@geminixiang/mikan 1.0.0-beta.6 → 1.0.0-beta.61

package/CHANGELOG.md

@@ -9,6 +9,954 @@ any release.
 
 ## [Unreleased]
 
+## [1.0.0-beta.61]
+
+### Added
+
+- Ground Slack DM progress replies in runtime/v4 task observations; common task-thread status queries no longer steer work, and ordinary followups do not repeat completion mentions.
+- Slack DM task handoff: independent task threads keep the main conversation free, with text steering in active task threads and continuation after stopping.
+
+### Fixed
+
+- Keep thread stop acknowledgements in the source thread, including shared-channel unmentioned stop controls.
+- Notify Slack DM task requesters with a fresh in-thread mention after normal completion.
+- Finalize stop acknowledgements that arrive after the cancelled run has already settled.
+- Propagate final response delivery failures so rejected updates do not trigger completion notifications.
+- Honor stop during runner preparation and keep older active tasks visible in status queries.
+- Report task admission, asynchronous startup, and status inspection failures through the existing Sentry/OTLP observability path.
+
+### Changed
+
+- Publish the already built and verified npm package without rerunning build and repository setup lifecycle scripts.
+- Keep the documented and CI coverage commands as stable entry points while maintaining their shared Vitest invocation in one place.
+- Validate debug Session View selections from their path and header, leaving full parsing to consumers that load session content instead of inspecting the same file twice.
+
+## [1.0.0-beta.60]
+
+### Fixed
+
+- Separate CJK-adjacent bold dollar amounts for Slack's Markdown parser while preserving code and link destinations.
+- Validate Session View selections through read-only inspection so active and repeatedly selected historical sessions do not conflict with writer ownership or appear corrupted.
+
+## [1.0.0-beta.59]
+
+### Fixed
+
+- Keep Slack's working indicator in its own paragraph so progressive heading and table updates can replace existing rich-text messages without `block_mismatch`.
+- Pace failed progressive redraws as well as successful ones, retaining accumulated text for recovery instead of retrying on every delta.
+
+### Changed
+
+- Use Commander for CLI option parsing, subcommand validation, and generated help.
+- Guide interactive onboarding with arrow-key selections, masked credentials, and a final confirmation before saving. Cancel without writing settings.
+- Refuse custom-provider onboarding when models.json already exists, without printing credentials or writing partial settings.
+
+## [1.0.0-beta.58]
+
+### Added
+
+- Restore Slack `/pi-auto-reply on|off` with the original per-conversation marker files, without judge models or rules.
+- Expose the admin portal command on Discord and Telegram.
+
+### Changed
+
+- Collapse conversation sections in the Admin portal, load their data only when opened, remember their open state, and open Vault and Session View links in new tabs.
+
+## [1.0.0-beta.57]
+
+### Changed
+
+- Export raw platform conversation, channel, session, thread, message, and user identifiers so Sentry traces can be mapped directly back to their source while continuing to exclude human-readable names and conversation or tool content.
+
+### Removed
+
+- Remove telemetry identifier hashing and the `TELEMETRY_HASH_KEY` deployment setting.
+
+## [1.0.0-beta.56]
+
+### Added
+
+- Add content-free agent diagnostics for actual model IDs, token and cost totals, first-token latency, context utilization, message and attachment counts, payload sizes, tool categories and status, and retry, compaction, and budget summaries.
+
+### Security
+
+- Replace raw conversation, session, message, thread, and user telemetry identifiers with stable opaque values, support deployment-specific HMACs through `TELEMETRY_HASH_KEY`, and stop sending usernames to Sentry.
+
+## [1.0.0-beta.55]
+
+### Added
+
+- Export explicitly configured, content-free traces and metrics over standard OTLP HTTP/protobuf, including GenAI and OpenInference attribution for Arize Phoenix. Sentry remains available for sanitized issues and legacy metric fallback without duplicate spans; zero configuration remains network-free.
+- Add a guided Admin dialog for configuring MCP servers, with structured fields or pasted standard `mcpServers` JSON and card-based installed-server management.
+
+### Changed
+
+- Delegate the agent run loop, retries, compaction, persistence, cancellation, and the native `read`, `write`, `edit`, and `bash` tools to Pi's `AgentHarness` and execution-tool implementations. mikan retains budgets, platform presentation, authorization, and sandbox-backed execution routing.
+- Upgrade `pi-agent-core` and `pi-ai` to 0.85.1, including GPT-6 Astra catalog entries and the 30-minute prompt-cache TTL for GPT-5.6+ Responses models.
+- Consolidate harness, office, session, sandbox, web-adapter, and shared-command ownership without changing the published root exports.
+
+### Removed
+
+- Remove managed skill packages and their Admin/package materialization surfaces. Workspace and conversation skills remain supported.
+- Remove the auto-reply judge, command, configuration, and UI; explicit platform triggers remain supported.
+- Remove the unused `/api/agent-events/stream` SSE mirror, its token setting, and supporting event types. The authenticated session viewer continues to use `/session/stream`.
+
+### Fixed
+
+- Preserve Pi's native optional tool schemas, require an explicit authorized execution environment for native file/shell tools, and keep container working directories inside the guest instead of applying them to the host Docker process.
+
+## [1.0.0-beta.54]
+
+### Changed
+
+- Admin portal: MCP servers are added by pasting the server's standard `mcpServers` JSON (Claude Desktop / Cursor shape), stored as-is; the old name / target / `KEY=value` form is gone. Every add and preset install is followed by a real connection check, and the response shows the tool count or the server's own error; a per-server **Test** button re-checks an installed entry. Query-string values in listed URLs are redacted. stdio entries now run their command on the host at save time.
+
+## [1.0.0-beta.53]
+
+### Changed
+
+- Graceful shutdown drains in-flight runs for up to five minutes (was 30 seconds) after stopping intake; runs still open at the deadline are aborted and their conversations receive a restart notice instead of silence. The pm2 template `kill_timeout` is now six minutes; update your `ecosystem.config.cjs` to match. Shutdown failures now log every nested step error.
+
+### Added
+
+- Send the run user (id and username) with Sentry events instead of stripping it, so Conversations show who sent each message; email and IP stay dropped.
+- Set the Sentry conversation id to the session key on every agent run so Agent Monitoring groups gen_ai spans per thread.
