@hybridaione/hybridclaw 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -2,6 +2,190 @@
 
 ## Unreleased
 
+## [0.16.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.16.0) - 2026-05-07
+
+### Added
+
+- **macOS desktop wrapper**: Source builds can run `npm run desktop` for a
+  native Electron shell around the existing `/chat` experience, with menu
+  access to `/admin`, automatic local-gateway startup, packaged runtime
+  preparation, and DMG build scripts.
+- **Browser provider substrate**: Browser automation can run through a local
+  persistent Playwright profile or Browser Use Cloud CDP sessions. Browser Use
+  Cloud reads `BROWSER_USE_API_KEY` from the encrypted secret store, records
+  usage/audit events, rejects unsafe local profile hints, and reports setup
+  problems through `hybridclaw doctor browser-use`.
+- **Cloudflare Tunnel provider**: Local gateways can use
+  `deployment.tunnel.provider=cloudflare` with `CLOUDFLARE_TUNNEL_TOKEN` or
+  certificate credentials from encrypted runtime secrets, plus a dedicated
+  setup guide and admin tunnel status.
+- **A2A outbound delivery**: Agent-to-agent envelopes can be delivered through
+  JSON-RPC Agent Card peers or signed webhook peers with an outbox processor,
+  retry/backoff, audit events, secret-backed bearer tokens, and operator
+  escalation when delivery cannot continue safely.
+- **A2A webhook inbound endpoint**: Gateways accept signed envelopes from
+  trusted non-A2A peers at `POST /a2a/webhook/:peerId` with HMAC-SHA256
+  verification, replay-window enforcement, per-peer SecretRef-backed shared
+  secrets, sender/recipient validation against local agents, configurable
+  per-peer rate limiting (default 60/min → 429), and structured audit events
+  for every inbound POST.
+- **Monthly invoice harvester skill**: The bundled
+  `download-platform-invoices` skill collects official SaaS invoice PDFs and
+  normalized records across Stripe, Google Ads, AWS, Azure, GCP, browser-driven
+  SaaS portals, and DATEV Unternehmen Online handoff flows.
+- **Warehouse SQL skill**: The bundled `warehouse-sql` skill reviews and runs
+  read-only natural-language SQL against cached warehouse schemas, with a
+  deterministic SQLite eval fixture and optional connector-backed execution for
+  production warehouses.
+- **Google OAuth secret routes**: `hybridclaw secret route ...` and
+  `/secret route ...` can map URL prefixes to stored secrets or short-lived
+  Google OAuth access tokens for direct `http_request` calls such as Google Ads
+  API access.
+- **Interactive escalation handoff**: Runtime middleware can pause for
+  operator-facing escalation, collect resumable interaction context, and expose
+  browser controls for continuing or resolving pending approvals.
+- **AI-generated session titles**: `auxiliaryModels.session_title` can use an
+  auxiliary model to title recent sessions from the first user message while
+  preserving the local preview fallback when disabled.
+- **Canonical identity discovery**: User and agent identities now have shared
+  parsers, local instance-id allocation, and DNS-style TXT discovery records
+  that map canonical identities to peer URLs and public keys for federation.
+- **Per-agent liveness surface**: Gateway status now includes agent liveness
+  metadata for admin and health surfaces.
+- **Workflow definition schema**: YAML workflow definitions can declare
+  agent-owned steps, transitions, and `stakes_threshold` escalation hints with
+  validation coverage.
+- **Classifier middleware contract**: Agent middleware can classify, warn,
+  transform, block, or escalate pre-send and post-receive content, giving
+  plugins such as `brand-voice` and confidential leak checks a shared runtime
+  surface.
+- **Console skill ZIP overwrite control**: The admin Skills page can upload a
+  skill ZIP with an explicit `--force` overwrite option while preserving the
+  existing skill if the replacement copy fails.
+
+### Changed
+
+- **Approval policy rule pipeline**: Container approval evaluation now runs
+  through a hook-fed, policy-orderable rule pipeline, preserving the existing
+  trust-store layout while giving plugins pre/post tool-use visibility.
+- **Provider fallback chains**: `HYBRIDAI_FALLBACK_CHAIN` can route model calls
+  to alternate providers on auth and rate-limit failures, with primary-provider
+  cooldowns and streaming-safe retry gates.
+- **A2A retry classification is shared**: Outbound A2A delivery and transport
+  error handling use common retry classifications so transient failures,
+  permanent failures, and escalation paths stay consistent.
+- **Web chat sessions are easier to resume**: Recent-session history has clearer
+  titles/snippets, agent switching is more stable, and active-session routing is
+  less prone to stale agent state after UI changes.
+- **Browser tooling is stricter and more capable**: Browser tools share
+  navigation/profile guards, support reusable browser login state across host
+  and container runtimes, and handle download-heavy invoice flows more
+  predictably.
+- **TUI activity rendering is calmer**: Tool activity rows stack and de-dupe
+  more cleanly, repeated activity lines are suppressed, and `Esc` stops the
+  active run instead of leaving the session running in the background.
+- **Secret-bearing tool calls are narrower**: Gateway-side secret injection
+  resolves non-LLM credentials and Google OAuth tokens at request time instead
+  of exposing long-lived credentials to agent context.
+- **Provider discovery errors are clearer**: Shared discovery-error helpers and
+  normalized OpenRouter fallback hints keep model selection output less noisy.
