v0.49.1

Stageflow v0.49.1

Release notes for versions since v0.46.0.

---

0.49.1

Fixes

• Hosted provider login no longer stops on a localhost page. When the console is reached by a public hostname (STAGEFLOW_ALLOWED_HOSTS) or listens outside loopback (STAGEFLOW_BIND), Codex sign-in uses device code and skips the browser-or-device choice. If device code is not enabled, browser sign-in continues, and the paste field explains that a localhost error page is expected. When the provider also accepts an API key, the panel says it can be added in Settings, Providers.

---

0.49.0

Features

• Stage independence modes. independence is strict, persistent, or open. Omitted means persistent: after a turn with no envelope the stage keeps working, up to twenty quiet reminders, and a tool call resets that count. strict keeps the previous short budget, including its offer to emit failure. open adds permission to try another approach with the tools and inputs already given, and does not add tools or load AGENTS.md. Set it on the stage, the pipeline, or the manifest; the stage wins. A fragment's copy is ignored. See YAML catalog.
• Checkout AGENTS.md opt-in. checkout_context: true on the stage body loads that checkout's AGENTS.md as extra context. The stage assignment wins where they conflict. The author's system_prompt is not rewritten. A stage with no checkout fails prepare (stage.checkout_context_unbound). A missing file does not fail the stage. A symlink or hard link is not read.
• Built-in grep, find, and ls. Inside a sandbox those tools see /workspace and, when one is mounted, the read-only folder. Outside a sandbox they search the stage working tree. A host path, a ~ path, a .. escape, and a symlink used as the search path are rejected. Search skips .git and node_modules.

Changes

• Default independence is persistent. A stage that does not set independence keeps working; the old short reminder budget is now independence: strict.
• Compaction for persistent or open stages records the next approach. A summary written at one level is not reused at another. Compaction stays on.
• Eval snapshots record the effective independence and checkout_context. Agent eval fingerprints omit both, so they stay comparable.

---

0.48.0

Features

• Customer identity for protected agent chat. A Host can admit a business's own customers with a signed handoff or OIDC Authorization Code and PKCE, map them to accounts, and authorize order reads. Consumers stay separate from Workspace owners. Admission stays opt-in: sf ui leaves it off until the Host manages identity or an embedder passes consumerAuthorization. See Consumer identity.
• Turn identity on from the console. On a Host that manages identity itself, Turn on identity creates the Workspace store under $STAGEFLOW_HOME/identity/, starts with the built-in access rules, and needs no restart. Setup covers the order API (write-only credential, Host-generated ES256 signing key, ownership contract test) and the authorization engine (built-in rules or a Workspace-local Cerbos server, with a test that rejects unreachable servers and allow-all policies). An embedder-supplied authorization wins and makes setup read-only (identity.managed_externally).
• Identity console. Connections, People & access, Check access, Activity and Setup as guided tabs, with drawers and dialogs for handoff/OIDC go-live, grants, and preview. Secrets and order contents never appear in the UI.
• Identity documentation. Protect an agent's chat with customer sign-in, Console: Identity, and an Order API contract, plus operator API, glossary, data-directory and environment entries.

Changes

• Consumer identity host port. Operator routes and agent chat talk to ConsumerAuthorization only; admission returns a bearer token with expiry in one step, and the identity store stays internal to the identity module.

Fixes

• Granting access again to a person who was revoked now works. Saving their access reactivates it with a new revision; their old sessions stay invalid.
• Rebinding a protected conversation no longer fails when the Access Grant changes. bind updates the existing row; expired consumer sessions are removed when a new session is established.

---

0.47.0

Features

• Log in once in your own Chrome, then run headless. browser.host: attach drives the operator's Chrome over CDP (browser.attach.cdp_url); it never launches or closes it. With browser.login_host: attach, a login stage opens in your Chrome, the Host copies the session into its own browser and probes it with the stage's check. A site that rejects the copy pins the profile to your Chrome (host-hint.json, or browser.profile_hosts). See Browser sessions.
• Blocked sites escalate instead of failing. A stage that reports site blocked this browser: pins its profile to your Chrome and retries once in the same run.
• Saved browser logins in the console, CLI and API. Connections shows each login with its sites, last login and last check, and offers Delete, Switch back, Check now and Log in again. New: GET/DELETE /api/browser/profiles…, …/pin, …/check, …/login, …/login/finish, and sf browser unpin; sf browser profiles lists more fields.
• Live browser in the redesigned gate with a window frame and back, forward and reload (POST …/live-view/navigate).
• Docs and agent guidance cover the login handoff and which sites suit it: browser docs, the browser and stageflow-author skills, and the Guide's built-in knowledge. See examples/browser-login-handoff/.

v0.46.0

Stageflow release notes

0.46.0

Judge configuration, calibration against your labels, and console workflows to improve grader reliability.