+- Report subagent outcomes to Sentry from the subagent tool: `agent.subagent.runs` / `agent.subagent.duration` metrics and a lifecycle breadcrumb for every status; a Sentry error under `error_domain=subagent` for `failed` and `invalid_output` (fingerprinted by error class) and for launch failures. `budget_exceeded`, `timeout`, `cancelled`, and `skipped` stay metrics-only. Reports carry run metrics, never task text or labels.
+
+## [1.0.0-beta.52]
+
+### Removed
+
+- Remove the subagent `requiredTools` / `required_tools` mechanism: the post-run "every listed tool was invoked" check was a proxy for evidence that never held and failed only after the budget was spent. Callers that want evidence can read `toolCallCounts`.
+
+## [1.0.0-beta.51]
+
+### Fixed
+
+- Drop `requiredTools` from built-in subagent profiles; requiring both `read` and `bash` discarded finished answers from tasks that needed only one of them.
+- Keep a caller's `requiredTools` when the request also names a profile.
+- Stop dropping the retained assistant message when an overflow retry rebuilds context from the store.
+
+### Changed
+
+- Read mikan session metadata through Pi's `session.getValue` in `open`/`inspect`; compare `fstat` fields instead of hashing the file for pending-session materialization.
+
+## [1.0.0-beta.50]
+
+### Fixed
+
+- Tolerate byte-identical duplicate Dream session files while rejecting divergent same-ID files.
+
+## [1.0.0-beta.49]
+
+### Changed
+
+- Configure OpenConnector only at startup with `OPENCONNECTOR_ENDPOINT` and `OPENCONNECTOR_ADMIN_TOKEN`; ignore settings overrides of the reserved server, and reduce the Admin MCP Marketplace to the Metabase preset.
+
+## [1.0.0-beta.48]
+
+### Added
+
+- Add an offline session migration for Pi 0.84-generation v4 JSONL files, with verified atomic replacement and preserved `*.pi-084.bak` originals.
+
+### Changed
+
+- Upgrade `pi-agent-core` and `pi-ai` to 0.85.0 and persist sessions with the current `v: 4`, `storageVersion: 1` schema.
+- Extend `mikan sessions migrate` to convert both legacy mikan v3 and Pi 0.84-generation v4 sessions while the daemon is stopped.
+
+## [1.0.0-beta.47]
+
+### Added
+
+- Integrate OpenConnector as a host-side MCP gateway: Slack Conversation offices receive scoped runtime identities, while provider OAuth connections remain in the gateway and execution audit stays attributable to the originating conversation.
+- Preserve operating guidance supplied during MCP initialization and present it to the agent with explicit system-prompt and user-intent boundaries.
+- Add automatic selection of a sole OpenConnector provider connection when an action omits `connectionName`; retain explicit selection when multiple accounts exist.
+
+### Changed
+
+- Gate MCP tools by the platform trust model and enforce the untrusted package boundary.
+- Make platform shutdown cleanup bounded and strengthen runner/session lifecycle rollback handling.
+
+### Fixed
+
+- Isolate Slack DM and thread E2E context and bound event-delivery waits.
+
+### Tests
+
+- Add coverage for OpenConnector token provisioning, MCP instruction propagation, connection selection, trust gating, lifecycle cleanup, and Slack isolation.
+
+## [1.0.0-beta.46]
+
+### Added
+
+- Add an interactive `mikan onboard` wizard that configures one chat adapter, an LLM provider, and the sandbox, writing private environment and settings files while retaining non-interactive template generation.
+- Derive shared workspace visibility from platform channel privacy: Slack public channels can update shared memory, private channels receive it read-only, and DMs, external channels, unknown kinds, and other platforms stay isolated unless explicitly overridden.
+- Schedule Dream maintenance for Conversation-office memory with durable evidence checkpoints.
+- Add an Admin MCP Marketplace with reviewed GitHub, Context7, Playwright, Sequential Thinking, and Metabase presets; Metabase installations accept an instance endpoint and API key.
+
+### Changed
+
+- Remove the executable extension system and its CLI/chat management surfaces; packages remain the supported path for deploying read-only skills.
+- Remove the harness `auth.json` credential store; configure provider credentials through environment variables, onboarding, or the conversation vault.
+- Remove Gondolin, Firecracker, and GitHub Cloud Build log integrations from the supported runtime surface.
+- Fail closed when a sandbox backend cannot enforce an isolated office or read-only shared workspace memory; use `image:*` or explicitly select a trusted read-write projection.
+- Consolidate runtime, session, adapter, web, and configuration ownership to reduce duplicate lifecycle and parsing rules.
+
+### Fixed
+
+- Preserve streamed UTF-8 output when host sandbox chunks split multi-byte characters.
+- Re-aim migrated session lanes at the nearest surviving ancestor when the newest v3 entry contains facts but no v4 message.
+
+### Tests
+
+- Move CI action runtimes to Node 24 and strengthen runtime, presenter, workspace-projection, MCP marketplace, and session migration coverage.
+
+## [1.0.0-beta.45]
+
+### Fixed
+
+- Session migration now collapses crash-duplicated v3 lines (a retried append writing the same header and entry twice) the way the v3 reader did, instead of failing v4 verification on the duplicate id. Found rehearsing the migration against 5,446 production session files; after the fix all migrate and reopen cleanly.
+
+## [1.0.0-beta.44]
+
+### Added
+
+- Connect MCP (Model Context Protocol) servers via `mcpServers` settings and expose their tools to the agent as `mcp__<server>__<tool>`; stdio and streamable-HTTP transports, per-server failures isolated, credentials held host-side in server config out of the model's reach.
+- Manage MCP servers from the admin portal: per-conversation and global panels with add, enable/disable, and remove; credential values are redacted to key names in the UI.
+- Migrate sessions to pi's v4 format with a `mikan sessions migrate` CLI; pi upgraded to 0.84.3.
+- Extensions can declare required host capabilities in `package.json` (`mikan.requires`); activation checks them before importing the module and `mikan ext validate` reports them.
+
+### Changed
+
+- Split the agent module into five authority modules (catalog, prompt, runner, subagent-runner, types); the runtime now owns session rotation decisions and per-event chat-history sync.
