Changelog

Newest first. Dates reflect the release tag.

v2.2.6 — 2026-09-12

Highlights

Google Antigravity CLI provider — Native runtime support for the agy CLI with auto-detection, stream-json pipeline, live transcript streaming, conversation resumption via --conversation <id>, and next-turn steering, hardened by runtime sandbox isolation and step-boundary streaming aggregation (#874, #894, #896).
Interactive decision widgets for tickets — Single-select, multi-select, and confirm-action widgets in ticket comments and timelines with optimistic concurrency locks, audit log, workspace feature flag, the mopheus-ticket-widgets builtin skill, and a slim-prompt micro-spec (#860, #907).
Workspace-scoped user profiles — Environment variables and configuration files are isolated per workspace with encrypted values, server-owned templates, binary previews, and the mopheus user env / mopheus user config-file CLI surface (#901, #885).
Filesystem sandbox enabled by default — The daemon now activates the filesystem sandbox unless explicitly opted out via MOPHEUS_DAEMON_SANDBOX=false|0|off; the new policy survives restarts and is covered by regression tests (#906, #843).
Quartz schedule triggers for jobs — Add cron_dialect=quartz triggers with ? day-of-month/day-of-week semantics, optional startAt/expiresAt boundaries, an interactive schedule editor with future-run previews, and dialect-aware CLI help (#884).
Credential and auth redaction — Agent output redacts embedded credentials, auth environment values are masked before logging, and the integration audit table no longer leaks sensitive labels (security hardening series).
Channel async outbound delivery and scope enforcement — Channels ship messages asynchronously through a centralized lifecycle flow, drop non-retryable media gates, and enforce agent execution scope (#911, channel refactors).
Retained worktree registry — mopheus repo worktree list|prune reconciles bare-repo sidecar metadata, supports per-workspace and per-ticket selectors, and safely reuses or evicts worktrees with dirty/unpushed detection (#905).
Comment trigger previews and label-driven UX — Tickets expose live comment trigger previews, render the ticket creator and creation timestamp below the title, and standardize the My Tickets filter on a shared canonical constant set (#909, #923, #921).
Structured inbox cards for automated runs — Automated job-run and agent-task failure notifications now ship structured cards with quick actions and a direct transcript link (#868, #840).

Added

Antigravity CLI provider with stream-json pipeline, transcript streaming, conversation resumption, and agy brand logo in the provider picker (#874).
Interactive decision widgets with optimistic state, audit log, React components, multilingual localization, and a mopheus-ticket-widgets builtin skill (#860).
Workspace-scoped user environment variables and configuration files with encrypted storage, server-owned templates, and binary read-only previews (#901).
Quartz schedule triggers, multi-select schedule editor, future-run preview API, and locale-aware humanized schedule text (#884).
Retained worktree registry CLI plus local daemon list/prune endpoints with workspace scope (#905).
Async outbound channel delivery with a centralized lifecycle outbound flow.
Comment trigger previews in ticket timelines (#909).
--label and --labels flags on mop ticket create and mop ticket update (#918).
mop chat channel list to inspect channel bindings and provider scoping.
mop feature list and mop feature check commands plus a read-only mop profile family (list, show) (#858 and follow-up).
mop daemon upgrade flow with manifest-driven atomic reinstall.
Workspace-scoped email configuration and dispatch delegation plus an attachment-limit summary in workspace settings.
Job run notification cards with structured details and a direct link to the originating run (#868).
Agent task failure notifications with a "view transcript" action and listing of failed runs in the inbox (#840).
Ticket creator display name and creation timestamp rendered below the title (#923).
Agent avatars in the web agent list.
Topic session-id copy button in chat.
Long chat message input on the CLI; agent chat routing for sessions with provider-aware selection.
Decision widget micro-spec inlined in the slim prompt and the mopheus-ticket-widgets skill reference (#907).
Sandbox mount plan fix and explicit daemon sandbox opt-out values (#843, #906).
Sandbox credential isolation, profile recovery isolation, and Antigravity runtime sandbox isolation (#894).
Subscription propagation for provider session IDs and persistence across restarts (#885).
My Tickets default-to-all-scope toggle and canonical filter constants (#921).
Scoped user shortcut commands, Pi provider RPC migration, and the Antigravity brand logo.
CLI job create --cron-dialect quartz with start-at and expires-at boundaries.
Chinese ChatOps integration guide for Mopheus Chat and Event Jobs in docs/blog.
Provider integration guide and Antigravity provider documentation in EN/ZH/JA.
Security boundaries guide in the project documentation.

Changed

Daemon defaults the filesystem sandbox to enabled; only an explicit environment opt-out disables it (#906).
Inbox notifications rearchitected around an orthogonal toolbar with unarchive and scoped batch actions; automated job-run and agent-task failures now ship structured cards with quick actions (#868, #840).
Channel outbound delivery is asynchronous with centralized key/reason registries; agent execution scope is enforced and non-retryable media gates are dropped (#911).
mop profiles and config files resolve a global baseline plus workspace overrides by path; templates come from the server instead of client-side hard-coding (#901).
Daemon worker tasks persist their state across restarts, defer Claude cache cleanup, and isolate sandbox credentials and profile recovery records.
Skill search uses a CJK-friendly multi-term builder; ticket list context menu and detail actions use a streamlined layout (#900).
Agent-builder wizard supports conversational AI agent creation with bundled prompt templates; workspace onboarding remains a 7-step flow with idempotent re-runs.
Provider session source and task history metadata now flow through the canonical session record for assistant-message dedup.
Workspace files hub preference for grid/table view is persisted across navigation.
Provider workspace state is isolated per agent so MCP usage tracking stays per-tenant.
Antigravity streaming text deltas aggregate at step boundaries to reduce overhead (#896).
Antigravity runtime preserves the native HOME under sandbox and recovers fresh sessions on stream interrupt.

