v0.19.1 — Share Plane UI

Ships the Share Plane's user interface and reorganizes settings. (Builds on v0.19.0, which introduced the Share Plane backend + the security hardening.)

Added

• Settings → Sharing — review every cross-utility grant (consumer → provider, plane, scope, revoked/expired state) and revoke any in place; a requireScopedReads toggle; and a read-only directory of installed providers (their data kinds + exported verbs).
• Just-in-time consent — when a utility's Share Plane call lacks a grant, the host raises an unspoofable consent prompt in the iframe wrapper and, on approval, records the grant and transparently retries the original call. Works regardless of install order (dynamic / late-bound).
• Install-preview transparency — the GitHub install dialog now surfaces the sensitive permission slots (tasks / worktree / shares.consume) and a Cross-utility access section (what a utility provides + may consume).
• Tabbed settings — General, Agents & models, Integrations, Notifications & sharing, and Advanced, each with a short description of what it covers.

Notes / limitations

• JIT consent currently covers utility iframe host calls. Worker (server-action) and scheduled-workflow contexts can't prompt, so they rely on a grant created earlier (an iframe prompt or Settings → Sharing).
• Grants are persistent ("Allow"); "allow once" and interface-level grants are not yet offered.
• The writer-studio utility and task-board's provides / slot declarations still ship in their own repos.

🤖 Generated with Claude Code

Full Changelog: v0.19.0...v0.19.1

v0.19.0 — Share Plane

The headline of this release is the Share Plane — a governed, dynamic way for installable utilities to share data and call each other — plus the security hardening that made it safe to build. See docs/sharing.md.

Added

• Share Plane (cross-utility data sharing). With user consent, a sandboxed utility can read another utility's data and call verbs it exports — without blanket access to the rest of a Space.
  • DATA plane — kb.scopedList / kb.scopedRead return only a provider's own entries for a granted kind, filtered by the host-stamped, unspoofable createdBy.
  • CAPABILITY plane — capabilities.invoke runs a provider's exported verb inside the provider's own sandbox (never the caller's); capabilities.listProviders is metadata-only discovery.
  • Manifests gain provides (claim kinds / export verbs) and consumes (intent — grants nothing, never fails install, binds by interface at runtime).
  • New substrate: grant ledger (grants.json, 0600) + self-healing provider directory (providers.json) with first-claim-wins kind ownership.
• Permission slots permissions.tasks (read/write/dispatch), permissions.worktree, permissions.shares.consume.
• Opt-in requireScopedReads posture (default off) that narrows blanket kb.read/kb.list to own + granted entries.
• Grant lifecycle server actions for a forthcoming Settings → Sharing page.

Changed

• tasks.* and git.worktree.* are now gated by real permission slots (fix B) instead of a hard-coded task-board id check. An un-upgraded task-board is grandfathered in until it ships its declarations.
• kb.add is owner-enforced: once a provider claims a kind, only that provider may write it.
• Install/uninstall refresh the provider directory; uninstall prunes every grant touching the utility.
• Project + utility repositories migrated to the reflex-agent GitHub org.

Security

• Closed a privilege-escalation hole: tasks.dispatch (spawns a subprocess agent) and git.worktree.* (mutate the user's real repo) carried no id/permission check despite docs claiming "task-board only" — any installed utility could call them. Now gated at dispatchHostCall; denied calls are audited.

Not yet shipped (follow-up)

• React surfaces: install-time consent dialog, the just-in-time grant-request directive in chat, and the Settings → Sharing revoke page (server actions exist).
• The writer-studio consumer utility and task-board's provides/slot declarations ship in their own repos.

🤖 Generated with Claude Code

Full Changelog: v0.18.2...v0.19.0

v0.18.2

Full Changelog: v0.18.1...v0.18.2

v0.18.1

Full Changelog: v0.18.0...v0.18.1

v0.18.0

Full Changelog: v0.17.1...v0.18.0

v0.17.1

Full Changelog: v0.17.0...v0.17.1

v0.17.0

Full Changelog: v0.16.0...v0.17.0

v0.16.0

Full Changelog: v0.15.0...v0.16.0

v0.15.0

Full Changelog: v0.14.0...v0.15.0

v0.14.0

Full Changelog: v0.13.5...v0.14.0