Kintsugi v0.4.8

Kintsugi v0.4.8

Updates automation guidance and the opt-in review workflow, and corrects the highlighting benchmark's streaming sample count.

Changes

• Document workspace warnings, queued follow-ups, submission identities, steering, cancellation and resuming input left behind by a failed turn.
• Run /review through one fresh reviewer with structured findings, reproduction evidence, stored-state and upgrade-risk checks. The workflow never automatically fixes files, stages changes or commits. Further rounds require explicit approval. The reviewer receives read and bash; Bash is not an operating-system-enforced read-only boundary.
• Count decoded content prefixes in the write benchmark, matching renderToolCard, and add a regression check. Update the benchmark guide for the current Highlights and Pierre renderers.

Verification and limits

86 targeted tests passed in isolated file runs; lint and TypeScript checks passed. A combined route/runtime test invocation encountered fixture-lock teardown errors; all affected tests passed when run in separate processes. The tagged release runs the full suite and native image gates before publication.

Three Bun 1.4.4 Linux ARM64 benchmark runs passed 50/52, 49/52 and 49/52 cases. Every expected update completed, and every streaming replay passed its budgets. Bash/heredoc cases still exceeded existing timing targets; the slowest cold render was 88.4 ms and one shared highlight took 22.9 ms. No budgets were loosened. These measurements do not establish a Bun-only speedup or browser responsiveness. See the benchmark results.

No runtime protocol, compatibility counter, application environment variable or installation data format changes. The review script runs only when explicitly requested. Existing credential grants, network boundaries, custom sources, image pins and paired rollback are unchanged. The v0.4.7 runtime pin is retained. Unrelated local resource-default changes are excluded.

Publication advances latest only. stable stays at v0.4.1. No existing installation is updated or restarted.

Changes since v0.4.7

Kintsugi v0.4.7

What's Changed

• Fix workspace exec with Go 1.26 and delegated cgroups by @rcarmo in #11
• Run native runtime fixtures in production host cgroup namespace by @rcarmo in #12
• Prepare v0.4.7 with verified workspace exec runtime by @rcarmo in #13

Full Changelog: v0.4.6...v0.4.7

Kintsugi v0.4.6

Kintsugi v0.4.6

The workspace-helper protobuf schema is embedded in JavaScript bundles. System can load its supervisor without looking for a missing /opt/proto/workspace_helper.proto file. This fixes the packaged boot defect found after v0.4.5 publication.

Packaging and verification

• Import the schema as text and build the gRPC definition with the explicitly pinned protobufjs 7.6.2 dependency. Protocol names, encoding options, mutual TLS and namespace checks are unchanged.
• Add a regression check that relocates the helper bundle and imports it without its source tree or a separate proto file.
• Narrow System's Host imports to backend terminal functions, avoiding an app-only terminal CSS lookup in the standalone bundle. Host terminals remain available. A source-free entrypoint check verifies module loading reaches argument parsing before privileged startup.
• Make the app-image smoke check import the actual helper module.
• Gate native AMD64 and ARM64 image publication on booting the packaged System supervisor and real app to healthy /up, with no source-checkout mount. The disposable fixture uses its own volume and bounded containers; it changes only the app's preload label to use preloaded test dependencies. No application code is replaced.

The previous native smoke checks established binary availability, assets and resource bootstrap; they did not establish supervisor entrypoint boot. The new paired-runtime check closes that gap.

Host terminals, credential grants, network restrictions, custom sources, explicit image pins and paired rollback are retained. No application environment variable is added. Compatibility counters and the Go 1.26.10 runtime pin are unchanged.

Adapted from upstream 7d140bb2. Lucas Meijer and Larry Hudson attribution and MIT notices remain intact.

Publication advances latest only. stable stays at v0.4.1. No existing installation is updated or restarted.

Changes since v0.4.5

Kintsugi v0.4.5

Kintsugi v0.4.5

The 23 October upstream batch updates Agent recovery, terminals, Files and Changes while retaining Kintsugi's credential, network and release safeguards.

v0.4.4 failed CI before image publication and was not published. This release separates root installer checks from unprivileged helper fixtures.