+- Derive all platform command registration and routing from the single command manifest.
+- Adopt pi-ai's retryable-error classifier instead of a local copy.
+- Conversation runtimes are keyed by office key, fixing cross-conversation runner reuse after ID changes.
+
+### Fixed
+
+- Session files enforce single-writer ownership, surviving inode reuse and stale writer claims.
+- Failed extension activations roll back cleanly; duplicate tool names are rejected.
+- Slack slash commands in threads carry the thread session key instead of falling back to the top-level session.
+- GitHub first-contact stop no longer creates participation state.
+- Subagent deadlines are enforced by a single wall-clock timer; `before_agent_start` hooks run before auth and pre-turn compaction.
+- Sandbox container removal failures no longer clear ownership, preventing orphaned containers.
+- Run outcomes settle from the final message and run state is released on throw.
+
+## [1.0.0-beta.43]
+
+### Added
+
+- Add an optional authenticated GitHub webhook endpoint that wakes polling immediately for lower-latency issue and pull-request handling.
+- Add a machine-readable architecture index and generated system architecture documentation for repository-wide module boundaries and flows.
+
+### Changed
+
+- Run manual and automatic Session Dreams in the background while preserving session rotation and conversation maintenance boundaries.
+
+### Fixed
+
+- Wait for final Slack thread responses in isolation coverage instead of accepting provisional native-stream text.
+
+### Tests
+
+- Add regression coverage for GitHub webhook authentication and dispatch, background Session Dream lifecycle behavior, and final Slack stream settlement.
+
+## [1.0.0-beta.42]
+
+### Changed
+
+- Dispatch Slack extension commands when users type the command name without a leading slash, so documented Agent Project Manager commands work in ordinary messages.
+- Update `@earendil-works/pi-agent-core` and `@earendil-works/pi-ai` to 0.83.0.
+- Clarify Agent Project Manager onboarding, initial behavior, and the distinction between commands and natural-language tasks across all translated guides.
+
+### Fixed
+
+- Stabilize Slack end-to-end coverage for extension command dispatch, Agent Project Manager, and long-message threads.
+
+### Tests
+
+- Add regression coverage for slashless extension command routing and conversation runtime dispatch.
+
+## [1.0.0-beta.41]
+
+### Added
+
+- Add Slack App and Agent manifests plus support for `assistant_view` and `agent_view` lifecycle events, including thread-aware assistant context and optional socket-event tracing.
+- Add Discord Components V2 responses with native sections, separators, containers, and markdown-table rendering suited to Discord's width model.
+- Add rich Telegram responses through platform-native formatting.
+- Show the current activity of running subagents in progress dashboards.
+- Add an end-user Agent Project Manager guide in English, Japanese, Simplified Chinese, and Traditional Chinese.
+
+### Changed
+
+- Pace progressive redraws by elapsed time instead of response volume, and edit overflow messages rather than repeatedly posting replacements.
+- Split Slack streamed text at the 12,000-character API limit, decline unsupported native streams before starting them, and hand off a truncated final tail exactly once.
+- Report package-installed extensions in `/extensions` and return a clear compatibility error when an extension requires a newer mikan version.
+
+### Fixed
+
+- Preserve final-source preparation during progressive replacement and cut truncated Slack messages at line boundaries.
+- Distinguish Slack length-limit failures from other send errors instead of treating every failure as oversized content.
+- Prevent desktop automation helpers from sending into a Slack thread's main composer.
+
+### Tests
+
+- Add coverage for Slack assistant lifecycle and stream limits, Discord Components V2 and table formatting, progressive overflow editing, rich Telegram context, subagent activity reporting, and extension compatibility reporting.
+
+## [1.0.0-beta.40]
+
+### Added
+
+- Add deterministic extension callback schedules that run host-side without an agent run, model call, or token spend; schedules persist across restarts and use host-authoritative storage.
+- Add extension APIs for reading conversation or thread history, listing active platform users, opening direct-message conversations, and posting threaded notifications.
+- Add declarative extension secrets with activation-time validation, CLI visibility, admin portal provisioning, and purge support.
+- Add a production-ready agent project manager example built as an Event → Workflow → Task pipeline with SQLite persistence, scheduled heartbeats, threaded polling, delivery tracking, and Slack end-to-end coverage.
+
+### Changed
+
+- Make proactive extension messaging default to the conversation's platform, removing ambiguity in multi-platform deployments.
+- Make `api.notify` return the posted message ID and allow `api.fetchHistory` to read replies beneath that message, enabling poll-only follow-up workflows without webhooks.
+- Make `mikan ext remove --purge` sweep an extension's schedules, secrets, data directories, and optional workspace event files while reporting leftovers for non-purge removals.
+- Enable stricter TypeScript and lint enforcement for indexed access, type-only imports, Node.js import protocols, dependency cycles, explicit `any`, nesting depth, function size, and parameter count.
+- Consolidate duplicated authorities and thin wrappers into their owning modules, and refresh repository documentation for the office architecture.
+
+### Tests
+
+- Add coverage for callback schedule persistence and dispatch, extension secrets, platform reads, threaded notifications, purge behavior, and the agent project manager pipeline.
+
+## [1.0.0-beta.39]
+
+### Fixed
+
+- Slack mentions now actually notify people: the adapter resolves response-source `<@userName>` (and display-name) mentions to Slack's native `<@U…>` id form on every outgoing path, including streamed responses. Previously mentions rendered as literal text and never pinged anyone; scheduled-event texts that hard-require raw user ids as a workaround can go back to plain `<@userName>`. The system prompt now also names the Users table as the one source of mention handles and forbids borrowing handles from other platforms (a GitHub username is not a Slack mention).
+- Discord slash commands register again: the `/sandbox` option description had grown past Discord's 100-character limit, which made Discord reject the whole registration batch at startup. A manifest test now enforces the budget for every command, argument, and Telegram menu description.
+- Fix `generate_image` losing its generated file at the upload step (`sh: … cannot open /workspace/<file>: No such file`): the tool wrote the image host-side into the workspace base and then handed a bare filename to the attach upload path, which reads through the sandbox — where the base is no longer mounted since the office layout migration. The image is now written into the conversation's own office directory (guest-visible) and uploaded directly by host path, with no sandbox round-trip, under every door policy. Image-generation provider errors now also name the model id that was sent.
