Changelog

Newest first. Dates reflect the release tag.

v2.2.13 — 2026-10-31

Highlights

Tickets now have a dedicated owner, separate from the assignee — A ticket carries an owner (a human member accountable for the work) alongside the assignee (whoever actually executes it, including an agent). The owner is selectable in the create dialog, the ticket sidebar, the list view, the board card and the context menu, and it is filterable through a new "owned" scope. Owners are auto-subscribed to their tickets, are notified in the inbox when ownership is assigned, and are included in due-date reminders (#1277, #1284, #1288, #1303, #1335).
Workspace SSH command policies block and audit risky commands — Every workspace gets a command policy that is evaluated before credentials are resolved or a connection is opened. Immutable system rules ship with the platform, users add their own rule groups, and every blocked command is recorded with the actor and the agent task that attempted it. Policies are managed from Settings → SSH Policy and from the CLI, and mopheus ssh exec --dry-run prints the planned remote command without connecting (#1230).
WhatsApp becomes a first-class channel, in two modes — WhatsApp can be paired as a linked device via QR code or connected through the Meta WhatsApp Business Cloud API. Pairing is per-installation and encrypted at rest, and a remote logout on the phone automatically revokes the installation (#1243, #1245).
The usage dashboard becomes actionable, and mopheus usage brings it to the terminal — The Usage page shows a daily trend chart, an insights radar that flags token surges and efficiency wins, and a leaderboard of the most expensive tasks with direct links into their transcripts. The same data is available from the CLI through mopheus usage summary, top-tasks, agent and daily (#1283, #1295, #1316).
Assets become a first-class inventory with real credentials — A workspace-level asset list spans every application with search across names, aliases, IPs and hostnames, inline filters and sortable columns. Assets can hold external credential references in addition to SSH keys and passwords, and database tools such as redis-cli and mongosh run against an asset through the configured SSH jump path without exposing secrets on the command line (#1267, 235e29e5, f12a7db4, 3436d1f0).
Agent tasks gain durable notes and controlled retries — An agent task can carry a resolution note recording what went wrong and who wrote it, plus an explicit allowRetry switch that disables the retry action entirely. A task that already spawned a retry is refused with 409 AGENT_TASK_ALREADY_RETRIED instead of silently duplicating work (#1255, #1254, #1253, #1257).

Added

Ticket owner field: per-ticket picker, list column, board card, context-menu submenu, inbox notification, auto-subscription, due-date reminder, and a dedicated "owned" My Tickets scope (#1277, #1284, #1288, #1303, #1335).
Workspace SSH command policies: rule groups, user rules, immutable system rules, RBAC scopes, audit records, Web management screens, CLI management commands, and a static policy test that never connects to a host (#1230).
mopheus ssh exec --script uploads a local script to a remote directory, executes it there and removes the remote copy afterwards; --dry-run prints the planned command without connecting.
WhatsApp channel integration in dual mode: linked-device QR pairing and the Meta WhatsApp Business Cloud API, with webhook signature verification and media download limits (#1243).
Usage dashboard redesign with a daily trend chart, surge and efficiency insights, an expensive-task leaderboard and an agent drill-down; new mopheus usage CLI suite with tabular and JSON output (#1283).
Agent task resolution notes with an allowRetry toggle, surfaced in the CLI and the task UI (#1255).
Admin observability: paginated admin list endpoints plus runtime, daily-trend and guard-event endpoints (#1229).
Workspace-level global asset list view with a view switcher, deep-linkable URL state, multi-field search, inline filters and column sorting (#1267).
External asset credential references, credential connection-chain inspection, and a credential list that returns only approved references and SSH key names — never secrets (235e29e5).
Asset-backed database tools: mopheus tool redis-cli and mopheus tool mongosh resolve a workspace asset and run the shell over the configured SSH jump path (3436d1f0, f12a7db4).
Databases can be modeled as running on hosts, database instances are shown in topology, and RAC assets are grouped in topology layouts (0787a139, 7c745976, 723a6e1f).
Terms of Service and Privacy Policy pages, with localized notice links on the login and registration pages (#1332).
A built-in Feishu CLI setup skill that drives device authorization across turns and uploads configuration and keychain files to the user's profile in encrypted form (#1306).
A mopheus-security-scan skill covering static analysis, dependency scanning, proof-of-concept verification and trust-boundary references (1b203be5).
Agent task runtime version snapshots: the provider CLI version, daemon version and Git commit are recorded when a task starts and shown in the transcript (#1300).
Live workload diagnostics for blocked agent tasks, stating deterministic blockers directly (#1236).
Job list filters and an "Upcoming Runs" preview that projects the next scheduled slots and flags concurrency hotspots (#1292, 3153c971).
An MCP visual editor for agents with list and JSON views and editable STDIO and HTTP server configurations (822ff94b).
Daemon skill cache synchronization, so assigned skill bodies are delivered once and reused across tasks (1267e3d6).
A quote-selection action in ticket comments that appends the selected text as a Markdown blockquote into the reply composer (#1329).
# mentions of IT assets in ticket descriptions and comments, with a hover preview and click-to-navigate (#1269).
Subagent transcript lanes: the agent transcript can be filtered per subagent, each with a collapsible execution swimlane (#1232).
Attachment reference management: referenced attachments are listed before deletion and references removed by an edit are marked as deleted (#1264).
Deployment password encryption: passwords are generated at startup, the plaintext copy is kept in a restricted secret file, and the environment file holds only the encoded value (dbbc705d).
A chat proactive ticket creation preference; by default a chat agent answers without creating tickets (#1268).
Ticket description activity diffs, rendered lazily in ticket history and dashboard activity (e79bf09d).
Multi-ticket drag on the Kanban board moves the whole selection to the target swimlane (#1289).
Background Bash runs appear in the agent transcript, and agent tool transcript details render command and edit payloads (8f2cc09f, 3f7e84f6).
A floating chat panel preference, an explicit time zone column for job triggers, and a job list search field (5c05974a, cb38a68c, 3153c971).
Claim payload compression and deduplication, and workspace skill bodies are skipped when the daemon supports the skill cache (8b82c25d, 0f2dfce2, 253b75fc).