Agent and terminals

• Pi, chord and code mode advance together to 1.4.0; Bun advances to 1.4.4.
• Agent gains queued follow-ups, recovery and crash controls, with script-file support. Extra provider suggestion inference and automatic review commits remain excluded.
• A local Go workspace helper handles terminal processes and file metadata over a Unix socket. Mutual TLS uses an identity derived from the existing gateway credential, stored outside workspace-user mounts. Namespace checks and a separate socket mount bind access to the workspace; ingress and egress mounts remain read-only.
• Existing persisted bash operations retain their backend and recovery receipts. New terminal operations use a separate task identity, avoiding command replay during migration. Terminal viewers, Stop, reconnect and the mobile key accessory use the shared terminal transport. History limits are applied before pane creation for older tmux versions; local terminal-process caches follow the data directory and reset during cleanup.

Files and Changes

Pierre 1.6.1 adds the updated editor, highlighting and link handling. Changes gains buckets and commit/range links. Office, CSV/TSV and Draw.io previews, explicit Review delivery, ast-grep and browser-local centred timestamps are retained.

Uniform Go runtime

All eleven shipped runtime executables are rebuilt with Go 1.26.10 on native AMD64 and ARM64, including Docker CLI, Buildx, Compose and Ubuntu's patched runc. Binary metadata and EROFS smoke tests passed before publication. App, System and workspace builds share the immutable runtime manifest sha256:927bea2d5276f87de04d7934b19124c48f9bd1c877743cace382bd5271ffbfe4.

Existing CLI/plugin versions, Ubuntu runc patches and licence notices are retained. Go build/module caches and unused BuildKit cache mounts were cleared without deleting images, volumes or workspace data.

Verification and operation

Release verification runs frozen installs, lint/types, asset builds and the bounded full suite from a clean checkout. Manual checks cover terminal lifecycle, Pierre autosave, Markdown file references and CSV preview. Composer layout passed 89/89 checks across six explicitly partial desktop/mobile Chrome scenarios. Tab delivered byte 9 with simulated keyboard visibility. Production inference and physical/iOS soft keyboards are not live-qualified; the live Pi setup requires a connected provider and enabled model.

One-shot limits, caller identity and credential grants, explicit plan/Review boundaries, network restrictions and DNS pinning, custom sources, version pins and paired rollback are unchanged. No application environment variable is added. System capability remains 3, app minimum 0, network-policy reader 2 and resource-policy reader 1.

Publication advances latest only; stable stays at v0.4.1. No installation is updated or restarted. Before downgrading, stop active scripts and agents and back up app data; image rollback does not restore journals or settings.

Adapted from Lucas Meijer's AgentsInTheCloud through 063c8b202355ac23c7cf683b3ce0571d5ab33d4c. Lucas Meijer and Larry Hudson attribution and MIT notices remain intact.

Changes since v0.4.3

Kintsugi v0.4.3

Kintsugi v0.4.3

The final transcript timestamp now has an explicit full-width, three-column layout: the timestamp stays centered between equal-width horizontal rules, including in narrow panes.

Browser-local formatting, the retained UTC instant and idle/busy behavior are unchanged. This patch contains no other application behavior changes. A release-tooling lint warning is also corrected. v0.4.2 was not published.

Manual review confirmed alignment at 320, 393, 800 and 1,440-pixel viewport widths. Composer layout acceptance passed 89/89 checks across six explicitly partial, no-inference desktop/mobile Chrome scenarios.

No installation is updated or restarted by publication. The separate stable promotion remains an explicit operator action.

Changes since v0.4.1

Kintsugi v0.4.1

Kintsugi v0.4.1

v0.4.0 was not published; this is the first published release of the 0.4 minor series.

Code mode templates and one-shot agents

Prompt templates in .kintsugi/prompts or .pi/prompts can declare codemode: true. Their JavaScript runs only when the slash command is explicitly submitted, with args and argumentsText available. Saving a template starts no work. Code mode templates do not accept attachments.

