v0.18.2

v0.18.2 — Notes land cleanly, release versions stay current, and the public product surface matches the dashboard

Released 2026-08-01.

What changed

A failed Git push is no longer mistaken for denied access just because its path contains 403

fix · low impact

The fork fallback now recognizes GitHub's complete HTTP 403 failure phrase instead of matching the three digits anywhere in stderr. A local path or generated fixture name containing 403 therefore remains the original push error and cannot trigger an unrelated fork attempt.

Affects: Git push classification, fork fallback

A note is validated before its pull request opens and remains legal in every artifact state

fix · high impact

a2a note and its MCP twin now ask the shared fold legality engine before writing. A note remains transition-free and does not change the artifact state, but only either party named by the artifact may add one. This is the same rule the space validator applies, so an authorized note on a submitted response passes the required check instead of opening a pull request that can never merge, while an outsider is refused locally before any branch or pull request is created.

Affects: a2a note, MCP lifecycle tools, fold legality, space validation

What to do (local): Update the a2a binary before adding notes to active exchange artifacts; no document or space migration is required.

Check: a2a version

a2a update --yes

The website and local release tooling no longer report the release before the one actually published

fix · normal impact

Public releases are now derived only from exact immutable tag refs, and the Pages build fetches complete tag history. After a proven candidate is promoted, the publisher imports the exact verified public tag back into the private source checkout before it returns. This closes the filtered history gap that left the website, roadmap and release-aware agents on 0.18.0 even though GitHub, the installed binary and operated spaces were already on 0.18.1. Authored notes without a matching tag remain hidden as release candidates rather than being mistaken for shipped software.

Affects: release publisher, changelog, roadmap, GitHub Pages

The public site demonstrates the real dashboard instead of describing it with a second interface

feat · normal impact

The product homepage now embeds the same exchange map, artifact proof, status badges, filters, disclosures and visual tokens as the local dashboard. Features is generated from the dashboard Guide source, public page headers follow one component grammar, and compact cards, popovers, modals, mobile layouts and dark mode share the same interaction and spacing rules. Human owners can carry locally cached GitHub avatars after an explicit sync while every offline render keeps a monogram fallback and performs no network request. Doctor reports missing active-owner images as a non-blocking advisory with the exact a2a sync repair, so people never need to inspect or manage the cache themselves.

Affects: a2ahub.dev, a2a html, a2a doctor, design tokens, dashboard map, avatar cache

Search engines and agents get canonical, complete and provenance-labelled product evidence

feat · low impact

The static site now publishes canonical route metadata, a sitemap, Atom release feed, permissive crawler policy, structured data, security.txt, a compact llms.txt and a complete llms-full.txt assembled from the current embedded documentation and tagged releases. The synthetic dashboard is excluded from indexing, Google Analytics loads only on the public site, and the quality gate checks accessibility, links, metadata, bundle shape and Lighthouse budgets before Pages deploys. The shared runtime also keeps unbooted design markup out of the first visible frame, eliminating a timing-dependent changelog layout shift; a deliberately delayed-runtime browser check now guards that first-paint contract.

Affects: SEO, agent discovery, llms.txt, accessibility, performance, analytics

Prompt refreshes finish independently without turning optional avatar downloads into shell latency

fix · normal impact

The detached statusline refresh now owns a real operating-system session, carries a five-second end-to-end budget and skips optional avatar downloads while retaining mirror and update-notice refreshes. Explicit a2a sync still refreshes avatars normally. Scoped e2e verification also refuses a cached CLI from an earlier run, so a stale binary can no longer hide a regression in the source currently under test.

Affects: a2a statusline, background sync, avatar cache, scoped verification

Known issues

The macOS companion remains ad-hoc signed and may require manual approval

known issue · normal impact

The release cohort authenticates the exact macOS app and ad-hoc signing protects its bundle integrity, but the app is not identified or notarized through a paid Apple Developer account. A quarantined download may require one explicit System Settings → Privacy & Security → Open Anyway decision. Interactive Notification Center, Focus, Login Items, VS Code trust/profile, and remote-window checks remain release-environment evidence rather than claims inferred from hermetic tests.

Affects: macOS notifications, VS Code notifications

Current guidance: Keep Gatekeeper enabled and approve only the A2A Notifier version obtained through the verified a2a release cohort.

Install or update

macOS and Linux:

curl -fsSL https://raw.githubusercontent.com/ydnikolaev/a2ahub/main/scripts/install.sh | sh

Already installed? Run a2a update --yes. Windows archives and manual downloads are in the assets below.

Release artifacts include checksums, per-asset Sigstore bundles, SBOMs, and SLSA provenance. See SECURITY.md for verification commands.

Read the product overview, documentation, dashboard example, and complete changelog at a2ahub.dev.