Changed

The agent runtime prompt explains the sandbox layout it runs under, so agents understand the long tmpfs mount list and the intentional empty sibling directories and stop trying to repair the isolation (#1338).
Agent task and runtime lifecycle events are aligned across the daemon, the WebSocket hub and job triggers: completed and failed fire only on a real terminal transition, and idempotent replays no longer re-trigger jobs (#1321).
The agent task FAB opens an adaptive-height popover anchored to the floating button instead of a full-height side sheet (#1271).
The admin CLI reports real runtime and storage statistics and prints output for write subcommands that previously discarded their response (#1226).
The Jobs page shows explicit trigger time zones and removes the redundant concurrency banner from the upcoming-runs card (cb38a68c).
Memory retrieval is strictly scoped: asset_id and profile_id are treated as equivalent, alias keys are normalized on write, and a memory bound to an asset, user, project, job or agent no longer leaks into unrelated task contexts (#1251).
Agent prompts no longer imply that every task should end with a memory write; routine tasks are read-only by default (62e2a9f0).
Antigravity background commands are tracked so a task settles only after every detached command has actually finished (#1334).
The Go and frontend dependency sets are refreshed (5deede55, 3f127b64).

Security

Browser WebSocket subscriptions are restricted to authorized rooms, and relay control scopes are separated from browser notification scopes (6a054401).
Changing a local password revokes previously issued sessions; a password version is embedded in the JWT and checked on every authentication (#1307).
Chat-originated agent task details are redacted for viewers who are not participants in the associated chat session (#1304).
SSH commands are evaluated against the workspace policy before credentials are resolved or a connection is opened, and blocked commands are recorded with the actor and agent task (#1230).
Asset credential listings return only approved external credential references and SSH key names; secrets are never echoed (235e29e5).
Deployment passwords are generated at startup and stored in restricted secret files, with only the encoded value kept in the environment file (dbbc705d).

Fixed

mopheus ticket assign --unassign reported success without clearing anything; ticket update and ticket batch-update gained a unified --clear-assignee flag, and an empty --assignee-id or --owner-id is now an explicit clear rather than a silent no-op (#1294, #1301).
Board card description previews rendered agent-generated descriptions as punctuation-only garbage; inline code is now unwrapped instead of deleted (#1330).
Agent transcript dialogs stalled on tasks with thousands of events; the event list is now virtualized and timeline lanes are memoized (#1227).
Antigravity tasks were settled as complete while a long background command was still running, killing the command and losing the completion wake-up (#1334).
Daemon task claims and maintenance requests are paused after repeated heartbeat failures and resume when connectivity returns; claim retries use bounded timeouts and report the previous failure reason (211d14d5, d57467c2, 9a92d39b).
The comment editor's # and @ suggestion popups lost their key handling because it was captured before the React commit (#1325).
Usage model attribution was recorded as unknown for streaming deltas; it is now tracked and recovered per model (#1295).
Context overflow is classified for both Claude and Pi (38d0ff11, 7c146a77).
The nightly build failed intermittently because next typegen started a non-atomic rewrite of the generated docs index (#1259).
Interactive comment widgets no longer expire prematurely when posted on a ticket that is already closed (#1231).
Redis now rejects remote interactive sessions (911715f4).
Attachment queries are invalidated when a ticket is updated (#1279).
Clearing the assignee or owner in the create-ticket dialog now persists instead of the previous actor being silently restored (#1317, #1303).
The browser no longer autofills a saved password into masked environment variable rows (#1248).
Inbox notification bodies no longer suffer UTF-8 corruption, and long titles are truncated safely (#1340).

Breaking Changes

Asset IDs are restricted to ^[a-zA-Z0-9][a-zA-Z0-9_.:-]*$. Slash and other illegal characters are rejected by the API and the CLI, and a migration normalizes legacy slash-form IDs. Update manifests that use slash-form asset IDs to the colon form (host:node-1) (#1305).
mopheus ticket assign --unassign and mopheus ticket batch-update --unassign are now hidden aliases of the unified --clear-assignee flag. Existing scripts keep working, but the advertised flag name changed (#1301).
mopheus ssh exec --script no longer pipes the script into a remote shell. The script is uploaded to --remote-path (default /tmp), executed there, and removed afterwards; the root directory is rejected as a destination (026a80af).
POSTGRES_PASSWORD and ADMIN_PASSWORD are no longer written with default values into the environment file. They are generated on first startup, the plaintext copy is written to the restricted secrets/ files, and the environment file keeps only the encoded value (dbbc705d).
Asset credentials moved external credential references out of the asset attributes and into the credential rows. Manifests that still declare credential_ref as an asset attribute are migrated automatically (f12a7db4).