+- The Slack e2e workflow works again after the door-policy and office-key changes: the runner's settings opt into the trusted door policy explicitly (host mode is refused under the isolated default by design), local-delivery verification reads the office-key log path, and one recall prompt was disambiguated.
+
+### Changed
+
+- The Conversation office is now a first-class module: `src/office/` owns identity, the Workspace/Office layout values, the registry journal, and the boot migration. Option bags across the runtime carry one `office` value instead of parallel address/directory fields, the attachment convention has a single owner on the shared adapter surface, and `ChannelStore` is gone. No behavior or on-disk layout change.
+- Embedders can now construct the runtime from the public surface: `createWorkspace`, `createOfficeAddress`, and `officeKey` (plus the `Office`/`Workspace` types) are exported, and `createConversationRuntime` takes a `workspace` value in place of the `workingDir` string.
+- Repository layout for contributors: run-it assets live under `deploy/` (pm2, docker, examples), the test suite lives at `src/test/`, and tool configs live in `.config/` (root keeps `package.json` and `tsconfig.json`). The build config moved to `src/tsconfig.build.json`.
+
+## [1.0.0-beta.38]
+
+### Fixed
+
+- Align the conversation-skill symlink guard with what the host actually reads: symlinked entries are skipped per skill — with the skipped paths named in the host log and surfaced to the agent in its prompt — instead of one symlink anywhere disqualifying the whole tree, and symlinks inside vendored `node_modules` or dot directories (which the loader never reads) no longer disqualify anything. Offices whose skills vanished because a skill vendored npm dependencies (`.bin` symlinks) get them back.
+
+## [1.0.0-beta.37]
+
+### Fixed
+
+- Stop discarding preserved container contents on mount drift: a drifted managed container is now committed and re-created from its snapshot with the desired mounts — writable layer intact — instead of being rebuilt from the base image. This closes the gap that recreated layout-migrated containers from scratch on their first message after upgrade (stored mount signatures went stale as shared sources changed overnight). `MIKAN_SKIP_CONTAINER_PRESERVATION=1` restores plain recreation.
+- Stop treating ordinary directory activity as mount drift: directory mount sources are now fingerprinted by identity (a replacement directory is drift) instead of size and mtime, so event-file churn and children being created no longer force container rebuilds. File sources keep content fingerprints — atomic replacement leaves a stale inode in the container and must recreate it.
+- Door-policy changes now preserve container contents through the rebuild; the portal and `/pi-sandbox door` copy no longer warn about a reset.
+
+## [1.0.0-beta.36]
+
+### Added
+
+- Make the office door policy configurable: the Admin portal gains a per-office selector (global default / isolated / trusted shared-support / trusted full) plus a global-default selector, and the existing `/pi-sandbox` command gains `door <default|isolated|shared|full>` — both write the explicit `sandbox.workspace` settings and retire the legacy `image.workspaceMount` key on save.
+- Door-policy changes follow the same clear-or-refuse contract as model changes (the system prompt bakes the workspace projection), and the sandbox container is rebuilt with the new mounts on the office's next message.
+
+## [1.0.0-beta.35]
+
+Completes the office storage migration introduced in 1.0.0-beta.34: sandbox containers now survive it with everything installed inside them intact. Upgrading directly from 1.0.0-beta.33 or earlier to this release keeps container contents; deployments that already booted 1.0.0-beta.34 had their containers recreated by that release.
+
+### Added
+
+- Preserve managed sandbox containers through the office layout migration: each container still mounting legacy paths is committed to a snapshot and re-created with translated workspace, state, and vault mounts, keeping its writable layer — software installed inside survives the upgrade.
+- Migrate containers off the boot path: on demand before a conversation's next message and via a background sweep after the platforms start, so boot stays fast and nothing blocks on the one-time cost.
+- Resume interrupted container migrations safely: the pre-removal mounts ride on the snapshot image, a crash at any point resumes without data loss, and snapshots are reclaimed once a container naturally returns to the base image.
+- Add the `MIKAN_SKIP_CONTAINER_PRESERVATION` escape hatch to fall back to plain container removal.
+
+### Tests
+
+- Cover translate, no-op, resume, orphan-resume, snapshot reclamation, and disarmed paths on a stateful docker mock, plus bind-translator unit tests; rehearsed against real docker including the crash-resume path.
+
+## [1.0.0-beta.34]
+
+**One-way storage migration.** On first boot this release renames every conversation's workspace directory, credential vault, and host state tree to platform-scoped office keys, journaled with crash recovery. Back up the state dir and workspace before upgrading; earlier versions cannot read the migrated layout, so there is no downgrade. Managed sandbox containers for migrated conversations are recreated, which resets software installed inside them once (a preservation path is planned for a follow-up release).
+
+### Added
+
+- Isolate every conversation as an office keyed by platform and conversation id, ending all cross-platform collisions on shared raw ids: runtime state, workspace files, chat logs, attachments, credential vaults, settings, extension data, and scheduled-event scoping are now platform-scoped.
+- Migrate legacy directories automatically at boot: ownership is verified against each enabled platform's id format, ambiguous or unrecognized directories fail closed as needs-owner, and repositories or build output sitting in a trusted workspace root are skipped in place.
+- Add the `mikan office` CLI: `list` shows the office inventory and pending migrations; `claim` assigns an owner platform to a legacy directory the format check cannot decide.
+- Record every office in a host-only registry at creation, giving Admin and CLI surfaces a durable raw-id ↔ office mapping.
+
+### Changed
+
+- Scope the Admin portal by office: conversation lists show platforms, cross-platform targets name theirs explicitly, and all paths, settings, projections, and vault links resolve from the full office address.
+- Show office-key paths (`/workspace/v1-slack-…`) in agent prompts and workspace listings; transcripts from before the upgrade may reference old paths until the agent re-lists.
+- Breaking for embedders: `createRunner`, `MessagingEventHandler`, settings, package, and extension APIs now carry an `OfficeAddress`.
+
+### Fixed
+
+- Preserve Session Dream memory writes after the migration; the write grant previously derived the memory path from the raw conversation id and would have refused every dream.
+- Stop `mikan ext` from resolving conversation state against the wrong state dir when `--state-dir` differs from the environment default.