Scripts can call tools.agent({ prompt, schema }) for a fresh, task-owned conversation and a validated JSON answer. Calls retain their conversation and deduplicated inputs across recovery; Stop ends their owned work. Their transcripts open from the script's call details, and usage contributes to the parent Agent's total.

A read-only transcript does not mean side-effect-free tools. One-shot agents can use a selected subset of read, write, edit and bash, intersected with their caller's enabled capabilities. They cannot delegate, run further scripts, access another Agent's plan or obtain undispatched Review comments. Existing workspace credential and network restrictions still apply.

Admission is limited to eight concurrent one-shot agents per workspace. Each call has a five-minute deadline, three attempts to produce a valid answer, and a 32k output-token threshold checked between provider requests; a single request may cross that threshold. Schemas are limited to 32k characters, 1,024 nodes and depth 32, without regex patterns or references. Answers are limited to 64k characters, 4,096 nodes and depth 32. Code mode retains its two-worker host limit, counted through actual worker exit, and 256 MiB VM limit per worker.

Unified Background

Background groups delegated work and Claude Code tasks above the conversation. Commands and monitors expose output in place; subagents and workflows open their own pages, with progress, transcripts and supported Stop controls. Workflow phases include running and queued agents, and link to started agents' transcripts.

One-shot agents belong to their script rather than the Background list. Existing Subagents routes and subscriptions remain available. Newly exposed Claude background journal previews require regular, non-symlinked files and safe task IDs; they retain at most the last 2 MiB, with 16 cached tails. Source journals are not changed.

Live interaction and usage

• Live collection updates send changed rows without resetting unchanged permanent rows.
• Transcript following resumes when the reader actually moves toward the end. Opening a disclosure or expanding thinking pauses following; live updates leave paused reading positions alone.
• Composer tap highlighting is suppressed on iOS.
• Anthropic usage cards show extra-usage status and available allowance details.
• Browser-local idle timestamps remain localized after Turbo morphs, while retaining their UTC instant. Background elapsed-time facts have an immediate server-rendered value.

Verification and operation

Verification includes frozen installation, lint/types, asset builds, the full test suite and native-Harness lifecycle checks. Manual acceptance uses a local faux provider and a fake Claude transport, not production inference. Composer layout acceptance passed 89/89 checks in six explicitly partial desktop/mobile Chrome scenarios. Production-provider inference and physical/iOS soft keyboards are not live-qualified.

System capability remains 3, app minimum 0, network-policy reader 2 and resource-policy reader 1. Pi remains pinned to 1.3.0. Provider routing/caching defaults, explicit Review delivery, credential grants, custom sources, version pins and paired rollback are unchanged. No application environment variable is added.

Publication advances both latest and stable after native AMD64/ARM64 verification. No existing installation is updated or restarted. Before downgrading, stop active scripts and one-shot agents and back up app data; image rollback does not restore journals or settings.

These eight upstream changes were adapted from Lucas Meijer's AgentsInTheCloud. Existing Lucas Meijer and Larry Hudson attribution and MIT notices remain intact.

Changes since v0.3.10

Kintsugi v0.3.10

Kintsugi v0.3.10

Review and structural code tools

Changes gains Send to Agent…, with a preview and explicit confirmation. Saving a review comment alone does not grant Agent access. The native and authenticated MCP code_review tool exposes only batches dispatched to that Agent; editing or deleting a comment revokes its dispatched revision. Uncertain delivery is never retried automatically.

code_search and code_rewrite use pinned ast-grep 0.51.0 parsers on AMD64 and ARM64. Rewrites default to previews; applying one requires a matching source revision and changes one regular UTF-8 workspace file atomically. Paths, parser resources, results and process output are bounded.

File viewers

• CSV/TSV files open as filterable tables, with a Source toggle and the existing editor. Formulas and HTML remain inert text. Previews are limited to 2 MB, 500 data rows and 80 columns.
• Office Work panes preview DOCX, Excel spreadsheets, ODS and PPTX. They support sheet selection, slide navigation, zoom, reload and download. Legacy DOC/PPT, ODT and ODP are unsupported.