Upgrade Notes

Review the SSH policy for each workspace after upgrading. Policies are enabled by default for new workspaces and are evaluated before every SSH connection, so a workspace that relied on unrestricted remote commands should add an explicit rule group or relax the system rules before agents run (#1230).
After upgrading a self-hosted deployment, run mopheus.sh start-server (or up) once and read the generated administrator password from secrets/admin_password. The environment file contains only the encoded value (dbbc705d).
Convert any slash-form asset IDs in manifests and configuration to the colon form before re-applying them (#1305).
The deployment password encryption change adds secrets/ to the ignore list. Exclude the directory from backups you do not want to contain plaintext credentials (dbbc705d).

v2.2.12 — 2026-10-24

Highlights

Two-factor authentication for password sign-in — Password login can require a code from an authenticator app. Administrators choose the policy — disabled, optional, or required — and under the required policy users are prompted to enroll at their next password sign-in, with no grace period. Users manage their own authenticator under Settings → Profile & Account → Security; replacing or disabling one requires both the password and a current code. Failed codes lock the account after 10 consecutive attempts for 15 minutes, and a code cannot be replayed. Administrators can reset a lost authenticator from the Users screen, which is audited and emailed to the user when SMTP is configured (#1202).
Admin control over which sign-in methods are available — Password, email-code, Feishu, and LDAP sign-in are now individually switchable from a new Authentication section in admin configuration. The system refuses to disable the last usable sign-in method, so an instance cannot lock itself out of its own login page.
Encrypted SSH credentials for IT assets — Each asset can hold one or more named SSH accounts, each stored encrypted and scoped to your workspace, the asset, and the login name. Accounts support password authentication and private-key authentication including passphrase-protected keys, plus an optional one-hop jump host for bastions. New commands: mopheus asset credential add|update|list|import|inventory and mopheus ssh credential get <asset-id> --user <username>. Listing and status commands return metadata only — passwords and private keys are never echoed (#1215).
Interactive widgets now capture free-text instruction — Every decision widget — single-select, multi-select, and confirm-action — offers a built-in free-text instruction field, so a user can pick an option and say what they want changed instead of only choosing from a fixed list. The reply is recorded alongside the selection in the decision receipt (#1204).
A standalone admin CLI puts platform control on the command line — mopheus-admin is a separate binary covering users, licenses, workspaces, feature flags, statistics, and templates. It refuses non-admin logins and can update itself with mopheus-admin upgrade (#1189).
Ticket-scoped memory distillation now has a managed lifecycle — Distillation moved from a fire-and-forget operation to an explicit claim → run → publish lifecycle tied to a ticket. Distillation status (queued / running / distilled / failed) is visible in the ticket, claims are reconciled automatically if a run dies, and each workspace remains bounded by its licensed memory quota.

Added

Two-factor authentication with per-user authenticator enrollment, account lockout after repeated failures, administrator reset with an audit trail, and interactive CLI handling of the challenge (#1202).
Individual sign-in method switches for password, email-code, and Feishu sign-in, with a guard against disabling the last usable method.
Encrypted SSH asset credentials with password and private-key authentication, optional jump-asset support, database-paginated host inventory, and a mopheus asset credential / mopheus ssh credential command family (#1215).
A standalone platform admin CLI for users, licenses, workspaces, feature flags, statistics, and templates, distributed as its own release archive (#1189).
A skill template request workflow: members submit a skill for promotion, administrators approve or reject it with a note, and members see the request status and review note on the skill row (#1189).
Built-in custom instruction feedback on decision widgets, with feedback text required before submission (#1204).
Separate assets:write and assets:delete permission scopes that administrators can grant independently per role; read access is unchanged (#1205).
Role assignment surfaced on the agent page, so members with the role-management scope get an Access tab for granting workspace roles.
An Event trigger tab in the Create Job dialog with an Agent-first onboarding guide and copyable CLI reference (#1220).
Sortable skill lists by name, last updated, or recent usage, with the selection preserved in the URL (#1223).
Per-pillar memory tree pagination and a searchable floating asset picker (#1184).
Batch acceptance of multiple workspace invitations for new users.
Joined workspaces listed for each user in the admin users table (#1187).
A "Create Pangu" action on the Agents page that pre-fills the agent creation form from the built-in template.
Browser notifications for private chat replies, with a Private chat reply toggle under notification preferences.

Changed

One ticket list instead of a separate "My Tickets" page. My Tickets is now a toggle in the Tickets view toolbar, personal scope tabs replace workspace scope tabs when it is on, and the ticket list columns are aligned across header and rows: Priority, ID, Title, Labels, Assignee, Start, Due, Updated (#1213).
The workspace sidebar is reorganized into work items, build resources, and administration sections, with administration docked to the bottom, holding across expanded, compact, and mobile layouts (#1211).
Memory markdown files now carry top-level frontmatter fields instead of a nested context_tags object, and the memory detail screen replaces a raw JSON editor with structured fields for description, labels, custom attributes, and asset binding (#1195).
The agent runtime prompt now forbids working around permission, security-control, or environment restrictions, and requires a blocked operation to be reported as a limitation.
mopheus ssh list is served from the database with pagination, accepts --page / --per-page, and gains an AUTH column reporting whether a host is configured, legacy, or not configured.
HTTP handlers log the failing operation together with workspace, agent task, agent, and user context on a 500 response.
Daemon cleanup applies the artifact retention TTL to chat, job-run, and quick-create task directories in addition to tickets.