+- Keep thread sessions anchored to their main-session lineage via `parentSessionId`.
+
+### Tests
+
+- Add migration-engine coverage for claiming, crash recovery, ambiguity, reappeared directories, vault and state-tree moves, and format verification; rehearsed end-to-end against a production-shaped 327-entry workspace (285 offices migrated in ~2.4s, zero manual claims, checksums identical).
+- Keep state-writing tests out of the developer's real `~/.mikan` with a suite-wide temporary state dir.
+
+## [1.0.0-beta.33]
+
+### Changed
+
+- Give every built-in subagent profile a 100,000-token allowance and honor larger token budgets requested by the parent model.
+
+### Fixed
+
+- Disable Sentry's faulty OpenAI integration to prevent instrumentation failures in model-provider requests.
+
+### Tests
+
+- Add regression coverage for subagent profile token defaults, model-requested increases, tool schema behavior, and disabled OpenAI instrumentation.
+
+## [1.0.0-beta.32]
+
+### Changed
+
+- Raise the autonomous event and trigger run cost stop-loss from $2 to $10 while retaining the 10-minute and 50-call limits.
+- Allow session memory dreams to make up to 10 LLM calls and remove their fixed cost cap while retaining the two-minute limit.
+
+### Fixed
+
+- Prevent large conversations from becoming permanently unable to reset or rotate when preserving memory necessarily exceeds a fixed cost threshold.
+
+## [1.0.0-beta.31]
+
+### Changed
+
+- Allow attachments to use each sandbox executor's standard file reader while retaining workspace path containment.
+
+### Fixed
+
+- Restore HTML, image, and document uploads from managed sandboxes that cannot provide atomic symlink-free traversal.
+
+### Tests
+
+- Add end-to-end regression coverage for staging and uploading workspace files through the regular executor transport.
+
+## [1.0.0-beta.30]
+
+### Added
+
+- Add role-based subagent profiles for software engineering, DevOps, data science, account management, business development, creative production, advertising operations, and bounded general work.
+- Add a generated cross-module hardening report covering module boundaries, coupling, and verification evidence.
+
+### Changed
+
+- Stabilize exported module interfaces and route executor-dependent file staging through the active execution transport.
+- Deepen progressive response rendering and keep Slack E2E turns bound to the runner lifecycle.
+
+### Fixed
+
+- Prevent extension packages, attachment bridges, vault keys, sandbox paths, and event inputs from escaping their intended boundaries.
+- Close runner construction, cached-runner invalidation, Gondolin projection, and automatic Session Dream settlement races.
+- Validate model identifiers, event timezones, package refreshes, and shared-history watermarks consistently.
+- Keep reset history bounded by reset time and exclude queued future turns from session history.
+- Prevent Slack from posting bare working-indicator updates.
+
+### Security
+
+- Harden Git package materialization, extension subpaths, filesystem bridges, and sandbox path validation against traversal and symlink escapes.
+
+### Tests
+
+- Add regression coverage for declaration surfaces, session history boundaries, runtime races, event validation, package materialization, and Slack runner integration.
+
+## [1.0.0-beta.29]
+
+### Added
+
+- Add Git-sourced extension packages with global and conversation scopes, package mount resolution, CLI inspection, and admin portal management.
+- Add native Slack markdown-block responses and the `slack_blockkit` tool for interactive Block Kit messages.
+- Add interactive Block Kit APIs for extensions, with a poll extension example.
+- Add named subagent profiles, built-in workflow specialists, per-profile tool grants, and a bounded Slack progress dashboard.
+- Preserve durable memory with Session Dream before biweekly shared-channel session rotation, using the same conversation-scoped maintenance path as `/new`.
+
+### Changed
+
+- Run Gondolin runtimes inside the mikan process instead of detached workers. Restarts now boot fresh VMs on demand, and shutdown closes every VM so projected files sync back first.
+- Remove Gondolin runtime inventories, worker heartbeats, and the `stateDir` argument from `configureGondolinRuntime`.
+- Render standard GFM response prose as native Slack markdown blocks while keeping progressive response updates behind a single lifecycle.
+
+### Fixed
+
+- Keep the current session active and preserve saved memory when Session Dream cannot finish.
+- Bound subagent cancellation, invocation modes, profile labels, and Block Kit payloads; clamp long labels with an ellipsis instead of rejecting calls.
+- Show the selected subagent profile and its tool grant consistently in progress output.
+- Render the Slack subagent dashboard as a response source rather than escaped mrkdwn.
+- Isolate Git test fixtures from an ambient `GIT_DIR`.
+
+### Tests
+
+- Add coverage for extension packages, extension Block Kit APIs, native Slack rendering, subagent profiles and progress, Session Dream rotation, and in-process Gondolin lifecycle behavior.
+
+## [1.0.0-beta.28]
+
+### Removed
+
+- Remove Gondolin remote-worker and fleet support. `sandbox.gondolin.remote`, `gondolin:remote`, and `--worker-token` are no longer supported; use the local `gondolin:default` sandbox instead.
+
+### Fixed
+
+- Preserve Slack mrkdwn links whose labels contain spaces when rendering Block Kit responses.
+- Reuse the existing Slack progress message when streaming the final response, preventing duplicate or partially completed bot messages.
+
+## [1.0.0-beta.27]
+
+### Added
+
+- Preserve concrete long-term memory before `/new` creates a fresh DM session, while keeping transient context and pre-reset platform history out of the new model context.
+
+### Changed
+
+- Serialize workspace-mutating tools and memory-maintenance runs so file updates, resets, and incoming messages have deterministic ordering.
+- Align extension context and message hooks with the active agent lifecycle, including per-run system prompt rewrites that preserve dynamically rebuilt memory, skills, and sandbox context.
+
+### Fixed
+
+- Keep extension-rewritten messages consistent across tool execution, persistence, provider context, and lifecycle events.
+- Account for compaction model usage in run budgets and reject corrupted session trees instead of silently accepting broken history.
+- Wait for active runs before resetting sessions, and prevent old runs from writing after `/new`.
+- Keep long Slack continuations in their thread and preserve mrkdwn links when rendering Block Kit text.
+
+### Tests
+
+- Add real Slack coverage for memory-preserving `/pi-new`, long threaded responses, and Block Kit markdown links.
