v0.43.0

Agent Threads v0.43.0

Features and improvements

• Optional Design plugin: Design now releases independently as Design for Agent Threads, keeping the host focused on agent execution and peer integrations. (#579)
• Peer plugins can prepare new threads transactionally: incomplete preparation rolls back the provisional thread and its allocated artifact storage; sending remains blocked until commit.
• Existing legacy design cards retain a read-only Reveal source action when Design is absent. Installing Design restores its artifact controls without moving existing files.

Migration — Design users

• /design, EnterDesignMode, design creation, preview, and capture are no longer built into Agent Threads. Install and enable Design for Agent Threads v0.1.0 alongside this release to keep using them.
• Design is currently distributed from a private repository. Repository access is required to download it. If you need Design and do not have access, stay on v0.42.0 until you can obtain the companion plugin.
• Enable Agent Threads first, then Design. Start a new conversation after enabling the plugins to refresh contributed agent tools.
• Interactive previews and screenshot capture require Geode's artifact runtime. In Obsidian, Design reveals the generated source instead.
• This release does not include the Geode conversation-first pane fix; Geode updates independently.

Verification

• 3,230 unit/integration tests passed, 1 existing skip; TypeScript and production build passed.
• 217 browser/screenshot tests passed, 2 existing harness skips. These are browser-harness checks, not a fresh installed-host smoke test.
• Release metadata and migration guidance synchronized in #584.

v0.42.0

What's New in v0.42.0

Features

• Responsive Skills Manager — narrow panes now show a usable one-panel list/detail flow with back navigation and unsaved-edit protection, while wide panes keep the familiar split layout. (#571)
• Peer-owned artifact presentation — plugins can register namespaced artifact providers with declarative actions instead of reaching into Agent Threads views or DOM. (#574)
• Public artifact lifecycle API — peers can allocate host-owned storage, attach artifacts to threads, open them, and invoke actions through API v1; thread deletion cleans up owned storage. (#576)
• Contributed agent tools — peer plugins can add isolated, bounded in-process tools to new Claude and Codex sessions, with host-injected thread identity, collision protection, and permission-aware support APIs. (#577)
• Contributed slash commands — enabled peers can add commands to the composer, Agents List, and Agent Board with live registration/disposal and safe draft recovery on failure. Built-in Design now exercises the same public path. (#578)
• OAuth resource indicators — MCP OAuth now supports RFC 8707 resource audiences across authorization, token exchange, and refresh, enabling servers such as v0 that require them while rejecting unrelated advertised origins. (#580)

Improvements

• More room to edit skills — Save, Reveal, Reload, and Uninstall actions now live in the detail header instead of consuming editor height below the document. (#575)
• Smaller Codex raw logs — repetitive diff snapshots, plan deltas, and command-output updates are compacted with bounded diagnostic tails while authoritative completed records remain unchanged. (#581)
• Documented modular architecture — ADRs now record the peer-plugin contribution strategy, orchestration ownership boundary, and namespaced artifact-provider model. (#572)
• More faithful visual tests — the screenshot harness now matches the real host's view-content layout, preventing misleading compressed Skills Manager editor baselines. (#573)

Notes

• No manual migration is required.
• Existing built-in Design behavior remains available in this release; the separate Design-plugin extraction was intentionally not included.
• Existing MCP OAuth connections that were granted without a resource audience may require one reauthorization if their authorization server rejects adding resource during refresh.
• Codex compaction applies to new log events only; existing JSONL logs are not rewritten, and compaction is not a total file-size cap.

v0.41.0

In-app agent browser

Claude can now drive a browser inside Geode, using the same embedded web view that powers Web Viewer tabs — instead of launching a separate Chrome.

The point isn't new capability. It's that the external browser CLI spawned its own Chrome plus a supervising daemon per session, and nothing counted those processes, reclaimed them, or refused to start one more when the machine was already out of headroom. While this was being tested, the same machine was running 38 Chrome processes and 42 daemons leaked across four sessions, the oldest three hours old. The in-app browser drops from 2 renderer processes to 1 the moment a session closes.

How it reads a page

An accessibility snapshot rather than screenshots or raw HTML — just the things a person could actually interact with:

- textbox "What needs doing?" [ref=e1]
- button "Submit the form" [ref=e2]
- link "Documentation" [ref=e3]

Claude reads that and hands back a ref. No coordinate guessing, no brittle selectors. Hidden and disabled elements are omitted, so every ref is something you could have clicked yourself.

Refs are scoped to a snapshot epoch, and the check runs in the same injected call as the action — so a page that navigates between the check and the click gets refused rather than acted on by accident.

Resource limits, because that was the whole problem

Sessions are capped (2 by default, 4 max), reaped after 5 minutes idle, recycled after 30 minutes, and closed when their thread is deleted or the plugin unloads. Geode already measured file-descriptor pressure but only ever reported it; a sandboxed page process needs a spare descriptor at launch or it dies as a bare "exit code 6", so the browser now refuses to start a session when the app is running low.