Security

Private chat and agent-task data are session-scoped: task details, transcripts, usage, and interaction queues require chat session access before being returned.
SSH credentials are stored encrypted per workspace, asset, and username, are never returned by list or status commands, and are only decrypted for an authorized SSH execution.
CLI auth tokens now live in a dedicated auth.json file with 0600 permissions rather than inside config.json, and the on-disk token format was compacted to an encrypted envelope.
TOTP codes are rejected on replay, and a run of 10 consecutive failures locks the account for 15 minutes.
HTTP handler failures are logged server-side instead of being silently swallowed.
Agent prompts explicitly forbid privilege escalation, forged mounts, host-state changes, and writable-path workarounds around a denied operation.

Fixed

Replying to an agent comment now resumes that agent inside the team that produced the original comment, rather than routing under the ticket's current assignee's team.
Closed tickets and member replies no longer wake agents. Explicit @ mentions still work, and the trigger preview explains why a trigger was suppressed or blocked instead of doing nothing silently.
Offline upgrades load the bundled container images before replacing any files or updating configuration, and abort if an image archive is missing.
Offline image bundles are built for the right architecture: image export uses platform-aware docker save and verifies the archive's tag and CPU architecture before publishing (#1178).
Agent tasks are no longer killed for using disk cache, because the cgroup v2 memory guard discounts reclaimable page cache and slab (#1182).
WeCom installations with rejected bot credentials no longer reconnect on an endless backoff loop; the channel is parked as blocked and resumes once the configuration is corrected.
The comment minimap no longer adds a second scrollbar, and the hover preview shows a position badge (#1206).
The collapsed chat panel is removed from the accessibility tree and from keyboard navigation instead of remaining an invisible, focusable target (#1199).
Saving a skill shows a proper "saved" confirmation rather than repeating the button label (#1200).
The ticket list no longer hides open tickets older than 30 days unless a date filter is chosen, the filter button no longer shows a false active-filter indicator, the "agent working" indicator now filters both list and board views, and the header count matches the active scope tab (#1213).
Jobs with a Webhook trigger display their trigger label in the Jobs list (#1220).
Pinned-ticket badges in the collapsed sidebar are no longer clipped (#1214).
Chat topics can once again be archived, restored, deleted, renamed, and left directly from the topic list.
"Create Workspace" opens correctly from the collapsed sidebar, and the workspace dropdown closes after a workspace is picked (#1186).
The login page shows its title and description above the form on small screens.

Breaking Changes

Asset manifests containing ssh:// credential_ref attributes are rejected by mopheus asset apply. Move SSH accounts into the top-level credentials list, or a separate --credentials-file, before re-applying manifests. Assets already stored with a legacy credential_ref keep working and are not migrated automatically.
The /[workspace]/my-tickets route was removed and is no longer redirected. Use /[workspace]/tickets and the My Tickets toggle; existing bookmarks to the old list or detail URLs no longer resolve.
mopheus ticket mark-distilled was removed and replaced by mopheus memory mark-distilled. Custom scripts and skills invoking the old command must be updated.
mopheus ticket distill --force no longer deletes existing memories up front. It replaces the ticket's own old memory sources only after a successful publication, and only when new memories were actually produced.
mopheus ssh list output and pagination changed: an AUTH column was added, --page / --per-page were introduced with a default of 100 rows per page, and unconfigured hosts are now included.
The REST contract for distillation changed. POST /tickets/:id/mark-distilled now requires an agent-task token; GET /memories/distill/status/:ticketId returns a status field and drops memoryCount; the trigger-preview response adds suppressedByStatus and changes blocked[].id from a UUID to a string.

Upgrade Notes

Database migrations 150–157 apply automatically during the upgrade: distillation lifecycle and status columns, skill template requests, TOTP authenticator bindings and account lockout, the asset credential table, and the new asset permission scopes.
Credential files must be mode 0600. Both the credential manifest and any mopheus asset apply file containing a credentials section are rejected if they are readable by group or others.
HTTPS is required for credential operations. mopheus asset credential and mopheus ssh credential refuse to run against a plain-HTTP API endpoint unless the host is localhost or a loopback address.
If you use credential_ref today, run mopheus asset credential inventory to review which assets still carry legacy SSH URI metadata, then re-create those accounts with mopheus asset credential add or import.
A jump asset and jump username must be set together and must reference a different asset; a jump credential cannot itself point at another jump asset.
mopheus-admin is published as its own archive alongside the mopheus archive. Download it and put it on PATH, or use mopheus-admin upgrade to keep it current.
CLI credentials moved to ~/.mopheus/auth.json (or ~/.mopheus/profiles/<name>/auth.json) instead of config.json. Migration is automatic, but backup scripts and config sync that read the token from config.json must be updated.
Memory markdown files now use expanded top-level frontmatter. Import still reads the old format, and the exported MEMORY.md index table has new Description and Labels columns, so scripts parsing a fixed column count need adjustment.
Offline upgrade packages must contain the image archives and an env.example. A missing archive now aborts the upgrade before any files or configuration are changed. The set of images loaded during an offline upgrade is derived from the release's env.example rather than the installed instance's .env, so sites running the nginx or new-api add-ons should confirm the expected image set is included in their bundle.
New configuration keys default to current behavior: totp_policy (disabled), password_login_enabled (true), email_code_login_enabled (true), and lark_oauth_enabled (true).
The distillation deduplication thresholds are now per memory type: preference 0.25, success playbook 0.28, others 0.30.
MOPHEUS_IMAGE_TAG in the install environment example now points at v2.2.12.