Fixed

Agent output redacts embedded credentials; auth environment values are masked before logging (fix(security) series).
Integration audit table no longer leaks sensitive labels.
Channel media gates no longer block retryable deliveries and respect agent execution scope (#911).
Channel session source metadata is consistently recorded across the canonical session record.
Ticket discussion timeline supports quote replies and a unified activity history.
Mobile job dialog scrolls correctly inside the Mopheus shell.
Job assignees are isolated by workspace so cross-workspace triggers cannot fire.
Job cron expressions with empty cron fields now use Quartz-compatible wildcards so schedules never stall.
Comment IDs round-trip through widget choices so the floating submission bar preserves user state.
Failed agent task runs surface in the inbox with a transcript action instead of being hidden (#840).
Quick stop button is restored on the ticket execution run row.
Onboarding wizard no longer leaves the body with stuck pointer-events after skipping (#846).
Antigravity streaming interruptions preserve completed turns and recover with a fresh session.
Pi provider resumes sessions via RPC with capability checks (#887).
Antigravity runtime captures premature exits and preserves the native HOME under sandbox.
Workspace teardown cleanly removes worktree sidecars and CodeGraph snapshots.
Workspace sandbox settings survive background daemon restarts and explicit opt-out values (#906).
Sandbox credentials are isolated from the host; profile recovery records are isolated per workspace.

Security

Filesystem sandbox enabled by default for the daemon (#906).
Agent output redacts embedded credentials; auth environment values are masked in logs and audit tables (fix(security) series).
Sandbox credentials, profile recovery records, and Antigravity runtime state are isolated from the host.
Provider workspace state is partitioned per agent so cross-workspace data does not leak through provider caches.

Upgrade Notes

The daemon now enables the filesystem sandbox by default. Operators that previously disabled it via environment must explicitly set MOPHEUS_DAEMON_SANDBOX=false (or 0/off, case-insensitive) on the daemon process; otherwise sandboxing stays on and matches the new default.
Workspace-scoped user environment variables and configuration files require the schema bump introduced in this release. Pre-existing global profiles remain the baseline; new workspace overrides take effect after migration.
Quartz schedule triggers are opt-in per trigger. Existing Standard five-field triggers continue to use the legacy grammar; reverting a migration is refused while Quartz rows exist to keep persisted expressions readable.
Interactive decision widgets require the widget workspace feature flag; comments degrade to standard syntax-highlighted code blocks when the flag is disabled or unset.
Antigravity CLI is required at agy (or MOPHEUS_ANTIGRAVITY_PATH) to use the new provider; the CLI must be invokable with --input-format stream-json --output-format stream-json --dangerously-skip-permissions.

v2.2.5 — 2026-09-05

Highlights

Event-driven jobs with causal loop containment — Jobs subscribe to internal events (comment.created, ticket.created, …) with structured filters. A causal ancestor graph prevents recursive trigger loops, and event payloads now expose self-describing enum names, ticket context, and ticketPriority for accurate routing (#795, #805, #806, #811, #813, #814, #817, #808, #809).
Subagent lineage and lifecycle tracking — Subagent runs persist parent lineage, Claude subagents track lifecycle transitions, and the scheduler coordinates subagent final results. Provider workspace state is isolated per agent, and Codex MCP calls are recorded alongside Claude usage (#767, #803, #828, #830).
mop CLI skill and release sync workflow — A new mop CLI skill ships with the release sync workflow so agents scaffold PRs, sync release artifacts, and discover model enums without bespoke scripts; using-codegraph now mandates a worktree prerequisite and ships MCP-compatible guides (#616/#820, #746).
File attachment access control and isolation — Attachments enforce workspace-scoped CanView/CanEdit/CanDelete capabilities in queries and storage paths, with origin labels that include the parent ticket identifier and short ID (#730/#734, #731/#733).
Short ticket identifiers — Tickets expose a stable short ID alongside the UUID, mirrored across CLI, web, and mop outputs (#818).
Topic lifecycle management — A first-class topic lifecycle API lets workspaces archive, restore, and clean up topics with audit-friendly state transitions (#824).
User SSH config management — Members register SSH config files delivered into sandbox tasks via the runtime config file pipeline, with native OpenSSH composition (#740).
Skill invocations and synthesis — Every skill invocation is recorded for auditability, distilled memories can be synthesized into reusable skills, and a daily-usage rollup powers workspace analytics (#737, #754, #822).
Daemon telemetry, snapshots, and worker recovery — Daemons collect per-task resource telemetry, emit durable worker completion snapshots, and filter recovery by workspace so a restart never picks up a foreign runtime (#766, #776, #786).
Release artifacts on Huawei OBS — Release images and license notices publish to Huawei OBS, accelerating installs in mainland China regions.
Standardized workspace UI — Workspace list, header, integrations settings, brand icons, and confirmation dialogs follow a unified card container layout with inline page headers, batch actions, platform-sectioned integrations, and delete/archive dialogs with explicit consequence warnings (#741, #758, #761, #791).