+- **IMAP polling failures stay local**: Email transport timeouts are contained
+  to the IMAP connection path instead of leaking into broader gateway state.
+- **Release automation is stricter**: Release workflows validate promoted image
+  tags, pin newer checkout/setup actions, tolerate build-cache export failures,
+  and enforce the Node engine during npm installs.
+
+### Fixed
+
+- **Gateway transport timeout resilience**: Host/container transport timeouts no
+  longer bring down the gateway; affected runs fail locally while the gateway
+  stays available for subsequent work.
+- **Google Ads invoice harvesting**: Google Ads invoice discovery and PDF
+  downloads use the correct InvoiceService and GoogleAdsService paths,
+  including accessible-customer, manager-client, and billing-setup discovery.
+- **TUI stop behavior**: Pressing `Esc` reliably stops the in-flight TUI
+  session run.
+- **TUI tool activity duplication**: Repeated and stacked tool rows no longer
+  produce noisy duplicate output.
+- **OpenRouter fallback hints**: HybridAI-prefixed model hints are stripped
+  before OpenRouter fallback resolution.
+
+## [0.15.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.15.0) - 2026-04-29
+
+### Added
+
+- **Backup and restore CLI**: `hybridclaw backup` creates WAL-safe runtime-home
+  archives and `hybridclaw backup restore` validates manifests before
+  rehydrating `~/.hybridclaw` on a fresh or recovered host.
+- **Brand-voice output guard**: A repo-shipped `brand-voice` plugin can flag,
+  rewrite, or block off-brand final responses using configured voice rules,
+  banned phrases or patterns, required phrases, and optional classifier/rewriter
+  models. The bundled `brand-voice` skill helps agents draft within those rules
+  before the output guard fires.
+- **Production Salesforce skill**: The bundled Salesforce skill now ships a
+  fuller read-only helper, metadata/query references, eval scenarios, and
+  server-side secret placeholder handling for inspecting org schema and SOQL
+  records without writing credentials to disk.
+- **Tailscale Funnel tunnel provider and admin status**: Local deployments can
+  use `deployment.tunnel.provider=tailscale`, with `TS_AUTHKEY` resolved from
+  encrypted runtime secrets when needed and kept out of process arguments. The
+  admin console surfaces public URL and tunnel status alongside the existing
+  gateway controls.
+- **Web chat model switcher**: The chat composer can switch models from the
+  browser using discovered provider catalogs, provider icons, model capability
+  metadata, and the same active-session routing used by local slash commands.
+- **Agent org chart, team revisions, and chronological CVs**: Agent metadata
+  can model role, reporting, delegation, and peer relationships; admin agent
+  pages keep restorable team-structure revisions; observed skill history can
+  refresh per-agent CV output.
+- **Warm process pool**: Host and container runners can keep a bounded adaptive
+  pool of idle runtime processes for recently active agents, reducing cold-start
+  latency while respecting max-idle, startup-claim, config-change, and
+  memory-pressure limits.
+- **Trace judge and trace preparation**: Local eval workflows can prepare
+  redacted traces and dispatch them through an auxiliary judge model for skill,
+  leak, and output-quality evaluation foundations.
+- **Config value inspection**: `hybridclaw config get <key>` and `/config get
+  <key>` return one resolved runtime config value without dumping the full
+  config file.
+- **GPT-5.5 model support**: Static and Codex-discovered model catalogs include
+  `gpt-5.5`, `gpt-5.5-pro`, and `openai-codex/gpt-5.5`.
+
+### Changed
+
+- **Gateway health is less fragile**: Gateway status and health endpoints rely
+  on cached provider checks instead of blocking on live model-provider probes,
+  so transient provider failures no longer make the local gateway look down.
+- **Token usage recording is buffered**: Usage events are normalized,
+  size-capped, and batch-flushed asynchronously to reduce hot-path overhead
+  while preserving audit records.
+- **Runtime secrets are scrubbed more consistently**: Host/container agent
+  runtimes share sensitive environment filtering and web-search credential
+  injection so Brave, Perplexity, and Tavily keys are passed only through the
+  intended secret channels.
+- **Trajectory capture is stricter**: Stored skill trajectories run through
+  PII, secret, and confidential-info redaction, and retention can be capped
+  globally or per tenant.
+- **Docs are consolidated under `docs/content`**: The duplicate legacy
+  `docs/development` tree was removed after the content moved into the current
+  docs hierarchy.
+
+### Fixed
+
+- **Loopback API auth is no longer bypassed**: Local OpenAI-compatible API
+  requests require `WEB_API_TOKEN` or `GATEWAY_API_TOKEN`; loopback address
+  alone is not treated as authentication.
+- **Local TUI and gateway token handling is safer**: Generated gateway tokens
+  are persisted once with serialized creation, shared with local TUI/eval
+  clients, and no longer rewritten during later config reloads.
+- **Ngrok tunnel reconnects are quieter**: Reconnect errors are deduplicated by
+  normalized cause, audit run ids are correlated, and tunnel health checks stay
+  enabled by default.
+- **HybridAI-prefixed model names resolve cleanly**: Provider prefix handling
+  recognizes `hybridai/...` model ids without noisy warnings.
+- **Context ring popovers render correctly**: The web chat context usage ring
+  once again shows its detail popover.
+
 ## [0.14.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.14.0) - 2026-04-28
 