Features

• Judge settings — rubric and goal_reached graders accept judge_settings (temperature, reasoning, votes) per grader or in defaults, merged key by key. With votes of 3 or 5, each judge runs that many times and the majority wins. Validation warns when votes > 1 at temperature 0 (eval.judge_votes_no_variation). See Evals.
• Calibrate judges against your labels — Label judged results Pass or Fail, then measure agreement (kappa, TPR/TNR, confusion matrix) on a stable 70/30 split of tuning vs fair-test rows, with optional stability testing. Calibration replays stored outputs (no stage re-runs). New: sf eval calibrate, calibrate_eval_grader and calibration-list MCP tools, and POST /api/evals/:id/graders/:grader/calibrate. Migration 018 adds eval_grader_labels and eval_calibrations. Runs can be cancelled (EVAL_CALIBRATION_CANCELLED).
• Tune from mistakes — Suggest worked examples from judge disagreements on tuning rows, or try alternate rubric wording and validate on fair-test rows before saving.
• Console: label queue and guided calibration — Full-screen label queue, guided “Is this judge reliable?” panel, Teach and Wording dialogs, “Needs my label” filter on Cases, and “Label more like this” in the case drawer.

Changed

• Guide playbook — One sentence beside every confirmation card; declines outside SQL/code; names console building blocks; states missing features plainly; notes when file instructions were ignored.
• Internal-agent eval snapshots include graders so the Cases grader filter works for Guide evals.

---

0.45.0

Console keyboard fixes and clearer GitHub PR trigger semantics.

Fixes

• Console shortcuts work — ⌘, opens Settings; T on Providers tests connections; Tab in the command palette cycles result type; ⌘↵ on run-detail gate sends the note with Accept; ⌘S in Workshop saves while the chat box is focused.
• Search fields keep caret keys — In the command palette and model search, Option/Command/Control/Shift with arrows and Home/End move the cursor; plain Up/Down still move the highlighted row.

Changed

• GitHub PR trigger actions — Normalized action is opened | synchronize | updated | merged | closed. updated no longer covers pushes; use synchronize when the PR head SHA changes. event.match.action is required for github.* sources. See Triggers.
• GitHub poller — Upgrade no longer false-fires opened. Missing heads with an existing cursor backfills quietly; opened requires equal created/updated timestamps or a PR created after the cursor, not merely an unknown prior SHA.

v0.44.0

Stageflow release notes

Release v0.44.0 includes changes since v0.42.0 (0.43.0 and 0.44.0).

0.44.0

Artifact verification, sandbox grants for prior stage outputs, and console improvements for runs and transcripts.

Features

• On-disk stage artifacts before emit. emit_stage_envelope refuses claims that are not regular files under the attempt’s artifacts directory (closed posture: no symlinks). See Envelopes.
• Prior envelope artifacts as sandbox grants. Consumer stages get read-only mounts at /workspace/grants/<stageId>/… with an explicit listed→container mapping in the stage prompt. Missing prior files are skipped; duplicate basenames are disambiguated.
• Honest missing artifact claims in the console. Envelope panels show when a claimed path is absent on disk.
• Artifact path grammar and closed-posture disk inspect share one module each. Emit, verify, and prior grants compose the same layout/inspect rules instead of hand-rolled twins.
• Run reopen clock and action eligibility are deep pure modules. Store/finished_at, retention, retry, cancel, abandon, and the Gantt now-marker go through them; UI retry matches runtime (including succeeded stages that are not clone/fork blocked).
• Guide cards and mutations deepen. cardContract owns wire validate/build for producer and console; GuideToolkit(deps) owns confirm + place over buildToolkit.
• Grant mounts copy files as files. Host file artifacts bind with shape: "file" at /workspace/grants/<stage>/<filename> instead of creating a directory named after the file.
• Stage retry reopens cancelled runs. Retry is allowed when the run is failed, succeeded, or cancelled; moving back to running clears finished_at so the timeline “now” marker and Cancel stay coherent.
• HTTP stage retry returns when the attempt starts. The console Abandon/Cancel busy lock is no longer held for the whole stage.
• Stage transcript tool results. Tool outputs render as structured cards (including GitHub PR-shaped payloads) in a scrollable transcript pane instead of raw escaped JSON.

0.43.0

Automatic context compaction for long Pi sessions, a working_state tool, and tighter stage emit and tool-budget behavior.