Watching it work

Open Agent Browser from the command palette shows live frames, the page, session age, and a stop button. It streams only while visible, and closing it never closes Claude's session.

Safety

Its own cookie jar, separate from your Web Viewer tabs. Page text arrives wrapped as untrusted data rather than instructions. Typing a stored secret into a page is refused. file:, javascript: and cloud metadata addresses are blocked; private network access is opt-in.

Limits

Geode desktop only — it needs process diagnostics Obsidian doesn't expose, and mobile has no embedded web view. Top frame only; no iframes, file uploads, or multiple tabs. It can't drive Electron desktop apps, evade bot detection, or use cloud browsers — the agent-browser CLI still covers those.

Off by default. Settings → Tools → Agent browser, then reload.

---

Full notes: #569

v0.40.0

Features

Watch a document, alert the owning thread on changes (#559) — mark a note as watched and the thread that owns it gets told when it changes, so an agent working from a spec notices when the spec moves under it.

Agent Board ribbon icon (#560) — the Agent Board is now one click from the sidebar instead of a command-palette lookup.

Peer-plugin MCP API (#565) — other Obsidian plugins can register global MCP servers (stdio/http/sse/oauth) and request OS-keychain-backed secrets through Agent Threads via api.v1.mcp.register and api.v1.mcp.requestSecret, rather than reinventing MCP config UI or credential storage. Both reuse the same human-in-the-loop confirmation machinery the agent-facing tools already use — there is no silent path for a peer plugin, and requestSecret never returns the secret value to the caller.

Compass "Send to Agent" receiver (#566) — Agent Threads now listens for agent.handoff events from Compass running in Geode's Web Viewer and seeds a local thread from the handoff context. This ships inert: Compass's sending side isn't built yet, so nothing emits the event in this release. It's the receiving half landing first on purpose — a receiver with no sender is invisible, whereas a sender with no receiver is a dead button.

Fixes

• OAuth MCP consent opens in the system browser, not the Web Viewer (#562) — several providers refuse to complete sign-in inside an embedded view.
• MCP capability tokens stay stable across turns (#563) — they were being regenerated mid-conversation, breaking long-running sessions.
• OAuth MCP scopes default to the resource's advertised list (#564) — instead of a hardcoded guess that some providers rejected.

Maintenance

The screenshot suite is fully green again — 207 passed, 0 failed. Four baselines had been failing for several releases and repeatedly written off as "pre-existing." They turned out to be stale baselines: the diffs were confined to deliberate copy changes in Settings → Pull requests, with the components actually under test rendering pixel-identical. Verified by inspecting the rendered diffs before regenerating, not by assumption.

---

Install: BRAT → Update all beta plugins. Assets are attached below.

v0.39.0

Connect Slack (and other fixed-redirect-URI OAuth MCP servers)

Some OAuth MCP providers register one exact callback URI and reject anything else. Until now Agent Threads always spun up its local OAuth callback listener on a random 127.0.0.1 port, relying on RFC 8252's "any loopback port" allowance — which those providers don't honor. That made them impossible to connect.

mcp_register_server now accepts an optional redirectUri on oauth-type servers. It pins the local callback listener to an exact loopback URI — host, port, and path — and uses that same URI verbatim in the authorization request, the Dynamic Client Registration payload, and the token exchange.

Slack is the motivating case; it requires exactly http://localhost:3118/callback.

Connecting Slack

name: slack
type: oauth
url: https://mcp.slack.com/mcp
clientId: 1601185624273.8899143856786
redirectUri: http://localhost:3118/callback

You can also set it in Settings → MCP → Add MCP server → OAuth, where redirectUri sits alongside the existing optional clientId and authorizationServerUrl overrides.

Notes

• localhost and 127.0.0.1 are not interchangeable. OAuth redirect URI validation is exact string matching, so use whatever the provider registered. Slack registers localhost.
• The listener binds the hostname parsed from your URI rather than a hardcoded 127.0.0.1. That matters on macOS, where localhost resolves to ::1 first — an IPv4-only bind would leave the browser talking to a dead port after you'd already consented.
• redirectUri is validated as a security boundary, since it decides where the authorization code is delivered and which interface is bound. Accepted: http scheme, a loopback host (127.0.0.1, localhost, or [::1]), and an explicit in-range port. Rejected: 0.0.0.0, any LAN or public host, and embedded credentials, query strings, or fragments.
• Omitting redirectUri changes nothing. Servers without it keep today's exact behavior: an ephemeral 127.0.0.1 port, a portless DCR redirect URI, and the /callback path.

Full field reference: docs/mcp-registration.md

---

Included PR: #557 — feat: pin the OAuth MCP callback via an exact redirectUri (Slack support)

v0.38.0

New: author skills in your vault

Create reusable skill packages directly from Skills Manager with New skill, or let an agent create and update complete packages with skills_create_local and skills_update_local. Authored skills live in your vault's configurable Skills/ folder and can include scripts, templates, and binary resources. (#554)

New Claude and Codex sessions discover authored packages as /local:<identifier>. Updates preserve omitted files and validate paths, with rollback when package writes fail. Qualified identifiers distinguish packages that share a name.