v2.2.11 — 2026-10-17

Highlights

LDAP / Active Directory sign-in — Configure a directory URL, TLS mode, certificate verification, Base DN, search filter, login attribute, an optional read-only bind account, timeout, and name/email mappings in the admin console, then test the connection in place. The LDAP / AD entry appears on the login page only while directory sign-in is enabled, and directory users are provisioned automatically on first successful login (#1168).
Workspace configuration backup and restore — Workspace owners can export a ZIP backup of agents, skills, channels, jobs, teams, tickets, and settings, then import it with a preview of what will be created, updated, or skipped before anything is written. The web flow and mop workspace export / mop workspace import share one serialization format.
Custom application HTTP stream bridge — A new channel type lets an external runner deliver platform messages to a Mopheus agent over HTTP and receive outbound deliveries on a continuous NDJSON stream. Installations get their own credentials with rotation and revocation, and Python, Go, and Node.js example runners are downloadable from the setup flow (#1161).
Deterministic memory provenance — Every memory records its origin as a ticket, job, chat session, manual entry, or agent task, resolved from verified authentication context rather than free-form tags, so cross-ticket knowledge is traceable end to end (#1173).
Human-readable decision receipts — Interactive widget receipts render as a Question / Choice table instead of machine-oriented fields, with multi-select answers joined readably and confirm-action feedback shown inline.

Added

LDAP / Active Directory authentication with an in-console connection test, automatic user provisioning matched by mapped email, and administrator-set local password fallback (#1168).
Owner-only workspace configuration export and preview-driven import in workspace settings.
Custom application channel bridge with credential rotation and revocation, inbound media handling, stream leases, outbound delivery results, and retry handling (#1161).
Polymorphic memory provenance with historical backfill and source-task tracking (#1173).
Per-recipient comment trigger start strategies, including joining an agent run that is already pending.
Channel integration context on ticket references and agent tasks, with the channel type shown in activity rows.
Daemon self-restart after binary replacement, on by default and controlled by MOPHEUS_DAEMON_AUTO_RESTART (#1157).
Local OpenSSH configuration applied when connecting to authorized assets; asset credentials stay authoritative.
Standardized SwissQL credential_ref URI scheme for database assets with a deterministic endpoint resolution procedure.
Documentation site: Maple Mono NF CN code font, a 2:1 character-grid linter for ASCII diagrams, and compact sidebar navigation (#1137).
Overhauled cross-ticket memory documentation in English, Simplified Chinese, and Japanese (#1132), plus stricter memory type semantics and distillation classification guards (#1131).

Changed

Ticket metadata key permissions are split from ticket entity permissions, so metadata maintenance no longer implies ticket deletion rights (#1148).
Memory views are paginated with consistent paging and status controls, and the "all" filter includes disabled memories.
The "Grill" action always opens a menu offering configured griller agents or the assigned agent (#1150).
Job run history numbers attempts chronologically and measures multi-attempt runs from the active attempt (#1152).
Channel lifecycle notifications normalize attachment links and expand short-form URLs.
The nightly build schedule moves to 02:30 CST, with a guarded daemon restart step.

Security

LDAP authentication escapes filter input, bounds lookups with a timeout, and returns a uniform error that does not leak directory details; directory passwords are never logged or returned by the API, and directory users cannot reset their own password.
Ticket metadata write and delete scopes are independent of ticket entity scopes (#1148).
HTTP handler failures are logged server-side instead of being silently swallowed.

Fixed

Claude context exhaustion is detected and reported as a failure instead of a successful turn.
Pending attachment uploads are reconciled, so images discarded in the editor no longer attach to comments as duplicates, and stale uploads are reaped after two days.
Repository cache entries validate worktree pointers before reuse and can recreate broken checkouts.
Workspace invitations cannot be accepted twice.
Ticket fields survive partial CLI updates; ticket update no longer clears fields that were not supplied.
The installer checks Docker and Compose during setup and stops on dependency failures, protecting generated credentials.
Installation and offline updates preserve ownership of host tools, and repository creation errors now surface in the UI.
License state recovery waits for the required migration, and a bound legacy license can be reimported.