Features

• Long Pi sessions compact themselves, and compaction keeps what matters. Pipeline stages, project agents and the operator agent now compact their context when the window fills. The summary is written by the same model the stage or agent uses; Stageflow appends pinned facts, verbatim operator/user directives, an index of cleared tool results, and working state. Secrets are scrubbed before and after summarization. If custom summarization fails, Pi's default compaction runs. See Context and compaction.
• working_state tool. Stages, project agents and the operator agent can keep keyed entries (facts, decisions, progress, to-dos, blockers). Entries survive resume and reappear after every compaction, with secret scrubbing on values.
• Context size and compactions in the console. The stage inspector shows tokens used of the window; the events list shows Context compacted with before/after tokens, summary size and cost. Compaction is charged to stage usage and agent limits.cost_usd.
• compaction-stress example. A three-stage incident postmortem that reads about 1 MB of logs through a context window that forces compaction, with evidence generator and result checker (check-run.mjs).

Changes

• A Pi stage's assignment and envelope contract are in the system prompt. The first user message is now a one-line kickoff instead of the full assignment (which compaction could summarize away).
• read and bash share a per-turn token cap. The first result of a turn always returns; later parallel results in the same turn may be replaced by a short notice once the turn would exceed 40% of the window or the space left after the reserve.
• Emit reminders reset on progress. Reminders cap at 20; a tool-call turn resets the count. Stages that end by writing a tool call as plain text now fail with a clear provider error instead of missing emit_stage_envelope.
• OpenRouter requests that carry tools ask for providers that support them (require_parameters), unless routing is set in models.json. See Providers.
• The Claude backend pins the SDK's auto-compaction on.

v0.42.0

Stageflow v0.42.0

Release notes for versions since v0.39.0.

---

v0.42.0

Features

• Agent author keeps a draft. The create page interviews before it fills the config, shows the chat model, and stores the draft and transcript. Leave the page and open the draft again from Drafts on Agents.
• The author reads documentation only. read_project_file and list_project_files allow docs/, policies/, AGENTS.md, and README.md, and only .md and .txt. Source files are refused.
• The author can see what is already connected. list_author_catalog returns connection ids with provider labels and installed skill names. It does not return secrets, and it does not grant a name that is not listed.
• Document policy review example. examples/document-policy-review/ is a generic agent that compares a document to company policies, with a public chat page. docker-compose.policy-review.yml publishes that host on port 3849.
• Agent author on Cursor keeps one draft. A Cursor composer lists the pi__ tool names, the create page uses one session, and an edit made while the author is still replying is not overwritten.

---

v0.41.0

Features

• Evals: measure whether a stage still works. An eval is a YAML file (*.eval.yaml) that points at one pipeline stage and a dataset of cases (JSONL or JSON), runs every case several times (repeats) in a fresh stage session, grades each output, and reports a pass rate with a confidence interval, reliability across repeats, flaky cases, latency, cost and failure tags. The console has an Evals page (list, results, case drawer with review and tags, Edit with a dataset editor, and a new-eval wizard), an installable sample (POST /api/evals/sample, examples/evals/), and GET/POST routes under /api/evals, /api/eval-runs, /api/eval-compare and /api/datasets. Results live in state.db; eval stage runs do not appear in Runs or Inbox.
• Graders: five kinds, three need no model. schema, field, reference and code graders are deterministic and free; rubric graders ask a judge model and are scored on a pass/fail or 1-to-5 scale. A weighted score is compared with pass_threshold, and must_pass graders fail the result on their own.
• Compare two runs. Compare shows the paired difference with a confidence interval and a verdict (improved, regressed, no clear difference or insufficient data), per-case and per-grader changes, a line diff of the changed system prompt, and warnings when datasets or graders differ.
• sf eval and MCP. sf eval validate, sf eval run (--json, exit 0 when the run passed, 1 below the threshold or failed), sf eval engine status|install, and MCP tools for listing, validating, running, comparing, and canceling evals. sf validate also checks evals and datasets.
• On-demand engine install, Node 22.22+ for evals. Evals run on a pinned promptfoo (0.124.0) installed with sf eval engine install (~1.2 GB). Evals need Node 22.22 or newer; the rest of Stageflow still runs on Node 20+. The Docker image bakes the engine in at /data/eval-engine/0.124.0.
• Evals for agents. Target an agent instead of a pipeline stage with scripted or simulated user scenarios; conversation graders (tool_calls, conversation_check, goal_reached); read-only / mocked / real tool policies with explicit opt-in for real tools.
• Evals: sort failed results automatically. Sort failures (sf eval sort, API, MCP sort_eval_failures) classifies failed results into buckets with optional TypeSafe Jev or judge-model backends; suggestions require operator acceptance before becoming tags.
• Evals console improvements. Reopen running evals, run switcher, searchable model dropdowns, and flexible comparison baselines.
• Provider actions menu in Settings. Replace API key, Sign in again, and Disconnect from the provider card menu.