Office rendering uses pinned libraries, including the official SheetJS CE 0.20.3 distribution. Documents stay read-only in an opaque-origin sandbox with network access blocked. Macros are not executed and formulas are not recalculated. Server preflight bounds source size and actual ZIP expansion; browser rendering remains best effort, including image decoding and synchronous parsing.

Idle conversation timestamps

An idle conversation ends with a temporary timestamp separator. It uses the last available message timestamp, formats it in the browser's local timezone, and disappears when work resumes. It is never stored as a transcript message.

Pi 1.3

The coupled Pi packages are pinned to 1.3.0. Native Agents use the new document-cache eviction support, retaining unobserved documents for one minute. Scheduler ownership caches now follow live work. Code mode admits at most two native workers across workspaces, counting cancelled workers until they actually exit, with a 256 MiB VM limit per worker.

Kintsugi now uses Pi's corrected 500k Codex Sol context limit without a redundant app override; explicit user overrides still win. Title requests follow the updated thinking capabilities, including Haiku 5.5's supported off level.

The upgrade also includes upstream provider, model-switching, argument-validation and code-mode cancellation fixes. Pi 1.3 changes Kimi Code to Chat Completions; custom kimi-coding base URL overrides must include /v1. Existing overrides are not rewritten automatically.

Verification

Local verification passed 2,509 tests with 39 skipped and zero failures across 340 files. Frozen install, lint/types and asset builds passed. Native-Harness checks cover document eviction, worker admission and cancellation; a copied 1.2 journal opened under 1.3 without modifying its source.

Manual desktop/mobile review confirmed idle → busy → idle transitions and reload stability. Los Angeles and Tokyo browser timezone overrides displayed different local times for the same stored UTC instant. Composer layout acceptance passed 89/89 checks in six explicitly partial, no-inference Chrome scenarios. Production-provider inference and physical mobile keyboards were not live-qualified.

Operation and compatibility

System capability remains 3, app minimum 0, network-policy reader 2 and resource-policy reader 1. No new application environment variable or System operation is introduced. Explicit review consent, credential grants, network exclusions, custom release sources, version pins and paired rollback remain in place.

Publication advances latest after native AMD64/ARM64 verification. stable is unchanged. No existing installation is updated or restarted.

Before downgrading, stop active native tool calls and back up app data. Image rollback does not restore settings or journals.

Changes since v0.3.9

Kintsugi v0.3.9

Kintsugi v0.3.9

Editable per-Agent plans

Open Plan from the Work-view launcher. The pane follows the selected Agent; each Agent, including native subagents and CLI Agents, has its own persistent Markdown checklist. Plans survive refresh, new sessions and compaction.

The user and Agent share the same plan contract: read, write, structured update, item patches, exact edits and reset. At most one item can be in progress. Live changes preserve unsaved drafts; revision checks prevent stale browser saves, and drafts survive Agent switches, pane closure and page reloads. Saving never starts work. Submit to model explicitly sends the saved plan through that Agent's composer without consuming its existing draft.

Checklist semantics are adapted from Rui Carmo's MIT-licensed PiClaw Plan Sidebar. Attribution and licence text are retained in the adapted source. The native adapter reads the current plan as transient request context rather than changing provider caching defaults.

Instance credential catalogue

Settings → Credentials stores encrypted, write-only values with explicit template grants. Agents can discover only their granted descriptions, allowed destinations and opaque placeholders through list_credentials. Rotation, disabling and revocation apply to subsequent proxy requests, including requests using cached hooks.

New catalogue entries permit exact DNS hosts over HTTPS on port 443. URL-path substitution requires its own explicit permission; query-string substitution and plaintext shell injection remain unavailable. Existing global and template secrets retain their current behaviour. The catalogue adds stale-form protection, bounded management audit metadata and last proxy-use timestamps. Its encryption key remains a separate file in the same app data volume, not an external vault.