Upgrade Notes

Directory sign-in is opt-in and must be enabled in admin configuration before the LDAP / AD login entry appears. Existing local, verification-code, and Lark login are unchanged.
Existing deployments gain a ticket context_refs column and the memory provenance schema automatically on migration; export a fresh configuration backup after upgrading.
Set MOPHEUS_DAEMON_AUTO_RESTART=false before upgrading to keep the daemon from re-execing itself after a binary replacement.

v2.2.10 — 2026-10-10

Highlights

Memory rebuilt on the Open Knowledge Format topology and native BM25 search — Vector embeddings and the knowledge graph are gone. Memories now live in a four-pillar directory layout (runbooks/, facts/, conventions/, docs/), retrieval runs on PostgreSQL BM25 full-text search with English, Chinese, and IT-domain dictionaries, and agent tasks receive a synthesized MEMORY.md navigation index plus direct read access to their memory files. Recall no longer depends on an external embedding provider (#1123).
Memory recall works for real queries — Retrieval falls back from strict AND to ranked OR when a term is missing, tasks with no context tags receive workspace baseline memories instead of nothing, asset-bound and user-bound records stay out of global queries, and reference documents are searchable by default (#1128).
Cluster-wide system cron visibility — Administrators get a console page showing every API instance's system schedules, next run, run state, last result, failure summary, minute-level history, and skip counts, with manual trigger on the current process (#1089).
Job run execution attempts are inspectable — Each job run resolves its attempts dynamically and exposes them through a dedicated API and an Execution Attempts history card with logs, multi-attempt badges, and replay provenance (#1108).
Agent provider failures are classified — Quota, rate-limit, transport, authentication, and token failures surface as stable reasons in chat and the UI while the raw error is preserved (#1109).

Added

Open Knowledge Format memory layout with a synthesized MEMORY.md index injected into agent tasks, plus read-only memory mounts in the sandbox (#1123).
Reference-document ingestion for Markdown and plain text (#1123).
Memory manifest endpoint with ETag negotiation and 304 caching (#1123).
Memory CLI commands: mop memory export, import, retrieve (alias search), get --save, and validate (#1123).
Admin-only system cron page with per-instance runtime health and manual trigger (#1089).
Job run tasks endpoint and Execution Attempts history card in the job run detail view (#1108).
Job trigger label editing with localized cron explanation for standard and Quartz dialects (#1102).
Memory distillation skills gain supersession, a reconciliation matrix, cognitive promotion rules, and a pre-completion quality check (#1125).
Nginx WebSocket proxy configuration documented for self-hosted deployments.
Offline installer packaging refreshes the bundled tool manifest automatically for an explicit version.

Changed

Memory search is served by native PostgreSQL BM25 with compiled IT-domain and Chinese dictionaries; embedding generation and graph traversal are removed (#1123).
Agent failures carry classified reasons alongside the preserved raw error (#1109).
Job run attempts are resolved at query time instead of through a stored task pointer (#1108).
Memory navigation defaults to the tree view; the reference-document upload dialog is bounded to the viewport.
Application fonts are self-hosted; workspace and admin page shells, scrolling, mobile headers, and tab controls are unified.
Ticket scope filters now apply consistently to list and board queries.
Front-end hardcoded translation fallbacks are removed in favour of locale-consistent lookups (#1111).
The release workflow no longer fires the artifact-sync webhook after publishing and notifies WeCom only on failure.

Security

The Linux sandbox masks the current workspace directory, so sibling task directories are no longer visible from inside a task sandbox.
Agent task message content is sanitized of NUL bytes before persistence, preventing database write failures from malformed input.

Fixed

Memory retrieval falls back to ranked OR when a query term is absent (#1128).
Chat and Job tasks with empty context tags receive baseline workspace and initiator memories (#1128).
Global memory queries no longer return asset-bound or user-bound private records (#1128).
mop memory retrieve uses the standard singular --type/-t flag; mop memory list accepts --types and forwards query parameters; CLI table output no longer truncates positive scores (#1128).
Pre-created memory directories match the canonical OKF topology (#1126).
Task recovery no longer deadlocks a runtime: replay runs asynchronously and a report failing three times is quarantined instead of blocking claims.
Antigravity task retries no longer let historical session errors override a successful turn.
The repository cache rejects ambiguous HEAD branch references.
Comment draft attachments no longer leak into the ticket description, and attachment caches invalidate on comment changes (#1114).
Comment submit re-entry is guarded against duplicate posts.
The fullscreen source preview scrolls correctly with aligned line numbers; Perl attachments are previewed with syntax highlighting (#1120).
Unsupported documentation locales, sitemap, and robots routes return 404.
Broken documentation links across English, Chinese, and Japanese content are repaired.
Deleting a configuration file confirms first and removes only the selected file.
Workspace page spacing, ticket detail remounting and route transitions, inbox error boundaries, and environment-variable save state are corrected.

Breaking Changes

The memory knowledge graph is removed: graph APIs, endpoints, and the web graph page are gone, and navigation is directory- and search-based. Migration 144 drops the vector, age, pg_rrf, and pg_tokenizer extensions and the embedding column.
Memory distillation management moved to tickets: use mop ticket list --undistilled and mop ticket mark-distilled. mop memory list filters superseded records by default (#1123).
mop memory retrieve --types is replaced by the standard singular --type / -t (#1128).
Migration 143 drops the stored job run task pointer; use the job run tasks endpoint or the Execution Attempts card to inspect attempts (#1108).