Changed

• sf validate --strict now fails on eval warnings (e.g. eval.tool_not_granted, eval.tools_unstubbed_list, eval.agent_disabled). The new error eval.read_only_tools_not_mcp applies in both strict and non-strict modes.

Fixes

• Eval console statistics (pass_fraction, grader scores, Compare percent_change) now come from the server.
• Backups include eval stage runs (sf export --all, /api/export).
• Security: read_only_tools could incorrectly allow write or bash in agent evals; only MCP tools can be declared read-only now.
• Eval sessions are read-only for operators (HTTP/MCP refuse chat and approve/deny; console hides composer).
• Eval tool gate also blocks sort_eval_failures and cancel_eval_run, even under tools: real.
• Docker: Host entrypoint sets HOME to the stageflow user's home so the email store works after dropping from root.
• Agent evals: empty replies and provider limits produce error results (EVAL_AGENT_EMPTY_REPLY), not graded failures; five consecutive failures stop the run early.

---

v0.40.0

Features

• Stage file tools can run in a sandbox container. Set STAGEFLOW_STAGE_CONTAINER_IMAGE and read, write, edit, and bash run in a per-attempt container at /workspace. The stage process, memory tools, and credentials stay on the host.
• Compose turns that sandbox on. docker-compose.yml builds stageflow-bash, sets the image variable, and mounts the Docker socket.
• A checkout object creates the worktree. checkout: { branch?, base? } creates or reuses a git worktree; a string path still selects an existing checkout.
• Getting started recommends the published image. docker run of ghcr.io/tejasghutukade/stageflow:0.39 opens the console.

Demo media

Demo video and GIF used by the README. Not a software release.

v0.39.0

Stageflow v0.39.0

Release notes for versions since v0.36.0.

---

0.39.0

Memories — host-scoped folders ($STAGEFLOW_HOME/memories/<id>/) with a cover page and keyed cards. List memory ids on a pipeline or agent so stages and sessions can read/update the cover and manage cards (one previous copy retained). Operators edit covers and cards in the console, including restore and delete. See YAML catalog — Memories.

Features

• Memory cover and cards with search, replace, and operator UI in Memories.

---

0.38.0

Overview — a control-center page for the console (#/overview), pinned above Inbox: gates and agent approvals with inline actions, live runs and agent sessions, system health, run/success trends with spend, outcome breakdowns, and per-pipeline success/time/cost (with flaky tagging). Window selector: 24h / 7d / 30d. Inbox remains the home page.

Features

• Console Overview page and GET /api/overview?range=24h|7d|30d aggregate (light run rows, no stage load, no schema change).

---

0.37.0

Major Agents release: YAML-defined agents with console, web chat, email (AgentMail), iMessage, Slack, Telegram, and schedule triggers; full tracing, approvals, and MCP/REST/CLI parity. Plus MCP console management, model catalog unification, agent inbox integration, and MCP security hardening.

Features

• Agents — agents/<id>.agent.yaml, sessions, run inspector, approvals, sf agents, /api/agents, and MCP tools. See Agents.
• Agent turns & delivery — centralized turnLifecycle; channel replies are part of the turn with retries and agent_deliveries (migration 014); AgentMail and iMessage channels with allow-lists and always_on limits.
• Stageflow tools for agents — grouped MCP registry with risk levels, granular file/shell/Stageflow permissions, operator-only tools enforced.
• Console MCP — add/edit/remove servers from Settings → Project MCP (stdio/HTTP, paste JSON, OAuth sign-in, secrets store); status on load; tool checklist in agent editor; secrets: on stages for console MCP credentials.
• Models — single catalog via GET /api/models from connected providers (Pi fallback); shared pickers across console; default from stageflow.yaml / Workshop / first free OpenRouter model.
• Agent approvals in Inbox — alongside pipeline gates with Approve/Deny and Open session.
• UI — sidebar grouped by job; Agent sessions list (GET /api/agents/sessions); Agents list Reach column; unified page header; new pipeline flows through Workshop only.
• Pipeline authoring MCP — read_pipeline, create_pipeline, edit_pipeline, create_stage, edit_stage, create_task, edit_task, trigger tools, list_agent_sessions, stop_agent_session, archive_agent.
• Console secrets in pipeline stages — declared secrets: for stage MCP only; validated by sf validate.
• Slack/Telegram allow-lists — user ids and @username besides email/phone/domain/*.
• Desktop notifications — agent approvals when stage notifications are enabled.