Committed history and output search

The native search_history tool uses SQLite FTS5 over the current workspace's committed messages and completed tool output. It supports Agent/branch filters, phrases, prefixes and Boolean queries, with bounded excerpts and native source references. Hidden thinking, system instructions, live partial output and uncommitted sidecars are excluded.

Saved bash logs are indexed lazily while accessible, up to an 8 MiB prefix per file and eight files per search. Coverage reports pending files and index limits. Searching never starts a parked workspace. The derived index is rebuildable and detects journal rollback at its saved boundary.

Verification and operation

• Final local verification: 2,462 tests passed, 39 skipped, zero failures across 335 files. Frozen installs, lint/types, the System bundle and actionlint passed.
• Domain, native-Harness and authenticated MCP checks cover per-Agent isolation, persistence, validation, revision conflicts and tool execution.
• Manual Plan acceptance passed 21 checks; composer acceptance passed 89/89 checks in six explicitly partial, no-inference Chrome scenarios.
• Desktop/mobile visual review, browser save handling and a networkless saved-output fixture passed. Production-provider inference, CLI terminal delivery and physical mobile keyboards were not live-qualified by these checks.
• No new runtime dependency, application environment variable, System operation or compatibility counter. System capability stays 3, app minimum 0, network-policy reader 2 and resource-policy reader 1.
• Existing network exclusions, custom registries/sources, explicit pins, paired rollback and telemetry are preserved. Concurrent resource edits are not included.

Publication advances latest after native AMD64/ARM64 verification; channel updates are not atomic. stable is not promoted. No existing installation is updated or restarted.

Before downgrading, stop active native tool calls and back up app data, including projects.json and project-secrets.key together. Image rollback does not restore settings or journals. Older apps can discard newer credential-catalogue fields when rewriting template settings.

Changes since v0.3.8

Kintsugi v0.3.8

Changes

• Thinking output renders as Markdown, including streaming text and shortened previews. Markdown also supports native <details> disclosures and fullscreen workspace images.
• Kintsugi welcomes direct pull requests. The README highlights this policy and links to CONTRIBUTING.md; upstream’s separate contribution policy is respected.
• Faster terminal reopening, explicitly awaited paint flushing and transform-independent grid sizing. Early output buffering is bounded, tmux feature setup is idempotent on older versions, and terminal exit waits for the final PTY output callback.
• Shared syntax and ANSI colours across file editors, terminals and VS Code. Modern theme aliases work across workspace image versions; unrelated user-selected editor themes keep their palettes.
• Pi isolates provider OAuth failures while retaining classifier-only credentials and origin-scoped secret handling.
• Reviewed upstream fixes improve Claude background-task notes, command output and steering images; Codex rollout readiness; preload recovery; and explicit launch-model validation. New nested-workspace subscription seeding uses proxy placeholders instead of copying rotating refresh tokens.

Verification and publication

• Full release checks passed: 2,422 tests passed, 39 skipped, zero failures. Native AMD64/ARM64 app and System checks passed; the unchanged workspace image was verified and reused.
• Manual no-inference composer acceptance passed 89 checks across six scenarios. Physical soft-keyboard and live-provider inference acceptance are not included.
• Local terminal reopening medians improved from 745 to 262 ms on desktop and 724 to 250 ms on mobile, with zero resize messages. These are fixture measurements, not production performance guarantees.
• The tagged-release workflow publishes immutable version tags and advances latest after verification; channel changes are not atomic. stable is unchanged. Publication does not update or restart an existing installation.

The v0.3.7 candidate failed its tmux compatibility check before image publication. Its immutable Git tag is retained; v0.3.8 contains the correction.

Thanks to Lucas Meijer, Larry Hudson and valar’s Nox fork for the original work and reviewed adaptations. Existing authorship, licence notices and fork safeguards are retained.

Verified release workflow · Full changelog from the previous published release

Kintsugi v0.3.6

Full Changelog: v0.3.5...v0.3.6