Upgrade Notes

Migrations 142, 143, and 144 run automatically during upgrade.
Custom PostgreSQL images must be rebuilt: the bundled database image preloads only pg_bigm,vchord_bm25 and mounts the compiled IT dictionary. Self-hosted deployments must update shared_preload_libraries, drop the removed extensions, and rebuild against the updated image definition, or memory full-text search will fail.
Migration 144 re-enables superseded environment facts and preferences last updated before 2026-10-09, so previously hidden records reappear in memory listings.
Existing memory embeddings are discarded; recall quality depends on the BM25 indexes built by the migration.

v2.2.9 — 2026-10-03

Highlights

Secure definition revision history with permission gating and secret masking — Revision history now enforces resource permissions and masks envVars in definition revisions so sensitive configuration never leaks through audit views (#1085).
Workdir and filesystem containment in prompt security boundaries — Prompt security now enforces the working directory and filesystem boundaries around prompt execution, closing a known way for prompts to traverse outside the intended runtime sandbox (#1049, #1047).
Agent run history and rich previews — The agent surface gains an in-app run history with rich previews, run-timeline navigation, and a refreshed attachment preview sequence so operators can investigate failures without leaving the surface (#1052).
Unified chat sessions and restful workspace/account settings — Chat sessions converge into a single model with member-session access enforcement, and workspace and account settings share a unified restful route surface for consistent navigation (#1059, #1052).
Standardized MCP transcript badges and event color matrix — MCP transcript rows now carry a consistent badge and event color matrix so multi-protocol conversations are easier to scan (#1052).
Self-built WeCom app callbacks — Operators running a self-hosted WeCom app can configure native app callbacks for agent-driven replies without routing through public connectors (c7eff5c9).
SMTP quick-setup presets in the admin console — The admin console surfaces SMTP quick-setup presets matching the most common transactional providers so operators can finish onboarding in a few clicks (493bb81d).
Qwen ACP usage support and ACP event throttling — Agents now report Qwen ACP usage and the ACP event pipeline throttles inserts, lowering cost and overhead while preserving transcript fidelity (72c555dd, a0093416).
Bundled Pi and opencode CLIs in the installer — The installer now bundles the Pi standalone release and the opencode CLI so workspaces ship with a self-contained default agent-runtime surface (9511bb7e, 37d75ddc).
De-escalated autonomous sub-ticket creation — The runtime prompt and builtin skills no longer encourage autonomous sub-ticket creation; teams opt in explicitly to keep human review in the loop (#1047).
Token-usage recovery and pending usage reporting — Agent tasks recover token usage from session artifacts on abnormal termination, report pending Pi usage, and standardize cancel/retry error codes with trilingual i18n (#1071).
Front-end resilience for storage, locales, and transcripts — Front-end storage isolation continues to harden, browser-locale fallback accepts more candidates, and the agent transcript split layout stays usable on long sessions (#1053).
CLI persistent flag lookup and isolation — The CLI resolves persistent flags through a unified lookup and isolates the test environment, fixing flag-resolution edge cases in scripted flows (#1044).
Nightly GitHub-only workflow with release-sync webhook — Nightly builds now ship via a GitHub-only workflow that publishes to GHCR and triggers the release-sync webhook to Huawei Cloud, with redundant binary aliases pruned (04c3fab4, 92910ad0).

Added

Definition revision history with resource permissions and envVars masking (#1085).
Agent run history with rich previews and run-timeline navigation (#1052).
Unified chat sessions across the workspace (#1059).
Standardized MCP transcript badge and event color matrix (#1052).
Qwen ACP usage support for the agent runtime (72c555dd).
Self-built WeCom app callbacks for agent-driven replies (c7eff5c9).
SMTP quick-setup presets in the admin console (493bb81d).
Bundled Pi standalone release and opencode CLI in the installer (9511bb7e, 37d75ddc).
Pending Pi usage reporting and token-usage recovery on abnormal termination (#1071).
Standardized cancel/retry error codes with trilingual i18n (#1071).
Retry button in the agent transcript dialog for failed and cancelled tasks (#1065).
Antigravity transcript display enrichment with sandbox thinking stream resolution (#1045).
Nightly GitHub-only workflow with GHCR publishing and release-sync webhook (04c3fab4, 92910ad0).
mop skill snapshot aligned to the latest CLI surface.

Changed

Chat sessions unify across the workspace with member-session access enforcement (#1059).
ACP event inserts are throttled to reduce overhead (a0093416).
Prompt security boundaries enforce the working directory and filesystem containment around prompt execution (#1049).
Front-end i18n interpolation uses double curly braces and disambiguates the agent environment save flow (#1077).
Workspace and account settings share a unified restful route surface (#1059).
Trigger event filters and enabled state are restored during job rollback.
Channel cleanup and cron logs are retained on the server side.
Legacy v1 prompt and golden test harness removed; the runtime prompt uses the slim v2 path exclusively (#1049).
Nightly workflow publishes to GHCR and triggers the release-sync webhook to Huawei Cloud, with redundant binary aliases pruned (04c3fab4, 92910ad0).

Fixed

Definition revision history enforces resource permissions and masks envVars (#1085).
Agent task badge only renders when active tasks exist.
Sub-ticket query cache is isolated to prevent continuous loading spin (#1053).
Browser locale fallback accepts more candidates and respects readonly locales.
Front-end inline validation prevents toast blocking on config file path and name.
Job run table uses fixed-width grid columns for consistent layout.
Replay job ownership is validated before execution.
Completed task duration is frozen when the task ends.
Pending Pi usage is reported on completion (5bb3cfd4).
Agent tasks recover token usage from session artifacts on abnormal termination (b9ff8bed).
Historical tokens are not double-counted in RecoverSessionUsage on resumed Claude Code sessions.
Stderr diagnostics are awaited before termination and stderr is retained on incomplete protocol.
Agent transcript split layout is enabled for long sessions.
Retry dialog cancellation no longer dismisses the agent transcript dialog.
Cron and channel log retention is restored server-side.
Attachment preview sequence is refreshed on update.
Task result summaries render in the ticket header.
Inline config-file alert locator is scoped to the inline error message.
Sandbox bwrap capabilities are probed before use.
Human task provenance is preserved across agent handoffs.
Integration back navigation state is preserved.

