Vellum 0.7.2

A broad reliability release focused on the Chrome extension and cloud connection path, macOS workflow polish, contact and communication flows, heartbeat and schedule reliability, and tighter gateway security.

Highlights

• Chrome extension and cloud reliability improved across the board: requests now send fresh session tokens consistently, platform API calls use the right headers and base URLs, self-hosted pairing is fixed, and the extension is prioritized over the macOS SSE bridge for browser control
• Gateway and security hardening tightened local and cloud boundaries, including stricter loopback handling, known-origin checks for pairing and CORS, safer token refresh behavior, secret redaction before recall evidence reaches the model, and reduced elevated capabilities in Docker-mode assistant containers
• Contact, messaging, and document workflows got smoother with contact prompt commands and macOS panels, gateway-owned Slack contact upserts, missed @mention catch-up after socket reconnects, stronger trusted contact checks, and PDF export for Document Writer
• Conversation workflows are more resilient with reliable notification deep links, Mark as read in the conversation context menu, a cleaner conversation-switch loading skeleton, visible trust-rule save errors, and the new burst-based Worked for X.Ys activity model
• Open-source visibility improved in the macOS app with a new Settings card for the public GitHub repo and a View on GitHub link in the About panel
• Scheduling, heartbeat, and operations are more robust: scheduled tasks can retry after failures, heartbeat runs use cron-style timing with missed-run detection, SSE disconnects are detected faster with a heartbeat watchdog, and assistant gateway logs tail makes gateway debugging easier