Fixes

• Ask-first gate stop no longer leaves dangling approvals that could approve a later identical call.
• Idempotent turn finish; guardrail patterns buffer streamed text until reply passes; path protection on all path-arg tools; bash always requires approval; no duplicate channel replies from overlapping retries; safe handling of Origin: null on public chat; reserved agent ids rejected everywhere.
• Agent sessions released after idle timeout, stop, archive, or Host shutdown; cheaper agents directory reads.
• MCP session tools require agent id and reject cross-agent sessions; sf agents chat non-zero without result; sf agents restore requires --base.

Changed

• Run inspector drops redundant Flame graph / Span list tabs.
• GET /api/models adds providers, default, fetchedAt, unlisted; models no longer includes a baked-in list.

Security

• MCP backend hardening: scoped secret resolution for stages vs agents, blocked link-local/metadata URLs, masked configs, scrubbed errors, atomic state writes, OAuth key handling, and stricter credential name allow-lists.

v0.36.0

Stageflow v0.36.0

Send-only communication channels (AgentMail, Slack, Telegram, iMessage/WhatsApp via Photon), a Connections console page, pipeline editor channel wiring, shared host connections with a secret store, run-start channel checks, and safe idempotent sending.

0.36.0

Features

• Communication channels (send-only). Connect AgentMail, Slack, Telegram, iMessage, or WhatsApp once; stages declare channels: with the recipient in YAML and agents get a neutral send_message tool on the Pi backend (no recipient choice). iMessage/WhatsApp use Photon and optional @spectrum-ts/* packages. One channel per stage for this release. See Communication channels.
• Connections page. Connect providers from the console: test before save, replace key, disable, disconnect, per-connection status hints and channels: snippets. First-run empty state lists all providers. Email accounts and .mcp.json tool servers appear alongside. New APIs: GET/POST /api/connections, POST /api/connections/test, PATCH/DELETE /api/connections/{id}, POST /api/connections/{id}/check, POST /api/connections/{id}/validate-target.
• Stage channels in the pipeline editor. Inspector Channels section: pick a connection, enter a validated recipient, see connection status. Pipeline-level channels: persists on draft save.
• Host-level connections and secret store. Connections in $STAGEFLOW_HOME/connections.yaml (project file or STAGEFLOW_CONNECTIONS_FILE override). Secrets via env:NAME or store:NAME in channel-secrets.json (mode 0600); YAML never holds raw secrets.
• Run-start channel check. Preflight, start_run, and sf doctor verify connections live; failures block runs with channel_check_failed (connection + reason). Transient failures retried at most twice.
• Safe sending. Idempotent sends per operation key via a durable ledger; possible provider delivery is never double-sent after restart. Secrets excluded from stage worker, logs, errors, and API responses.
• examples/channels-smoke/ — two-stage pipeline sending one email and one text.

Changes

• Claude agent backend rejects stages that declare channels: instead of running without send_message.
• Docker image includes optional Spectrum packages (~100 MB); npm install --omit=optional skips them and iMessage/WhatsApp report CHANNEL_PROVIDER_UNSUPPORTED.

Known limits

• Free/Pro Photon users must be project users and must text their assigned Photon line once before iMessage sends work; run-start check cannot detect this.
• sf backup does not include connections.yaml or channel-secrets.json.
• Slack, Telegram, and WhatsApp sends not verified against real accounts.

v0.35.0

Stageflow v0.35.0

This release ships the operator console as the primary UI, separates credential storage from run data, and tightens how stage skill: bindings are authored.

[0.35.0]

Features

• Operator console. Inbox, pipelines list, pipeline editor (live DAG, inspector, YAML, Problems, session history), catalog, tasks, triggers, Workshop, and run detail (timeline / graph / list). Single dark console UI; no separate theme picker.
• Workspace catalog as default write root. Omitted project_root resolves to a Host-provisioned writable workspace under $STAGEFLOW_HOME, so Workshop and catalog saves work without a git checkout or multi-root picker.
• Catalog paste-install for skills. Install a skill tree into the workspace .pi/skills root from the Catalog UI (npx skills add wrapper), without requiring project_root when the Host has multiple roots.
• Stage-file editor from Catalog. Edit a single external stage file in the full pipeline editor chrome (graph + inspector + YAML).
• Triggers readiness catalog. examples/triggers-readiness/ ships one trigger per kind (manual, schedule, GitHub pull request, webhook, email, dynamic manual) and is registered in the local Docker image.