Added

Internal event triggers with causal loop containment; runtime attaches causal ancestor context and grants event broadcasts (#795, #814).
Event payloads enriched with ticketId, shortId, workspaceSlug, ticketPriority, and self-describing enum *Name companions (#805, #806, #817).
Job triggers tab visualizes event filter rules; manual trigger disabled for event jobs (#808, #809).
Subagent lineage table, Claude subagent lifecycle tracking, subagent turn coordination, provider workspace state isolation, and Codex MCP call recording (#767, #803, #828, #830).
Immediate agent interaction steering (#788).
Short ticket identifier column, API, CLI, and mop integration (#818).
Topic lifecycle management endpoints and audit hooks (#824).
Attachment access control + visibility isolation; attachment origin display carries ticket ID and short ID (#730/#734, #731/#733).
Skill invocation tracking table, daily skill usage analytics, and memory-to-skill synthesis (#737, #754, #822).
mop CLI skill, mop_ticket helper scripts, model enum references, and release-sync workflow (#616/#820).
using-codegraph skill worktree prerequisite and MCP compatibility (#746).
User SSH config registration with cli_type-aware delivery (#740).
Daemon durable task resource telemetry plus /profile endpoint and worker completion snapshots (#776, #786).
End-to-end agent task duration in job execution history; redesigned layout with real-time sync (#735, #736).
Workspace card container, inline page headers, batch actions, platform-sectioned integrations settings, unified brand icons, and AlertDialog-based delete/archive flows (#741, #758, #761, #791).
runtime guard explain forensics CLI and extended runtime_guard_event columns.
Custom CLI upgrade manifest, forced upgrade metadata, and atomic CLI reinstall.
Unified CI build timestamps; nightly Beijing 06:00 build.
License invitation re-issue and seat reshuffle across workspaces.

Changed

Job actor carries ancestor job IDs and origin_user_id to prevent recursive triggers and keep audit trails accurate (#813).
Event broadcasts unified into a single workspace event hub; HTTP handlers fan out through one broadcaster.
Channel session source and task history metadata propagate through the canonical session record.
Skill search switched to a CJK-friendly multi-term builder with longer name columns.
Agent-builder wizard supports conversational AI agent creation with bundled prompt templates (#616).
Wizard onboarding remains a 7-step flow with bilingual demo seeds, "skip permanently" preference, and idempotent re-runs.
Inbox and ticket actions consume backend-stamped CanEdit/CanDelete viewer capabilities (#607).
Daemon scheduler coordinates subagent final results and preserves the final result after checks.
Job execution history refreshes from websocket events so external state stays consistent without polling.
Workspace files hub preference for grid/table view is persisted across navigation.
Provider session source and task history metadata participate in assistant-message dedup.
runtime guard explain output canonicalized to English with i18n dictionaries for the web UI.

Fixed

Codex usage split by model; Codex stdout usage reporting surfaces in dashboards.
Subagent message parent preserved; subthread messages filtered safely; subagent names propagated into agent-task titles.
Lark channel task replies restored after the new session record schema.
Webhook dedup conflict absorbed via ON CONFLICT DO UPDATE (#799/#800).
Merged comment count includes the trigger; empty merged comments hidden; merged comments collapse.
Browser auth uses cookies consistently; locale cookie and active language state stay in sync across hydration and settings (#727).
Transcript search and escape shortcuts no longer leak to the ticket page (#725).
ActorAvatar no longer renders UUID initials; ActorPicker carries the display name (#759).
Daemon recovery filters by workspace so unrelated runtimes do not surface (#766).
Scheduler preserves the final result after lifecycle checks, recovers preparation panics, parses lifecycle check responses, and preserves timeout after protocol close.
Install path: runtime environment probe runs at install time; online CLI preparation supported; Windows install path no longer leaks the temp env; offline Docker paths documented.
CLI upgrade reinstall is atomic and respects a custom upgrade manifest; forced upgrade metadata flows through.
WebSocket subscribers refresh on resource mutations (#712).
Refresh runtime resource counts and the daemon health port after a websocket reconnect.
Duplicate migrations are idempotent; make migrate-up after a partial apply no longer trips a duplicate-key error.
Dashboard surfaces failed task counts alongside successful ones; empty from/to date parameters render as all-time usage (#771).
Kimi stderr error codes preserved in provider session responses.
Daemon report batches preserved when the daemon response drops mid-upload.
Origin user context preserved across agent task dispatches (#691).
Ticket dependency target tickets load individually via useTicket; perspective grouping and terminology aligned.
Ticket backend ZIP export and comment resolution contracts deprecation notice surfaced in the web UI (#802).
Skill subcommand mop_ticket add-comment invokes the correct subcommand; trailing whitespace in skill scripts removed.
Trigger filters persist across reloads and guard unload.
Hardened task lifecycle and scope checks across the runtime.
Wizard onboarding skip-existing-agent migration applied so disabling onboarding cannot bypass the safety check.
Skip flaky TestCreateWorktree_CodeGraphProvisioningAndExclude when CodeGraph is not installed.
Restore ticket comment follow-up after the daemon-task scheduler deferral.
Order terminal report replay deterministically; preserve terminal completion result across restarts.

Security

Workspace events fan out through a single broadcaster that enforces origin_user_id and causal ancestor checks; jobs cannot subscribe to events outside their workspace scope.
origin_user_id recorded on every agent_task row even when initiated outside a workspace membership, so audit trails capture cross-scope actions.
Attachment access control enforces CanView/CanEdit/CanDelete in every query path; storage paths are workspace-scoped.
Webhook dedup uses an atomic upsert to prevent lost or duplicated audit records (#799/#800).