+- Add regression coverage for harness message identity, dynamic prompts, compaction budgets, session integrity, runtime settlement, and mutation-tool ordering.
+
+## [1.0.0-beta.26]
+
+### Fixed
+
+- Make the subagent tool schema compatible with OpenAI by exposing an object at the function parameter root.
+
+### Tests
+
+- Add regression coverage for OpenAI-compatible subagent function schemas.
+
+## [1.0.0-beta.25]
+
+### Changed
+
+- Temporarily remove the Agent Sandbox runtime, SDK, Kubernetes client, Helm deployment, runtime images, and related release workflow from the npm release.
+- Restore the Gondolin, Gondolin remote-worker, and Firecracker sandbox implementations while Agent Sandbox packaging is redesigned separately.
+
+### Fixed
+
+- Restore global npm installation and CLI startup after the broken Agent Sandbox dependencies in `1.0.0-beta.23` and `1.0.0-beta.24`.
+
+### Tests
+
+- Add a real `npm install -g --prefix` smoke test for the packed tarball, enforce a 2 MiB size ceiling, and gate CI and npm publishing on the result.
+
+## [1.0.0-beta.24]
+
+### Fixed
+
+- Bundle the vendored Agent Sandbox SDK in the npm package so global installs no longer fail on a missing repository-local tarball.
+- Reuse mikan's direct Kubernetes client dependency as an SDK peer instead of recursively bundling a duplicate dependency tree, keeping the published tarball under 1 MiB.
+
+### Tests
+
+- Add a pack-install smoke test that imports the bundled SDK, runs the packed CLI, enforces a 2 MiB size ceiling, and gates both CI and npm publishing.
+
+## [1.0.0-beta.23]
+
+### Added
+
+- Add Kubernetes Agent Sandbox execution with mandatory `kata-qemu` isolation, a pinned TypeScript client, managed idle cleanup, and shared workspace support.
+- Add a Helm chart with GKE Standard, Linux k3s, Colima, and router-only profiles; GKE supports Filestore CSI on an explicitly configured VPC.
+- Publish mikan, the Agent Sandbox runtime, and the pinned router source build to GHCR through a release-aware image workflow.
+- Expose detailed subagent input, output, cache, reasoning, and cost usage while retaining the existing summary aliases.
+
+### Changed
+
+- Replace Gondolin and Firecracker sandbox modes with `agent-sandbox:<warm-pool>`.
+- Make Helm the supported Kubernetes deployment interface; the default and Colima profiles use host execution, while GKE and k3s profiles require Kata and RWX storage.
+- Include delegated subagent usage in parent run statistics and budget accounting.
+
+### Removed
+
+- Remove the standalone `mikan-worker`, remote worker fleet, dial-home gateway, Gondolin runtime, Firecracker executor, worker CI, and worker release binaries. Existing Gondolin deployments must move to the Agent Sandbox Helm deployment; no automatic deployment or state migration is provided.
+
+### Security
+
+- Require Kata rather than silently falling back to runc, restrict the optional router to the configured mikan namespace with a NetworkPolicy, and keep generated PVCs by default on Helm uninstall.
+- Update transitive `js-yaml` to 4.3.0 to address the merge-key chain denial-of-service advisory.
+
+### Tests
+
+- Add Agent Sandbox unit coverage, Helm profile assertions, pinned router image builds, and full GKE validation covering Kata, Filestore RWX, browser recording, aborts, recovery, Slack, and LLM tool execution.
+- Add coverage for detailed subagent usage, compatibility aliases, failure paths, extension results, and parent budget accounting.
+
+## [1.0.0-beta.22]
+
+### Added
+
+- Let subagents opt into a normalized reference snapshot of the active parent conversation with `parentContext`, while keeping fresh isolated context as the default.
+
+### Changed
+
+- Raise default subagent limits from 8 to 100 turns, $0.50 to $10, and 2 to 10 minutes; return concrete budget or timeout reasons.
+- Apply the process-wide subagent concurrency ceiling to both tool- and extension-initiated runs, with cancellation while queued and usage attribution only to the active parent run.
+- Use collision-safe hashed keys for credential authorization and runtime resources. Exact legacy host and shared-container credentials remain readable, but users of ambiguous legacy managed-sandbox keys may need to run `/login` again.
+- Reject unsupported vault file mounts and mounts that overlap workspace or other credential targets.
+- Extract workspace projection and session lifecycle responsibilities into focused modules without intended runtime behavior changes.
+
+### Fixed
+
+- Reject session keys belonging to another conversation and unsafe conversation or thread identifiers.
+- Prevent session pointers and thread files from escaping their owning directory or resolving through symlinks.
+- Process Slack messages posted by known human users through user tokens even when Slack includes the posting app's `bot_id`; bot-authored messages remain ignored.
+- Clearly report subagent budget exhaustion instead of returning a generic incomplete status.
+
+### Tests
+
+- Add Slack E2E coverage for DMs, idle stop, thread isolation, busy queues, images, and multi-file uploads.
+- Add unit coverage for session identity and path safety, collision-safe sandbox identities, vault mount policy, session lifecycle, normalized subagent context, shared slots, cancellation, and budget reporting.
+
+## [1.0.0-beta.21]
+
+### Added
+
+- Fold each subagent's tokens and cost into the parent run's tally (`MikanAgentSession.recordExternalUsage`), so delegated spend counts against the parent run's budget instead of staying invisible to it.
+- Add a process-wide subagent fan-out ceiling shared across conversations.
+- Add `mikan --help` and a generated `mikan env` inventory from the daemon environment manifest.
+- Make the working-directory argument optional, defaulting to `<state-dir>/workspace`.
+- Add a public Gondolin runtime bootstrap seam for embedders.
+
+### Changed
+
+- Subagent runs never reject: request validation failures (unknown tools, invalid budgets, empty tasks, nested runs) now resolve to `failed` results, so one bad request in a `tasks`/`dag` batch can no longer orphan in-flight sibling subagents.
+- Cap parallel `tasks[]` batches at 4 concurrent subagents (the same limit as DAG mode) and run DAG waves through a slot pool instead of chunk barriers.
+- Report a subagent final response with no text as `failed` instead of `completed` with empty output.