Changes

• Breaking: stage skill: is body-only. skill: on a pipeline uses: wrapper is rejected (pipeline.stage_wrapper_skill_rejected). Put skill: on the external stage file or inline stage body. The console inspector and draft overwrite strip wrapper skill. In-repo examples (archify-on-pr, oss-issue-contribution) were migrated. See Skill binding.
• Credential root separate from run data. Stage workers and Workshop resolve provider auth from STAGEFLOW_CREDENTIAL_HOME (default ~/.stageflow); run SQLite stays under $STAGEFLOW_HOME. Cursor models use the credential-root key; other models still require a usable auth.json there and fail closed.
• Docker console image. The image does not bake the full examples/ tree. Compose registers /opt/stageflow/catalog/triggers-readiness so the readiness triggers are listed on a local Host.

Fixes

• Workshop saves use .pipeline.yaml / .task.yaml, re-pin build ties to the catalog save root, and stop claiming paths under a stale image-root examples tree.
• createStage persists skill on the stage file; draft load/overwrite hoists legacy wrapper skill onto the stage body so save cannot drop the binding.
• Workshop mutation cards survive a reload because the transcript stores the draft, not only the summary.
• Run detail header and the stage inspector share one rule for showing Retry, Resume, and Abandon.

---

[0.34.0]

Live browser login from the operator console when the Host has no local window the operator can see.

Features

• Live view for human login gates. When a Host has no window an operator can see, the console shows the stage's browser inside the login gate and forwards mouse, keyboard, paste, and touch input, so a person can log in (password, two-factor, popup sign-ins) from the console. Uses agent-browser's built-in stream relayed by the Host. See docs/browser.md (Live view) and docs/browser-internals.md.
  • Capability-driven gate handoff: local_window on a desktop, live_view (stable path, never a credential) on a Host with a virtual display or headless-only with the relay. A Host with no screen and no live view still fails the login stage early.
  • Console API under /api/runs/:run/stages/:stage/live-view: single-use, short-lived tickets (view or control) redeemed into a path-scoped cookie, an event stream, ordered input, and a dialog answer route. Control works only while the stage waits at a live view gate and is revoked when the gate is answered, abandoned, or cancelled. Input and frames are never logged or stored.
  • Popups and new tabs are followed automatically; confirm and prompt dialogs can be answered in the viewer; alert and beforeunload are handled by agent-browser. Unanswered dialogs are dismissed after browser.dialog_timeout_seconds (default 60).
  • "Reopen browser tab" fallback in the viewer's "Page seems stuck?" section (POST .../live-view/reopen-tab, relay reopenTab()): replaces a tab that stopped accepting input with a fresh one at the same URL in the same browser, moves the stage session and stream to it, then closes the old tab.
  • Virtual display support: a Linux Host without a display but with Xvfb runs the browser headed. Host config keys browser.launch_args and browser.executable_path (never in YAML) for launch options and distribution Chromium on ARM.
  • docker/Dockerfile.browser recipe extending the runtime image with Chromium, Xvfb, and agent-browser (docs/docker.md).
  • Provider-neutral ports with in-tree fakes (browser host capabilities, sandbox orchestrator, live view relay, live view source) as seams for container and provider browser hosts.
  • Opt-in smokes: STAGEFLOW_BROWSER_SMOKE=1 (real Chrome, console API, popups, dialogs) and STAGEFLOW_DOCKER_SMOKE=1 (browser recipe image).

Changes

• Browser permission prompts (camera, microphone, location, notifications, clipboard) are denied by default for every browser session the Host launches (--deny-permission-prompts).
• Browser teardown first closes any live view for the stage or run (bounded wait), then runs the existing tab, session, and anchor order.

v0.33.0

Stageflow v0.33.0

Release covering 0.32.0 and 0.33.0 since v0.31.0.

---

0.33.0

Features

• Hosted runtime API — Embed a repository-free pipeline with createHostedRuntime: pass your Pi AgentPort from createPiAgentPort(), a local run store, and a HostedEventSink to run inline and receive a structured result plus execution receipt. Package skills under .pi/skills/<name>/ are materialized for the run; operator-home skills are not loaded. See Hosted runtime.
• configurePiProviderApiKey — Store a managed OpenRouter key in the Pi auth file the adapter already reads.
• Package exports — Import createHostedRuntime from the stageflow package root.

Changes

• Hosted runs no longer create the operator home. Stage credentials resolve from STAGEFLOW_AGENT_AUTH_PATH when set, otherwise from a path next to the local store.