Upgrade Notes

Apply database migrations before starting the new server. Migrations 118+ cover the event trigger registry, causal ancestor IDs, ticket short identifiers, topic lifecycle, attachment access control, skill invocations, daily usage analytics, daemon worker snapshots, user SSH config metadata, and runtime_guard_event columns.
Review existing jobs subscribed to comment.created: the payload now includes ticketId, workspaceSlug, and ticketPriority — adjust trigger expressions accordingly.
Daemon upgrades should redeploy the latest mopheusd image; Linux daemons pick up the new durable task resource telemetry profile endpoint and worker completion snapshots on first heartbeat.
Release artifacts publish to Huawei OBS; installation tooling now expects the OBS-backed image tags. Update local install/env.example overrides accordingly.
Workspaces that customize attachment permissions should re-confirm CanView/CanEdit/CanDelete after migration; default capability checks now apply at the repo layer.
The mop CLI skill is enabled by default for new workspaces; existing workspaces can opt in from the skill store.
Daemon recovery now filters by workspace; ensure runtime registrations live in the expected workspace before restart.

v2.2.4 — 2026-08-29

Highlights

CodeGraph intelligence for coding agents — Coding agents on registered repositories ship with the using-codegraph skill, commit-bound sidecar SQLite snapshot caches, and incremental re-indexing during worktree provisioning (#675).
Workspace files hub — A new /[workspace]/files page consolidates every attachment across tickets, comments, and chat sessions with full-text search, category filters, grid/table views, and a universal previewer for images, PDFs, Markdown, source code, and CSV (#713).
Japanese localization — The full product UI ships with Japanese (ja) translations alongside English and Simplified Chinese, including the new files hub and agent-task controls (#706).
Runtime task resource guard and circuit breaker — Linux daemons collect per-task RSS, per-runtime totals, process counts, and full process-tree metrics via rootless cgroup v2 + procfs sampling. A 3-tier cascade merges guard thresholds; over-budget warnings ramp into kill. Every kill/warning streams structured diagnostics to the control plane, persisted in runtime_guard_event (#694, #702, #710).
Direct ticket-level Grill Me review — Trigger a 10-round self-reflective review against a ticket's title and description from the ticket header or actions menu — no comment needed (#624, #642, #620).
Personal runtime configuration files — Each user can register custom configuration files (e.g. ~/.mopheus/*.toml) which are delivered into sandbox tasks with CLI-type aware attachment, managed Ed25519/RSA SSH keys, and user-first native OpenSSH composition (#685).
Non-root daemon container (UID 10001) — mopheusd runs as the mopheus user inside the container with the matching host UID, enabling rootless cgroup v2 hierarchies (#633).
User account status controls — Workspace admins can enable or disable individual accounts; disabled users are blocked from authentication and excluded from license quota counting (#705).
Batch ticket operations — A new ticket action bar lets operators archive, assign, re-prioritize, or move many tickets at once, mirrored in mopheus ticket CLI subcommands (#653).
Backend ZIP export of ticket run data — Tickets expose a backend ZIP export of all comment threads, agent task runs, and intermediate artifacts for offline review (#667).

Added

CodeGraph sidecar snapshot cache at .codegraph-cache/<sha>.db with automatic incremental codegraph sync during worktree creation (#675).
mopheus attachment list CLI and useFilesViewStore view-mode persistence (#713).
user_config_file table and settings UI for personal sandbox runtime configuration files, managed SSH keys, and user-first OpenSSH composition, with cli_type-aware delivery.
runtime_guard_event audit table with full forensics plus mopheus runtime guard events|explain CLI (#710).
usage_agent_task_report durable receipts and usage snapshot dedupe so daemon usage reports are safe to retry.
agent_task_interaction table and broadcaster for websocket comment sync (#623).
is_griller capability on agents for Griller specialization (#620).
Tickets updates-time sorting and start-date sorting.
user.enabled column with admin enable/disable controls (#705).
Workspace-scoped user env vars at profile scope (#669).
Interactive daemon task scheduler with batch claim across runtimes (#674).
Memory hit-count with BIGINT saturation clamp (#688).
Attachment pg_bigm GIN index with CJK multi-term search.
Bulk archive/restore/delete in the inbox with explicit "delete all" confirmation (#662).
CLI --action-type flag for mopheus job update and mop install-time shortcut alias.
Mopheus and CodeGraph OSS license notices packaged into release artifacts (#676).

Changed

License invitation flow supports re-issue and seat reshuffle across workspaces.
Inbox and ticket actions consume backend-stamped CanEdit/CanDelete viewer capabilities (#607).
Agent-builder wizard supports conversational AI agent creation with bundled prompt templates (#616).
Skill search switched to a CJK-friendly multi-term builder with longer name columns.
Wizard onboarding remains a 7-step flow with bilingual demo seeds, "skip permanently" preference, and idempotent re-runs.
Channel session source and task history metadata carry through to the canonical session record (#623).
Jobs list refreshes from websocket events so external task state stays consistent without polling.
Workspace files hub preference for grid/table view is persisted across navigation.
Provider session source and task history metadata participate in assistant-message dedup so the same output is never re-emitted across agents.