 ### Added

package/README.md

@@ -84,6 +84,18 @@ Open locally:
 
 Requirement: Node.js 22 (Docker recommended for sandbox)
 
+Desktop wrapper from source:
+
+```bash
+npm install
+npm run desktop
+```
+
+The Electron workspace opens the existing `/chat` surface in a native macOS
+window, exposes `/admin` from the app menu, reuses a running local gateway when
+available, and starts the bundled gateway automatically when it is not already
+listening on `http://127.0.0.1:9090`.
+
 Release notes live in [CHANGELOG.md](./CHANGELOG.md), and the browsable
 operator and maintainer manual lives at
 [hybridclaw.io/docs](https://www.hybridclaw.io/docs/).
@@ -96,7 +108,8 @@ Once the gateway is running, open HybridClaw locally:
 - Web Chat keeps a recent-session sidebar and can search conversation titles
   with contextual snippets before you reopen an older browser session
 - Web Chat shows live context-window usage, accepts `/context`, and lets you
-  switch the active agent from the composer
+  switch the active agent and model from the composer; active agent switching is
+  preserved across session reloads and UI route changes
 - Web Chat accepts `/btw <question>` side questions while a primary run is
   active, so you can ask an ephemeral follow-up without interrupting the
   current run
@@ -113,6 +126,9 @@ Once the gateway is running, open HybridClaw locally:
 - `hybridclaw gateway status` reports sandbox/runtime details, and in
   container mode it includes the configured image name plus the resolved
   version and short image id.
+- `hybridclaw backup` creates a WAL-safe archive of the runtime home, and
+  `hybridclaw backup restore <archive.zip>` validates the archive before
+  replacing local runtime state.
 - `hybridclaw update --yes` upgrades a global npm install and auto-restarts a
   running local gateway with its original launch parameters when possible,
   falling back to `hybridclaw gateway restart` if not.
@@ -130,20 +146,31 @@ Once the gateway is running, open HybridClaw locally:
   Signal QR linking, Twilio voice settings, and per-channel instructions that
   are injected into prompts at runtime.
 - `/admin/approvals` manages approval policies from the browser.
+- Approval policy evaluation runs through a hook-fed rule pipeline, so
+  workspace policy ordering and plugin tool-use hooks share one approval path.
 - `/admin/gateway` reloads runtime config and refreshes secrets from the
-  browser without tearing down the enclosing workspace container; keep
-  `hybridclaw gateway restart` for local/manual full restarts.
+  browser, and shows public URL plus tunnel status, without tearing down the
+  enclosing workspace container; keep `hybridclaw gateway restart` for
+  local/manual full restarts.
 - `/context` and the web chat context ring show current context-window usage,
   remaining headroom, and compaction counts for the active session.
 - `proactive.delegation.model` can pin delegated work to a different model
   from the parent turn; `/status` shows delegate token totals and local-token
   share when that split is configured.
-- `deployment.mode`, `deployment.public_url`, and `deployment.tunnel.provider`
-  describe local/cloud exposure. The built-in ngrok tunnel provider reads
-  `NGROK_AUTHTOKEN` from the encrypted runtime secret store.
+- `deployment.mode`, `deployment.public_url`, `deployment.tunnel.provider`, and
+  `deployment.tunnel.health_check_interval_ms` describe local/cloud exposure
+  and tunnel health cadence. The built-in ngrok, Tailscale Funnel, and
+  Cloudflare Tunnel providers read `NGROK_AUTHTOKEN`, `TS_AUTHKEY`,
+  `CLOUDFLARE_TUNNEL_TOKEN`, and Cloudflare certificate credentials from the
+  encrypted runtime secret store.
+- `container.warmPool` keeps a bounded adaptive pool of idle host/container