+- Enforce parent budgets immediately when subagent usage is folded into the parent run.
+- Apply one state-directory precedence rule across boot, extensions, Sentry, and runtime readers.
+- Refuse model and sandbox settings updates while a conversation is busy, and invalidate affected cached runners consistently.
+- Drive PM2 environment configuration from `~/.mikan/mikan.env` instead of inline secrets.
+
+### Fixed
+
+- Harden Gondolin dial-home reconnects after transport failures and stale sessions.
+- Reject invalid one-shot event timestamps consistently across all event writers.
+- Apply global model settings to idle conversations and report busy conversations as stale.
+
+### Security
+
+- Keep PM2 secrets in an owner-only file outside repository trees and make the PM2 template supervision-only.
+
+### Tests
+
+- Add coverage for subagent accounting and concurrency, CLI and environment manifests, settings mutation, Gondolin reconnects and contracts, event formatting, and worker state layout.
+
+## [1.0.0-beta.20]
+
+### Fixed
+
+- Validate subagent `outputSchema` correctly when it arrives as plain JSON Schema (the only form tool calls can carry), instead of throwing `ValueCheckUnknownTypeError` because it lacks TypeBox's `Kind` metadata.
+
+### Tests
+
+- Add coverage for plain JSON Schema hydration, nested objects, arrays, unions, and validation failures.
+
+## [1.0.0-beta.19]
+
+### Added
+
+- Add fresh in-memory subagents for the main agent and extensions, with explicit tools, budgets, structured output, parallel batches, and bounded DAG orchestration.
+- Stream debounced subagent node progress through the shared Slack, Discord, and Telegram response lifecycle.
+
+### Changed
+
+- Let final responses at the LLM-call cap complete without tripping the run budget when no continuation is required.
+
+### Fixed
+
+- Install worker binaries from the newest GitHub release that contains a matching asset, including prereleases.
+- Restore generic Google Workspace CLI credential mounts in sandbox vaults.
+
+### Tests
+
+- Add coverage for subagent isolation, recursion guards, budgets, structured output, parallel execution, DAG validation and dependency flow, and platform-neutral progress rendering.
+
+## [1.0.0-beta.18]
+
+### Added
+
+- Add an idempotent Debian and Ubuntu worker-host initialization script.
+- Add persistent `mikan-worker` installation as a delegated systemd service.
+- Add NFS export detection with OS-specific setup guidance for `gondolin:remote` workspaces.
+- Ship host-side vault credential files securely to remote workers without placing them in the shared workspace.
+- Add bounded shared-workspace health probes and worker degradation reporting.
+
+### Changed
+
+- Require each Gondolin remote gateway and static worker to declare its shared `workspaceRoot`.
+- Exclude workers with unhealthy shared workspaces from new placements and restore them after a healthy heartbeat.
+
+### Fixed
+
+- Fail remote execution with actionable diagnostics instead of hanging on dead shared-workspace mounts.
+- Create runtime cgroups beneath the worker's delegated cgroup and report missing `Delegate=yes` configuration.
+- Verify downloaded worker binaries against the matching release checksum filename.
+- Validate `gondolin:remote` only after gateway and worker transports are configured.
+
+### Security
+
+- Materialize remote credential files as owner-only, read-only runtime files outside shared workspaces.
+
+### Tests
+
+- Add coverage for worker host services, cgroup delegation, workspace health, credential delivery, NFS advice, remote validation, and idle execution deadlines.
+
+## [1.0.0-beta.17]
+
+### Added
+
+- Add `gondolin:remote` for scheduling sandbox runtimes across a fleet of Linux/KVM workers.
+- Add a standalone `mikan-worker` daemon with mutual TLS, fenced leases, crash recovery, capacity-aware placement, draining, and sticky conversation assignment.
+- Add dial-home worker enrollment through one-time join tokens and a mikan-hosted gateway.
+- Add private workspace projection, vault injection, resource limits, lifecycle reconciliation, and drift recovery to Gondolin runtimes.
+- Add worker installation, enrollment, operations, and remote quickstart documentation with a one-command end-to-end smoke test.
+- Publish `mikan-worker` binaries and checksums with GitHub releases.
+
+### Changed
+
+- Rename the preview sandbox mode from `microvm:default` to `gondolin:default` and the image build command to `npm run gondolin:image:build`.
+
+### Fixed
+
+- Project mounted files correctly into Gondolin guests.
+- Refresh rotated credentials when Gondolin runtimes are recreated.
+
+### Security
+
+- Authenticate remote workers with mutual TLS and fence stale workers through expiring leases.
+- Keep enrollment tokens one-time and store worker credentials privately.
+
+### Tests
+
+- Add coverage for Gondolin lifecycle, workspace isolation, vaults, resource controls, fleet scheduling, gateways, enrollment, workers, leases, and remote execution.
+
+## [1.0.0-beta.16]
+
+### Added
+
+- Add a preview `gondolin:default` sandbox backed by Gondolin and QEMU.
+- Add a curated microVM guest image build with Node.js, Python, uv, Git, ripgrep, fd, jq, SSH, and build tools.
+- Manage one process-local microVM per conversation with idle shutdown and recreation on demand.
+
+### Changed
+
+- Broaden the coverage gate across all source modules.
+
+### Fixed
+
+- Keep top-level Slack file uploads out of threads.
+
+### Tests
+
+- Add coverage for microVM execution and lifecycle, events, logging, disabled vaults, channel storage, and core file and shell tools.
+
+## [1.0.0-beta.15]
+
+### Added
+
+- Add native image generation with automatic upload through the active model provider.
+- Add extension chat commands via `api.registerCommand`: deterministic `/name` dispatch with no model call; built-ins and first registrations win.
+- Add an extension disposal lifecycle (`api.onDispose` or an `activate` return value), run when a harness instance is discarded (`/pi-new`, idle eviction, session rotation).
+- Add `api.triggerRun(text)` to fire an immediate autonomous agent run, `api.uploadFile(path, title)` for proactive file uploads, and an explicit `conversationId` option on `api.notify` for cross-conversation posting.
+- Add `agent_error` and `budget_exceeded` extension hooks so monitoring extensions see failed turns and tripped run budgets.
+- Pass a `RunOrigin` (platform, triggering message id, user identity, attachments) to extension hook events, making `api.react` and per-user extension policy usable.