Fixed

Return nil from memory task recall when the context candidate set is empty so prompts do not get a spurious "memory" attribution (#721).
Reject non-ASCII workspace slugs with a clear validation message (#715).
Show generated admin credentials in the install summary (#715).
Refresh resource mutations across all websocket subscribers; ticket updates propagate without a manual reload (#712).
Refresh runtime resource counts and the daemon health port after a websocket reconnect.
Make duplicate migrations idempotent so re-running make migrate-up after a partial apply no longer trips a duplicate-key error.
Surface failed task counts in the dashboard alongside successful ones for accurate usage diffing.
Restore server-side sorting for paginated ticket lists (#660).
Preserve Kimi stderr error codes in provider session responses (#665).
Bound durable event payload sizes for agent_task so a runaway stdout cannot stall the daemon runner.
Preserve the daemon's bound health port when starting tasks.
Restore runtimes after a websocket disconnect so daemons recover gracefully.
Preserve origin user context across agent task dispatches (#691).
Preserve daemon report batches even when the daemon's response drops mid-upload.
Skip flaky TestCreateWorktree_CodeGraphProvisioningAndExclude when CodeGraph is not installed.
Restore ticket comment follow-up after the daemon-task scheduler deferral.
Order terminal report replay deterministically and preserve terminal completion result across restarts.

Security

Workspace files hub enforces the existing Attachment viewer capability and reuses workspace scoping for every query.
Runtime guard alarm and kill events stream to a server-side audit table with dedicated forensic CLI commands.
origin_user_id is recorded on every agent_task row even when initiated outside a workspace membership, so audit trails capture cross-scope actions.
Wizard onboarding routes the skip-permanently preference through the new "skip existing agent" migration so disabling onboarding cannot bypass the safety check.

Upgrade Notes

Apply the database migrations before starting the new server. This release includes migrations 106–117 for griller agent flag, agent-task interaction history, usage snapshot dedupe, durable usage receipts, agent-task origin user, pending-task indexes, skill name length, user config files, runtime guard audit, user config CLI type, agent-task job-run index, memory recall hit count, user account status, attachment pg_bigm search index, and sensitive SSH config metadata.
Linux daemons should be redeployed as the mopheus user (UID 10001) to take advantage of rootless cgroup v2 and the full process-tree guard. Existing root daemons keep working but should be migrated promptly.
Existing workspaces can register personal runtime configuration files under User Settings → Runtime Config Files; CLI-type-aware delivery is automatic from the next task schedule.
Daemons running on Linux now report runtime guard diagnostics by default. Use mopheus runtime guard events and mopheus runtime guard explain <task-id> for post-mortem forensics.
New user account status controls let admins disable individual accounts; legacy accounts default to enabled. Disabled users cannot authenticate and are excluded from license quota counting.

v2.2.3 — 2026-08-22

Highlights

Daemon claim transport encryption — Daemon↔server claim traffic is now sealed end-to-end with per-runtime X25519 keys (issue #556). Each daemon persists its key in a dedicated keystore, the server validates the key on registration/heartbeat, and plaintext claim fallback is gated by a dual test plan with a warn-and-self-heal path.
Workspace onboarding wizard — A redesigned 7-quest onboarding flow ships with bilingual demo seeds, an opt-in demo data switch for migrations, and a "skip permanently" preference so existing workspaces do not see onboarding again. Memory distillation is enabled by default as part of the new flow.
Skill shortcuts capability — Turn rich skills into one-click executable actions callable directly from ticket headers, with a workspace-level capability toggle and explicit descriptions on the shortcuts UI (#542, #571).
Agent environment-variable encryption at rest — Agent env vars are now stored with a per-value ENC1 scheme, keeping the workspace key separate from the encrypted blobs while preserving live reads (#554).
Daemon task recovery after shutdown — Interrupting a daemon mid-task no longer strands work: the new recovery flow restores in-flight tasks on next startup, paired with refined systemctl and ownership handling during install (#585, #581).
More capable CLI surface — mopheus email send subcommand, chat message listing with cursor paging, structured nextBefore output on ticket/repo/chat commands, list pagination info, and a hard refusal to run the daemon as root by default (#547, #559, #560).

Added

Per-profile daemon install and systemctl-managed lifecycle with stream-decompressed image loading to avoid double compression.
Skill labels, workspace bundle support, and a new shortcuts feature flag.
Cross-ticket comment control and refactored workspace middleware for the agent task surface.
mopheus email send subcommand and chat message list with cursor paging.
Workspace deleted event notifies connected clients immediately.
Default agent-task timeout raised from 2h to 24h, with previous values preserved for restoration.
Distinguishing visual treatment for unconfigured values on the system config page.
Skill shortcut capability enabled by default and usable from the ticket header.
Agent-task parent wake table with deferred wakes, traces, and deduped resumptions when subtickets move between states.
Rich-text attachment preview with a source toggle (#576).

Changed

Daemon claim key package moved under a dedicated claimkey/claimcrypto path with explicit fallback and warn-and-self-heal coverage (#591, #588).
Channel session source and task history metadata are now part of the canonical session record.
Provider runtime, comment follow-up, and ACP hardening folded into the new line-protocol runner so providers share one lifecycle (#559).
Ticket dependency can be marked enforced so incomplete predecessors block assignment and status changes.
Workspace onboarding quest flow redrawn to seven steps with bilingual demo seeds and skip-permanently preference.

Security

Daemon claim transport encrypted end-to-end with X25519 + per-runtime keys; legacy plaintext mode remains for the migration window (#556, #580).
Agent env vars encrypted at rest using the ENC1 per-value scheme; key material stays out of the database row.
DingTalk binding restricted to agent owners; the previous cross-owner flow is closed.