---

0.32.0

Features

• Email connections — Host-owned IMAP/SMTP mailboxes via workspace email.yaml, with scoped stage tools for send, reply, retrieve, search, and bounded attachments.
• Email triggers — Durable incoming-mail detection and filtered pipeline triggers, with bounded retry queues, historical replay, and optional Sent-folder copies.
• Host UI — Read-only Connections page for configured accounts (no credentials shown); email-rule list and detail on Triggers.
• Examples — Single-stage email-send and conversational threaded-reply flows, including automatic-reply safeguards.

Changes

• Inline mailbox passwords from local YAML stay in Host memory; persisted account config uses opaque credential references only.
• Email list-limit tests use a small mailbox instead of bulk network fetches. Schedule catch-up test is temporarily skipped pending a deterministic timing check.

v0.31.0

Stageflow v0.31.0

Release notes for versions since v0.25.0.

---

0.31.0

Stageflow-owned provider auth on Pi 0.99, bundled Cursor SDK install, and fixes for Cursor stages, Docker builds, and GitHub-only releases.

Features

• Provider auth: Stageflow-owned authentication with Pi 0.99 support and optional disk-based admission for provider credentials.
• Install: pi-cursor-sdk ships with the npm package so Cursor stages resolve the SDK without a separate install.

Fixes

• Cursor stages receive the Host’s Cursor API key instead of failing with missing credentials.
• Docker image build copies .npmrc so npm ci resolves Pi 0.99 peer dependencies.
• CI can run the GitHub release workflow without republishing to npm.

---

0.30.0

Workshop Author in the studio: chat-driven pipeline drafting, persistent builds, and catalog save.

Features

• Workshop Author on #/workshop: a chat agent drafts pipelines, asks when missing details would change stages or wiring, and shows the draft on the studio stage map. Click a stage for prompt, IO, verify, and HITL summary.
• Untitled drafts persist as build records under $STAGEFLOW_HOME/workshop/builds/{id}.json (no catalog file until save). Chat history lives under workshop/sessions; each session points at the build it was editing.
• Author tools to list, focus, and create builds; create and edit pipeline, stages, and optional task; validate; and save. Save writes catalog YAML only when asked and refuses invalid packages unless the operator explicitly allows it. Saves without a folder name land in workshop/<pipeline-id> and are added to the catalog so Run lists the pipeline and task.
• Studio picker lists each open build and each on-disk pipeline once. The same chat can switch builds, or History can reopen the session that last edited another pipeline.
• sf init includes workshop in the pipeline and task catalog. Host boot registers the project root so the catalog is visible without a manual project add.

Changed

• Workshop chat uses the model in stageflow.yaml; when unset, the default is cursor/auto.

Fixes

• npm run dev stage workers load the TypeScript CLI through tsx (no missing src/cli.js).
• A stage process that exits before recording failure is marked failed instead of leaving later stages skipped with the entry still pending.
• Cursor models find pi-cursor-sdk from the Host Pi agent directory; the stage worker attempt HOME no longer hides ~/.pi/agent.

---

0.29.0

Browser sessions for stages: logged-in Chrome profiles, shared browser per run, human login gates, and sf browser CLI.

Features

• Browser sessions via agent-browser through the CLI and bundled browser skill (no MCP). See docs/browser.md and docs/browser-internals.md.
  • Stage browser field: profile, headed, allow_domains, login_url, check (url, logged_in_url, logged_out_url). The agent-browser requirement is added automatically.
  • Named profiles under $STAGEFLOW_HOME/browser/<scope>/<name>/, leased to one run; other runs queue until that run ends.
  • Shared browser per run and profile: one Chrome for the run, each stage attaches over CDP with its own tab; parallel stages share one login. Tabs close at stage end; browser closes at run end, cancel, or abandon. Orphan sweep at Host start.
  • Host-computed login check validated against the stage envelope; human login stage with verify: browser_login and confirm gate (handoff, site, profile). Wrong confirm can retry while repair attempts remain.
  • sf browser profiles | status | check | login | clear.
  • Host config browser.blocked_sites, audit log (browser/audit.jsonl), redaction for browser stages, and owner-scope seams for future multi-tenant use.
  • Example examples/browser-session/ and opt-in real-Chrome smoke test (STAGEFLOW_BROWSER_SMOKE=1).
• Answer responses (HTTP 202, MCP answer_gate, sf runs answer --json) may include optional verification.

Changed

• Stage workers receive the Host’s Pi auth path through STAGEFLOW_PI_HOME_AUTH_PATH.

Fixes

• Stages no longer fail with “No API key” under pi_home when the worker’s empty attempt $HOME hid ~/.pi/agent/auth.json.

Known limitations

• Profile stages use a soft allow_domains check; profile-less stages get the native allowlist.
• Visible login needs a screen; Docker Hosts fail the login stage with a clear message. See docs/browser-internals.md for the full list.