+  runtimes for recently active agents when low cold-start latency matters.
 - `container.persistBashState` controls whether bash tool calls share shell
   state (`cd`, exported env vars, aliases) across turns in the same active
   runtime session; `/admin/config` exposes the same setting as `Persistent bash state`.
+- `security.confidentialRedactionEnabled` controls whether optional
+  `.confidential.yml` rules redact prompts and block matching outbound text;
+  `/admin/config` exposes the same setting as `Confidential leak guard`.
 - `hybridclaw audit scan-leaks` scans historical audit logs against optional
   `.confidential.yml` rules for NDA-class client, project, person, keyword,
   and regex matches.
@@ -151,9 +178,12 @@ Once the gateway is running, open HybridClaw locally:
   exposes a custom workspace display root such as `/app`.
 - `hybridclaw tui` includes live delegate progress, pulsing tool rows,
   completion checkmarks, a keyboard-driven approval picker, and a ready-to-run
-  `hybridclaw tui --resume <sessionId>` command on exit.
+  `hybridclaw tui --resume <sessionId>` command on exit. Pressing `Esc` stops
+  the active run and returns control to the prompt.
 - `hybridclaw doctor` checks runtime health including resource hygiene
-  maintenance for stale gateway artifacts.
+  maintenance for stale gateway artifacts. `hybridclaw doctor browser-use`
+  checks the local browser automation substrate and can install missing
+  Playwright Chromium support with `--fix`.
 - `hybridclaw onboarding` and related local setup flows can restore the last
   known-good saved config snapshot or roll back to a tracked revision when
   `config.json` becomes invalid.
@@ -193,14 +223,28 @@ Once the gateway is running, open HybridClaw locally:
 - Google OAuth credentials for Workspace skills live in the encrypted runtime
   secret store; agent runtimes receive short-lived access tokens for `gog` and
   `gws` instead of long-lived refresh tokens.
+- Canonical user and agent identities use stable lowercase IDs and DNS-style
+  discovery records so A2A peers can resolve remote URLs and public keys.
+- `hybridclaw secret route ...` and `/secret route ...` can attach stored
+  secrets or Google OAuth access tokens to matching `http_request` URL
+  prefixes, including Google Ads API calls.
+- `HYBRIDAI_FALLBACK_CHAIN` can route auth and rate-limit provider failures to
+  alternate models/providers with cooldowns before retrying the primary.
 - Skills can be enabled or disabled globally or per channel from
   `hybridclaw skill enable|disable`, TUI `/skill config`, or the admin
   `Skills` page.
 - Packaged skills can declare versioned manifests, capabilities, required
   credentials, supported channels, and per-agent autonomy policy.
 - Bundled skills include API-backed Google Workspace workflows (`gog`, `gws`),
-  GitHub issue queue processing (`gh-issues`), and editable Excalidraw diagram
-  creation.
+  Salesforce inspection, GitHub issue queue processing (`gh-issues`),
+  monthly SaaS invoice harvesting (`download-platform-invoices`),
+  natural-language warehouse SQL (`warehouse-sql`), brand-voice drafting, and
+  editable Excalidraw diagram creation.
+- Browser automation can use local persistent Playwright profiles or Browser
+  Use Cloud sessions with encrypted `BROWSER_USE_API_KEY` storage, usage
+  metering, and shared navigation guards.
+- The repo-shipped `brand-voice` plugin can flag, rewrite, or block final
+  responses that violate configured voice rules before they reach users.
 - Built-in office skills handle longer PDF creation flows cleanly: the bundled
   PDF creator wraps long lines, honors explicit `\n`, and adds pages
   automatically when reports or invoices spill past the first page.