Upgrade Notes

Apply the database migrations before starting the new server. This release includes migrations 099–105 for skill shortcuts, agent-task timeout default, daemon public-key column, workspace onboarding, memory feature default-on, agent-task parent wake, and skip-existing-agent onboarding.
Existing daemons must re-register (or wait for the next heartbeat) so they generate and persist their X25519 claim key; daemons without a public key continue to operate in legacy plaintext claim mode until they do.
The default agent_task_timeout is now 24h. Custom values are backed up to agent_task_timeout_previous automatically; restore them after the migration if the old behavior was intentional.
Run the daemon as a non-root user — the CLI now refuses root execution unless MOPHEUS_ALLOW_ROOT=1 is set.
Workspace onboarding is enabled by default; existing workspaces are marked as already-onboarded so they skip the new flow automatically.

v2.2.2 — 2026-08-15

Highlights

DingTalk channel integration — Connect DingTalk Stream bots end to end, including Stream connection mode, QR code account binding, interactive Markdown and card rendering, inbound/outbound media handling, and AES-256 secret lifecycle management.
Agent filesystem sandbox — Protect host environments on Linux using Bubblewrap (bwrap) filesystem isolation, confining agent execution to its workspace and temporary directory while preventing host and cross-workspace leakage.
Private S3 storage & presigned URLs — Support private S3-compatible buckets via SigV4 presigned URLs (s3_private), ensuring secure attachment and media asset delivery without public bucket permissions.
Ticket scheduled activation & due reminders — Schedule tickets for future activation with automatic transition to in-progress status, and track due dates with automated background reminder processing.
Template system foundation — Platform-level schema and multilingual catalog for reusable workspace, group, agent, team, and skill templates.

Added

Unbind and clear runtime assignments from agents in both UI and API.
DingTalk bot integration settings in admin configuration, /dingtalk/bind authorization flow, and channel badges.
Configurable s3_private storage mode for presigned URL delivery and private cache headers.
Ticket scheduled activation (activate_at) and due date reminder tracking with automatic background dispatch.
Push ticket updates to external channels formatted with ticket titles and clickable references.
Schema, category definitions, and multilingual translations for workspace and entity templates.

Changed

Channel architecture unified across Lark, WeCom, and DingTalk, separating outbound content rendering from transport delivery.
Team member management allows promoting and removing members by either agent ID or member ID.
Daemon dynamic health ports are persisted and refreshed reliably during daemon startup.
Optional login methods in web UI are hidden by default when unconfigured.
Centralized workspace context binding across backend HTTP routes.

Fixed

Cross-workspace agent ticket assignments are rejected to prevent cross-tenant access.
Interrupted channel media tasks are canceled cleanly to avoid stalled worker routines.
DingTalk Stream connections tolerate network disconnects gracefully during acknowledgment.
CLI ticket dependency removal uses the correct API endpoint.
System comments and cross-ticket task relationships are identified accurately.
Real-time ticket boards refresh immediately on ticket status changes via WebSocket events.
Test suites isolated from user ~/.config and HOME directories with improved execution speed.

Security

Agent filesystem visibility sandbox (bwrap) prevents unauthorized host filesystem access and workspace crossing.
Cross-workspace authorization enforced on agent ticket assignment boundaries.
DingTalk bot secrets encrypted at rest with AES-256 and seamless key rotation support.

Upgrade Notes

Apply database migrations before starting the updated server. This release includes migrations 094–098 for DingTalk channel support, private S3 configuration, ticket timing/reminders, template system schema, and ticket activation requester auditing.
To enable the Linux agent filesystem sandbox, install bubblewrap (bwrap) on host runtime machines and set MOPHEUS_SANDBOX_ENABLED=true.
For private S3 bucket deployments, enable s3_private in platform configuration so attachment downloads automatically use SigV4 presigned URLs.

v2.2.1 — 2026-08-12

Highlights

WeCom smart-bot integration — Connect WeCom bots end to end, including onboarding, identity and session binding, inbound media, outbound ticket and task updates, and bilingual administration and product documentation.
Traceable and deferred agent work — Comment-triggered tasks coalesce follow-ups, tasks can wait in a deferred state until attachments are ready, and ticket details include an interactive task-flow view for comments, delegation, downstream tickets, and task status.
Domain-aware memory distillation — Distillation supports automatic, general-only, and specialty modes, records effective skills for audit, exposes generic memory type names, and makes forced re-distillation atomic.
Stronger Agent administration — Workspace members can bulk assign runtimes, archive, restore, and transfer ownership with all-or-nothing validation; private Agent permissions are enforced server-side and the default Agent license quota is 10.

Added

Persisted ticket filters and search per user and workspace, with URL date ranges remaining authoritative and date filters applied consistently to board columns.
Skill filtering by usage and owner, a memory-distillation capability toggle synchronized with SKILL.md, and a simplified manual creation form with Frontmatter validation and actionable errors.
Redis-backed shared state for local Skill discovery and import requests in multi-server deployments, with the existing in-memory fallback for single-server deployments.
Workspace inbox unread badges, persisted sidebar collapse state, pinned-ticket access in the collapsed sidebar, memory filtered totals, and persisted floating agent-task control placement.
Channel session source and task history, workspace user binding synchronization, consolidated Agent runtime configuration, CLI interactive token login, and automatic CLI tool configuration in supported installers.

Changed

Skill metadata editing now uses the complete SKILL.md source, including Frontmatter, as the canonical editing surface; database projections are derived during supported saves and import overwrites.
ZIP and filesystem Skill imports now share one discovery walker that consistently ignores macOS metadata and validates extracted paths.
Editor display preferences apply consistently to ticket, Agent, team, and scheduled-task creation and editing surfaces.
Team-leader delegation instructions now require valid mention links and a bare-@ preflight scan.
Ticket discussions gained parent/reply navigation, last-reply shortcuts, more reliable inbox-target scrolling, a more compact toolbar, and live task-graph refreshes.
Runtime lists put offline entries last and show owner display names instead of owner IDs.
Online installation is more resilient across unavailable CLI assets, Podman Docker aliases, quiet wget execution, deterministic text attachment extensions, and the PowerShell installer path.