---

0.28.1

Fixes

• Project root resolution no longer requires git. resolveStageflowContext finds the nearest stageflow.yaml first for catalog discovery, trigger-adapter discovery, and stage/pipeline/trigger creation. isGitProject still gates git-only operations but no longer blocks non-git catalogs. Trigger adapters can discover triggers in non-git catalog roots.

---

0.28.0

Pipeline triggers and schedulers: event/schedule YAML, GitHub poll, webhooks, and email connectors.

Features

• Trigger backbone: kind: event / kind: schedule trigger YAML, TriggerSourcePort adapter seam, and dynamic task mode (events can build a one-off TaskFile).
• Three adapters: GitHub poll (ETag-conditional, grouped by repo), generic webhook (per-trigger URL, HMAC-SHA256), and email (IMAP IDLE, pooled connections, bounded-backoff reconnect).
• Generic trigger_adapter_state store table for adapter cursors (ETags, UID watermarks).

Fixes

• event.config passes through on trigger creation (HTTP and MCP).
• STAGEFLOW_GITHUB_POLL_INTERVAL_MS and STAGEFLOW_TRIGGER_TICK_INTERVAL_MS are recognized Host env keys.
• GitHub poll adapter treats HTTP 304 as expected no-op instead of logging an error.

---

0.27.1

Fixes

• Registered catalog roots with local stageflow.yaml list pipelines/tasks without requiring git.
• Cold Host seeds examples browse via examples/stageflow.yaml.
• Empty catalog lists return a registration tip; absolute-path rejections include richer guidance.
• Unset TMPDIR / TMP / TEMP soft-default to $STAGEFLOW_HOME/tmp before Host writability assert.
• HTTP health exposes boot_providers; MCP get_health includes stageflow_home.
• sf init / author defaults prefer a configured provider instead of silently assuming Anthropic.

Changed

• Breaking: Omitting gate_kinds no longer registers ask_operator. Only an explicit non-empty gate_kinds list registers the tool. Stages that relied on omit-means-on must declare kinds. See docs/hitl.md and docs/yaml-catalog.md.
• Quickstart and setup skill split CLI vs MCP smoke; docs contrast STAGEFLOW_OPERATOR_CWD vs catalog project_root.

---

0.27.0

Container images on GHCR, doctor store integrity, and catalog validation improvements.

Features

• Docker delivery: multi-stage Dockerfile, docker-compose.yml, scripts/docker-smoke.sh, CI, GHCR multi-arch publish and cosign sign-by-digest. See docs/docker.md.
• sf doctor store_integrity runs full PRAGMA integrity_check.
• sf validate flags absolute paths under $STAGEFLOW_HOME in stage prompts and verify commands.

Fixes

• STAGEFLOW_BUILD_SHA allowed for container boot and /api/health build_sha.
• Bound-run Pi read/write/edit allow stage checkoutRoot.
• Bare repo cache uses remotes-style fetch with cache healing and pruning for linked worktrees.
• GITHUB_TOKEN / GH_TOKEN { as: env } is additive with git askpass.
• Repository-bound runs reclaim Host worktree on succeeded (keeps run_branch; records checkout_root).

Changed

• docs/mcp.md limitations table updated for Slot 9 surfaces.
• Docker local-try docs as Compose checklist; root .env.example aligned with STAGEFLOW_PROVIDER_* boot keys.
• Harness skills updated for Compose, drive-token MCP, $STAGEFLOW_HOME store, repository/ref binding, and Slot 6 secrets:.

---

0.26.0

Host-global project registry and curated stage environment (Slot 6).

Features

• Project registry under $STAGEFLOW_HOME: durable ensure of project roots; sf run ensure-then-starts; remotes use registered ∪ seeded catalog roots only. See docs/mcp.md, docs/cli-reference.md, docs/data-directory.md.
• Curated stage environment: stages no longer inherit Host ambient env; declare secrets:; file-backed git askpass; redaction; proxy/CA passthrough; shared cache; MCP connect default 30s; stage-process/heap caps; Claude-as-root refusal. See docs/migration-stage-environment.md.

Changed

• Shared catalog start/write path resolution; MCP run_stage and A2A honor same containment as start_run.
• Operator-terminal statuses (cancelled / queued) preserved in deriveStatusFromStages.
• Host shutdown uses single DrainableHost drain path.
• Path-checkout lease only for path-bound runs; repository-bound runs get parallel worktrees.
• verify commands run under bash -c.
• Stage MCP ${VAR} interpolation uses curated stage env only.

Removed

• Dead RunStore.listProjectRoots and unused isMutatingApi predicate.