package/config.example.json

@@ -1,16 +1,18 @@
 {
-  "version": 23,
+  "version": 26,
   "security": {
     "trustModelAccepted": false,
     "trustModelAcceptedAt": "",
     "trustModelVersion": "",
-    "trustModelAcceptedBy": ""
+    "trustModelAcceptedBy": "",
+    "confidentialRedactionEnabled": false
   },
   "deployment": {
     "mode": "local",
     "public_url": "",
     "tunnel": {
-      "provider": "manual"
+      "provider": "manual",
+      "health_check_interval_ms": 30000
     }
   },
   "skills": {
@@ -383,6 +385,11 @@
       "model": "",
       "maxTokens": 0
     },
+    "eval_judge": {
+      "provider": "auto",
+      "model": "",
+      "maxTokens": 0
+    },
     "mcp": {
       "provider": "auto",
       "model": "",
@@ -392,6 +399,11 @@
       "provider": "auto",
       "model": "",
       "maxTokens": 0
+    },
+    "session_title": {
+      "provider": "auto",
+      "model": "",
+      "maxTokens": 0
     }
   },
   "container": {
@@ -406,7 +418,15 @@
     "additionalMounts": "",
     "maxOutputBytes": 10485760,
     "maxConcurrent": 5,
-    "persistBashState": true
+    "persistBashState": true,
+    "warmPool": {
+      "enabled": true,
+      "coldStartBudgetMs": 200,
+      "trafficWindowMs": 3600000,
+      "minIdlePerActiveAgent": 1,
+      "maxIdlePerAgent": 2,
+      "memoryPressureRssMb": 2048
+    }
   },
   "mcpServers": {
     "filesystem": {