link, note pending §3 fields
• version: single-source version from plugin.json + drift gate

Documentation

• log-monitor: enrich — 2nd presence stale comment (:508), protocol.log writer confirmed, .gitignore vs CLAUDE.md (F8)
• scout: enrich SKILLS-SCOUT with web-verified findings
• log-monitor: HMD runtime log/telemetry findings — SONA starvation + wiring gaps
• scout: SKILLS-SCOUT skeleton from local evidence
• scoped privacy claim set — layered onto the pinned installer
• DATA.md data contract — reconciled to current code
• planning: Part B answers — exact values from source
• a5: site version-unification patch instructions
• security: complete SECURITY.md + de-stub the RR runbook endpoint
• install: SHA-pin the install one-liner to v2.2.6 + verify signature
• launch: A6 submission drafts — awesome-lists, listing copy, MCP bundle (HELD)

Tests

• truth-pass falsifier — gate the scoped claims, prove it goes red

Maintenance

• release: v2.3.0

Other

• session-end checkpoint (1 files)
• session-end checkpoint (1 files)

Full changelog: v2.2.6...v2.3.0

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.0/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.

v2.2.6

Full Changelog: v2.2.4...v2.2.6