+- Let `before_agent_start` extensions rewrite the user prompt or block the turn before the model runs; blocked turns leave no trace in the transcript or session store.
+- Let `tool_result` extensions rewrite tool output (content and error flag) before the model and the session store see it, enabling secret redaction and output truncation.
+
+### Changed
+
+- Dispatch `before_agent_start` and `tool_result` hooks with chaining semantics (each handler sees earlier handlers' rewrites; any `block` wins) instead of first-result-wins.
+
+### Fixed
+
+- Dispose cached runners when models switch or environment credentials refresh.
+
+### Tests
+
+- Add coverage for image generation, extension lifecycle and hook rewrites, and runner disposal.
+
+## [1.0.0-beta.14]
+
+### Added
+
+- Add GitHub inline review-thread intake and a `github_review_reply` tool.
+- Add `github_sync`, `github_read`, and `github_issue` tools for repository refresh and issue or pull request operations.
+- Add host-side Cloud Build log retrieval using GCP ADC or Workload Identity Federation.
+- Add a minimal embedder example that runs without portal services.
+
+### Changed
+
+- Update eligible GitHub pull request head branches in place instead of opening duplicate pull requests.
+- Drive platform command registration and routing from a shared command manifest.
+- Use one cross-platform stop grammar, including `/stop` in GitHub conversations.
+- Route sandbox file reads and writes through executors with staged, shell-safe transport.
+- Keep sandbox settings nested through configuration resolution and updates.
+
+### Fixed
+
+- Preserve raw session keys when using Slack's Force Stop button.
+- Spill large bash output into the runtime workspace so sandboxed agents can read it.
+- Keep malformed event files visible in the admin portal for deletion.
+- Unify platform formatting guidance across adapter and conversation contexts.
+
+### Security
+
+- Keep Cloud Build credentials host-side and outside agent sandboxes.
+- Centralize runtime identity and sandbox path sanitization.
+
+### Tests
+
+- Add coverage for GitHub tool operations, review threads, Cloud Build logs, executor file transport, command manifests, runtime embedding, and session serialization.
+
+## [1.0.0-beta.13]
+
+### Added
+
+- Add the `max` thinking level to commands, configuration, and the admin portal.
+- Add quickstart and extension development guides across all supported locales.
+
+### Changed
+
+- Update pi agent dependencies to 0.80.6.
+- Load platform-specific tool packs only for their configured adapters.
+- Improve `github_checks` output and guidance for external CI providers.
+- Synchronize configuration, platform, sandbox, session, skill, event, portal, and deployment documentation across locales.
+
+### Fixed
+
+- Fix broken CLI tables and dead documentation links across locales.
+
+### Security
+
+- Derive ambient shared-vault access from each platform's declared trust model and sandbox topology.
+
+### Tests
+
+- Add coverage for platform tool-pack isolation, external CI checks, and vault trust policy.
+
+## [1.0.0-beta.12]
+
+### Added
+
+- Let `github_checks` fetch the log tail for a failing GitHub Actions job by job ID.
+
+### Changed
+
+- Require GitHub App Actions read permission for job log inspection.
+
+### Fixed
+
+- Treat skipped and neutral GitHub checks separately from failures in check summaries.
+
+### Tests
+
+- Add coverage for job log retrieval and check conclusion classification.
+- Use collision-resistant temporary directories across parallel tests.
+
+## [1.0.0-beta.11]
+
+### Added
+
+- Add a read-only `github_checks` tool for inspecting branch and pull request check runs.
+
+### Changed
+
+- Make `github_pr` idempotent so pushing an existing branch updates its open pull request.
+- Teach the GitHub agent workflow to inspect CI, fix failures, and push updates.
+- Require GitHub App Checks read permission for CI inspection.
+
+### Tests
+
+- Add coverage for GitHub check summaries and existing pull request updates.
+
+## [1.0.0-beta.10]
+
+### Fixed
+
+- Retry cloning a GitHub repository on later triggers when the conversation clone is missing.
+
+### Security
+
+- Stop applying the ambient default shared vault to GitHub conversations while preserving explicit conversation vault grants.
+- Document the platform, shared machine, and personal credential trust boundaries.
+
+### Tests
+
+- Add coverage for GitHub clone retries and platform-gated default vault resolution.
+
+## [1.0.0-beta.9]
+
+### Added
+
+- Clone GitHub repositories into conversation workspaces and check out pull request heads.
+- Add a `github_pr` tool that pushes agent changes from `pi/*` branches and opens pull requests.
+
+### Changed
+
+- Require GitHub App Contents read and write permission for repository automation.
+- Post completed GitHub responses as single comments instead of streaming edits.
+
+### Fixed
+
+- Keep GitHub issue context inside the history recency window.
+
+### Security
+
+- Require commenters to have repository write permission or higher before triggering the agent.
+- Keep installation tokens out of sandboxes and restrict agent pushes to non-force `pi/*` branches.
+
+### Tests
+
+- Add coverage for GitHub repository checkout, permission gating, pull request creation, and branch restrictions.
+
+## [1.0.0-beta.8]
+
+### Added
+
+- Add a GitHub messaging adapter where each issue or pull request is an independent conversation.
+- Add GitHub App authentication, mention and participation triggers, persisted polling cursors, and downtime replay.
+- Add GitHub adapter deployment configuration and documentation.
+
+### Tests
+
+- Add coverage for GitHub polling, authentication, conversation context, triggers, and responses.
+
+## [1.0.0-beta.7]
+
+### Added
+
+- Add TypeScript and npm-package extensions with `package.json` entrypoints and runtime dependencies.
+- Add `mikan ext install`, `validate`, `list`, and `remove` commands.
+- Add extension installation from Git sources and repository subpaths.
+
+### Changed
+
+- Treat reinstalling an extension as an update while preserving its data directory.
+- Use `package.json` as the primary extension metadata source with `manifest.json` as a fallback.
+- Convert the agent project manager example to TypeScript with a typed extension API.
+- Add the Slack `reactions:write` scope and missing slash commands to the manifests and setup guides.
+
+### Tests
+
+- Add coverage for TypeScript loading, package metadata, extension CLI operations, and Git installation.
+
 ## [1.0.0-beta.6]
 
 ### Added