Fixed

Provider runtime panics are contained to the affected task across Claude, Codex, KimiCode, OpenCode, ACP, and Pi; cleanup, terminal results, session IDs, and channel closure remain deterministic.
Archived subtickets remain visible from their parent while general ticket lists continue to hide archived tickets by default.
Comment dispatch handles member follow-ups, self-mentions, missing coalesced IDs, and pending/running task successors without losing work.
WeCom credential rotation and encrypted media metadata handling are safer, and missing webhook triggers no longer cause nil failures.
Skill Frontmatter styling and Markdown editing are consistent, duplicate manual Skill names produce a specific error, and local Skill request polling works across API instances.
Search keyboard navigation, empty ticket suggestions, ticket mentions, agent-task message output storage, snapshot polling, FAB placement persistence, and deferred/terminal task status filtering now behave consistently.
The CLI refuses workspace switching while operating inside an Agent task.

Security

Skill ZIP extraction rejects path traversal and applies centralized metadata filtering before discovery.
Private Agent edit, management, and ownership-transfer permissions are enforced by the server, including bulk operations with pre-validation and no partial mutation.
WeCom secret-key rotation preserves decryptability during transitions, and provider panic details remain in server logs rather than task-facing errors.

Upgrade Notes

Apply the normal database migrations before starting the new server. This release includes migrations for comment-task coalescing, deferred task status, binary task output, WeCom/channel metadata, task-flow seed data, Chinese full-text search, and channel session identifiers.
The systemd unit is now named mopheus-daemon.service; update service-management automation that still references the former unit name.
Configure the new WeCom settings before enabling the integration. Multi-server installations should configure Redis so local Skill discovery/import request state is shared across API instances.
No manual data rewrite is required for the Skill editor changes; existing SKILL.md Frontmatter becomes the canonical source during subsequent supported saves and overwrites.

v2.2.0 — 2026-08-06

New

Channel unification — Lark and Feishu consolidated under one channel engine with media-state cleanup, task-batching semantics, and workspace-scoped chat writes.
Daemon identity & new runtime — profile-tagged runtime registration, per-profile daemon identity, and a new pi-coding-agent provider.
Workspace management — batch invites that include skills, visible resource grants on runtimes, paginated roles with refresh grants, and a new resource-grant model.
RBAC resource grants — self-managed agent access for members and lifecycle operations gated by workspace scope.
Tickets & metadata — metadata CRUD via the service layer with a picker UI, comment Enter-key behavior preference, ticket list search filter, and my-tickets scope filtering pushed to the backend.
CLI surface — skill list query flags, ticket list search filter, --project-id alias on ticket commands, --description-stdin and --description-file on agent and team create.
Profile & preferences — personal preferences, notification settings, keyboard shortcut recording, and editor display-mode preferences.
Agent-task checklist — per-task run-local checklist surfaced to CLI sessions.
License CLI — template presets available in mopheus-license.

Improved

Editor behavior — Enter / Mod-Enter complementary handling, shortcuts conflict detection, and /add comment style unified across prompts.
Distillation — redistillation choices signal for memory refinement; dedup logic aligned with mopheus memory subcommand.
Activation & registration — runtime activation preserved on register; new agents default to the normal role.
i18n — workspace settings tabs translated; memory role scope label added.
Hermes channel — per-task skills cleared between agent-task runs.
Codex sandbox — macOS sandbox aligned with the Linux behavior.
Channel install flows — workspaces refresh after invitation acceptance; media state cleaned on deletion.
Output guidance — slim repo command examples aligned with current CLI flags; provider-specific task tracking guidance added.

Fixed

Cross-workspace hardening — closing leaks in team CRUD, member onboarding, agent lifecycles, jobs/triggers/runs, runtimes, inbox operations, skill CRUD, attachments, ticket pins, labels, team leaders, chat writes, Lark installation/binding, and license quota checks.
Brand rename — moclaw → mopheus across CLI, scripts, docs, and packages.
Label operation type rename — TicketLableOperationParams → TicketLabelOperationParams.
Auth — current-password requirement clarified; expired JWT sessions report a distinct error; user error codes centralized.
Daemon — graceful handling when the prior working directory is unavailable; allow owner heartbeats when the runtime is disabled; bound heartbeat drain to snapshot length.
Workspace — enforce owner-only deletion; accept pre-rename license codes; refresh workspace data on config changes.
Migration & install upgrades — preserve existing table data and custom system config across upgrades; avoid duplicating migrated environment keys; harden renamed upgrade scripts.
Skills — paginated skills list, normalized script file permissions, renewal of import orchestration.
Agent — detect kimi missing sessions from stderr and retry resume; configure ACP unattended permissions; queue agent tasks when the runtime is offline; surface Codex plan updates as tool events.
Notifications — suppress banners while focused; foreground tests allowed.
Editor — limit large attachment previews; long-comment navigation, chat copy button, group mention routing by structured ids.
Inbox — group ticket read and archive actions; scope single-item operations by workspace and recipient.
Hermes channel — keep the sidebar chat available; clean media state on deletion.
Backend — allow heartbeat and registration for disabled runtimes when the owner is active; resolve daemon claim workspace; qualify joined SQL column references.