Existing installed/imported skills and GitHub sources keep their current locations; no migration is required. Start a new session to discover newly authored skills.

Skills Manager documentation

Update through Settings → BRAT → Update all beta plugins.

v0.37.2

Patch release covering three merged PRs.

Conversation first is now the default placement (#549)

New installs now open the conversation in the main area with one reusable native companion panel beside it, instead of the classic sidebar layout. Existing installs are unaffected — any vault that has already saved settings keeps whatever placement it was using. You can switch either way at any time under Settings → General → Conversation placement.

Alongside that, the Skills Manager now opens in the right sidebar under conversation-first placement (creating the sidebar if it isn't open yet), matching where the Agents List opens. Previously it always took a main-area tab, which collided with the conversation. Classic placement keeps the original main-area-tab behavior.

Edited-file chips respect host-attached Project folders (#552)

Clicking an edited-file chip for a file inside an attached Project folder opened it in an external application instead of the in-app read-only viewer. The plugin now gives the host first refusal before falling back to the OS, so Geode routes those files to its read-only viewer. Obsidian behavior is unchanged.

"Chat about this document" (#545)

Three new entry points — file-explorer right-click, editor right-click, and the command palette — start a new thread with the composer pre-seeded with an @[[note]] mention and the caret parked after it. It seeds rather than dispatches, so you type the actual question and the existing mention resolver inlines the note at send time.

---

Also regenerates three screenshot baselines that had drifted (request-secret-modal normal/force, mcp-registration); the suite is now fully green at 204 passed / 2 intentional skips.

Install/update via BRAT: Settings → BRAT → Update all beta plugins.

v0.37.1

Auto-generated release assets.

v0.37.0

OAuth-gated MCP servers

Adds a fourth MCP transport, type: "oauth", for remote servers that require their own sign-in — Vercel, Figma, Linear and most hosted vendor MCP servers. The plugin brokers the whole OAuth 2.1 + PKCE flow itself: discovery, Dynamic Client Registration, consent via the Web Viewer, token custody, refresh and revocation, all behind a local per-server proxy. Neither Claude nor Codex needs any OAuth-specific code.

Connect one two ways, both running the same flow and validation:

• Settings → MCP → Add MCP server → OAuth — name and URL required; scopes, an allow/deny tool filter, and client-ID / authorization-server overrides optional.
• Ask an agent to call mcp_register_server with type: "oauth".

Access and refresh tokens live only in the OS keychain, never in data.json and never returned to the calling thread. Settings → MCP → OAuth MCP servers shows each server's live status — connected with an expiry countdown, expiring soon, or needs re-authorization — with a Disconnect that revokes upstream, clears the keychain and stops the proxy.

Fixes found by hand-testing before release

The broker passed its full test suite while being completely non-functional in the real app. Three defects, all invisible to CI:

• Authorization-server traffic could never leave the renderer. Discovery, DCR, token exchange and refresh used the renderer's fetch, but the renderer runs on a file:// origin and Chromium blocks cross-origin fetch from an opaque origin regardless of the server's CORS headers. The MCP SDK converts that failure into empty metadata, so it surfaced as "this authorization server does not support Dynamic Client Registration" — a claim about the server caused by a failure in our HTTP layer. All AS traffic now routes through Obsidian's requestUrl.
• Agents never picked type: "oauth". The tool description advertised only "stdio, HTTP or SSE", so asked to connect Vercel a model reasonably chose http — saving a server that could never authenticate and never opened a consent screen.
• The consent callback page was mojibaked. Served without a charset, so its UTF-8 body decoded as Latin-1 and the em dash rendered as —. Now correctly encoded, and redesigned with distinct success and error states.

Full changelog: v0.36.0...v0.37.0

v0.36.0

What's new in v0.36.0

Features

• Enter design mode from an agent conversation. Claude and Codex can now call EnterDesignMode({ brief }) in an existing thread to create or reuse its static UI artifact, show its controls, and open the preview. The agent receives artifact paths and design instructions immediately and continues in the same turn. (#546)

Improvements

• Composer /design and agent-initiated entry share serialized artifact preparation. Failed persistence restores thread metadata, preserves files for recovery, and supports retry.
• Tool results distinguish an opened preview from a source-reveal fallback or unavailable preview, so the agent can accurately explain what happened.

Notes

• Requires a desktop filesystem vault and write permission; unavailable in read-only Plan mode or while plan approval is pending.
• Secure preview requires a compatible Geode host. Existing /design usage remains supported. Design artifacts do not introduce a persistent permission mode or an exit command.
• Local verification: 2,589 unit/integration tests passed and the browser suite covered artifact entry/reuse and controls. Live model-driven verification was blocked by a host startup compatibility issue (SearchComponent is not a constructor) before design entry could run; no live-host smoke is claimed.
• Update through BRAT, then use a newly initialized session to discover the new tool. Development instructions and public docs are updated in companion PRs.