v2.1.3 — 2026-07-21

New

Knowledge graph — AGE-backed knowledge graph with subgraph navigation, edit operations (merge tags, remove edge, update node metadata), and a RebuildGraph command.
Memory system — workspace memories written as files for agent prompt injection, retrieval guidance for agent workflows, recall by ticket context at claim time, table output with title, scoped CJK retrieval, status cleanup on memory deletion, invalidation of all memory queries on delete, hasEmbedding field, per-field editing, JSON view editor for context tags, and a --disable-memory-retrieve CLI flag.
Search — pg_bigm-backed CJK substring and multi-word tiered search for tickets, ILIKE substring fallback for CJK, and Chinese full-text search via zhparser.
Skills UX — searchable skills dialog with table view, page-entry refetch, total skill count, list search state preserved, and file mode preservation during import.
License — offline authorization enforcement and the default memory limit raised to 50.
CLI surface — tickets create accepts --parent as an alias of --parent-id and --project-id as an alias; agent and team create commands gain --description-stdin and --description-file.
Sidebar & navigation — pinned tickets shown in the sidebar and default-collapsed ticket sections with limited attachment display.
Agent-tasks FAB — expanded to six anchor positions and stacks in FabGroup, with a dedicated ticket link button and widened drawer.
Runtime import — search filtering in the runtime import dialog.
Daemon control — per-task subagent limit with prompt injection and ~/.claude/projects cache cleanup per task; subagent lifecycle event parsing.
Agent environment — task-scoped CLAUDE_CONFIG_DIR for Claude and a homeSeeder hook on cliProvider.

Improved

WebSocket client stability — refresh stale clients after deploy; invalidate the tickets-board query on ticket WS events.
Agent-task activity — restore batch usage in the task list endpoint; lazy-load messages with pagination.
Distillation prompt — strengthen memory retrieval trigger in chat mode; tighten memory CLI command references.
Editor — FAB jumps to top-left on click from bottom-right position; suppress body hydration extension noise.
Tickets UX — restore page clickability after setting parent ticket; agent task floating action button drag-to-corner behavior; absolute timestamps in comment and activity timeline.
Default prompt — slim provider prompt hardened; Claude default prompt switched from v1 to v2.

Fixed

Memory — fix V1 memory prompt paths and index format; fix searchSimilarMemories SQL parameter numbering and scope filtering; address final review findings.
Skills — preserve file modes during import; preserve script metadata during import; preserve executable skill scripts; batch agent usage lookup; refetch list on page entry; show total skill count.
Install & packaging — avoid copying downloaded archives; pull all services during online update, not just backend and frontend; harden online install scripts across platforms; update install env example.
Daemon — scope Claude cache cleanup per task; resume workflow after skill runs; detect Kimi missing sessions from stderr; retry missing resume sessions.
Tickets — validate metadata JSON filters; bind repositories to transactions; keep the board in place after delete.
Web — refresh stale clients after deploy; remove unused serverActions config; clean up final review findings.
Tickets scope — cascade delete memory_source and memory_distillation.
Agent — preserve executable skill scripts; stop ACP process after prompt completion.
Prompt — restore memory retrieval guidance references to match actual CLI flags.

v2.1.2 — 2026-07-08

New

Codex provider — Codex runtime support with full agent execution parity (MCP, sandbox, memory handling, session usage tracking).
GitHub integration — Register repositories, sync PRs and issues, link them to tickets, and drive the full checkout → code → PR → sync workflow from the CLI.
Group chat — Topics, reactions, replies, member management, mention filtering, clickable ticket identifiers, and hover cards.
Skill import — Import skills from a URL, parse from GitHub, upload a zip, or import locally.
RBAC — Observer role, role selection during member invites, and new scoped permissions.
/note command — Suppress agent triggering from a comment.

Improved

Ticket and workspace UX: dirty guards, explicit edit/save/cancel flows, context-menu pickers, identifier prefixes, terminal status cascading to subtickets.
Agent task floating action button, active-task display, and drag-to-corner behavior.
Helm chart and install/update packaging.
Marketing site scaffold (Next.js + i18n).

Fixed

Daemon WebSocket stability (fewer unnecessary reconnects; fixed 1006 on forced re-registration).
Agent task trigger-comment deduplication by thread context.
Repository query aliases, NULL scan handling, duplicate repo URLs, UUID resolution, and missing trigger thread IDs.
All-zero usage buckets no longer appear as synthetic model rows.
Long comment display, mention picker keyboard selection, timeline collapsing, and memory extraction UI.

v2.1.1 — 2026-06-30

New

Live workspace slug validation with safer random suffix generation.
Ticket ID matching in global search and clickable URLs for metadata values.
Runtime usage accuracy — task counts now sourced from runtime_daily; cache token totals surfaced in usage reporting.
Remote CLI installation and install backup tooling.
Requester and runtime info in agent run lists; dashboard activity log improvements.

Improved

Prompt metadata split into mandatory and optional tiers.
Feishu region labels unified to "Feishu" / "飞书".
Test coverage: webhooks 80.8% → 88.8%, auth 80.8% → 94.2%.

Fixed

Ticket metadata CLI parsing against response envelopes.
Runtime usage double-counting; number inputs stuck at 0 on backspace.
Attachment content-type via extension overrides; duplicate member add (409).
Browser autofill on hidden agent env-var fields; CLI session retry on 401; install health-check endpoint path.

Includes database and usage-reporting changes around runtime_daily. Apply migrations before relying on runtime usage totals.

v2.1.0 — 2026-06-25

Initial 2.x release. Detailed per-item notes were not captured at tag time.