Security

Definition revision history enforces resource permissions and masks envVars in audit views (#1085).
Prompt security boundaries now enforce workdir and filesystem containment around prompt execution, closing a known way for prompts to traverse outside the intended runtime sandbox (#1049, #1047).
Provider stderr is no longer awaited blindly, preventing the agent runtime from blocking on misbehaving provider streams.

Upgrade Notes

Definition revision history now enforces resource permissions and masks envVars in audit views. Operators that previously relied on raw envVars capture in revisions must review their definition audit policy and update tooling that reads revision payloads (#1085).
Prompt security now enforces workdir and filesystem boundaries around prompt execution. Custom prompts and skills that previously relied on filesystem traversal outside the workspace boundary will be refused at runtime; review prompt and skill definitions for any path access that should be tightened (#1049, #1047).
Nightly builds now ship via a GitHub-only workflow that publishes to GHCR and triggers the release-sync webhook to Huawei Cloud, with redundant binary aliases pruned from the artifact matrix. Operators that previously pulled nightly artifacts from a different registry should update pull sources to the new GHCR path (04c3fab4, 92910ad0).

v2.2.8 — 2026-09-26

Highlights

Asset topology visualization and native Archify integration — Interactive topology explorer with graph projector and native Archify authoring flows. Operators can navigate the asset graph visually, derive service-to-infrastructure paths, and round-trip topology manifests through Archify (#986).
Asset definition revision history and rollback — Workspace-scoped audit history for every asset definition with a comparison view, exact-version query filter, and one-click rollback to a selected revision. Closes the loop on accidental manual edits and supports safe promotion across environments (#1022, #1035, #1036).
Resource guard circuit breakers via cgroup v2 — Active CPU runaway, disk I/O, and PSI circuit breakers plus per-task cgroup containment, procfs fallback for hosts without systemd, and Delegate=yes in unit templates. Daemons now have an enforced blast-radius ceiling for runaway tasks (#1032, commits 032db8/33401a/f5e93f).
Native asset SSH credential resolution — mop ssh resolves authorized assets, accounts, and credentials natively from the workspace asset ontology and integrates with the asset driver for unified SSH dispatch (#995).
Local machine short-circuit for mop ssh — Commands targeting the local machine are detected through machine_id and executed directly without round-tripping the network stack, eliminating the need for users to set up self-loops (#1000).
Asset UI refinements — Topology graph gains wheel zoom, column-based popup docking for node details, broadcast updates across sessions, a guidance empty state for non-logical assets, and an aggregated unassigned-asset view (#1042, #1020, #1025, commits 8878261, #1001).
In-place agent task search and transcript viewer — Search agent tasks by ID, click through to the source chip in conversations, and inspect the full transcript inline without leaving the workspace surface (#1033, #1030).
Sandwich prompt security boundaries and anti-probing defense — New prompt schema isolates untrusted content with explicit scope markers and detects common prompt-probing patterns to keep agent runtimes from leaking credentials or instructions (#1014).
Overhauled Job Schedule trigger UI — Sentence-style trigger copy, native time pickers, abbreviated weekday pills, and clarified Quartz weekday semantics. The editing flow now mirrors how operators describe schedules out loud (#991).
Dynamic feature-flag loading — Feature flags resolve at runtime from the workspace settings page instead of going through the deprecated effective endpoint, removing a redundant round-trip and paving the way for per-user overrides (#977).
Audit-coverage-matrix script — Maintains a machine-readable coverage matrix that maps subsystems to the tests touching them, surfacing blind spots in feature, router, and E2E suites automatically (#980).
Telemetry streaming persistence — In-flight token sampling streams to the daemon and persists telemetry on task termination so cost and usage analytics are accurate even for early-terminated runs (#1037).
CLI pagination metadata — Every paginated CLI command now reports total count, page size, and next/prev cursors, enabling scripted workflows to walk large result sets reliably (commit 2b7cd7).

Added

Asset topology visualization, graph projector, and native Archify integration (#986).
Asset definition revision audit history, comparison view, exact-version query, and one-click rollback (#1022, #1035, #1036).
Resource guard CPU runaway, disk I/O, and PSI circuit breakers via cgroup v2 (commit f5e93f).
Native asset SSH credential resolution and mop ssh driver integration (#995).
Local-machine short-circuit and machine_id validation for mop ssh (#1000).
Topological wheel zoom, column-based popup docking, broadcast updates, guidance empty state, and aggregated unassigned view for assets (#1042, #1020, #1025, #1001).
In-place agent task search by ID and transcript viewer (#1033, #1030).
Sandwich prompt security boundaries and anti-probing defense (#1014).
Job Schedule trigger UI redesign with sentence-style copy, native time picker, and weekday pills (#991).
Dynamic feature-flag loading and removal of the deprecated effective endpoint (#977).
Audit-coverage-matrix script for automated end-to-end gap discovery (#980).
Direct open-ticket button on ticket notifications plus linked-ticket chip on job notifications (#1017, #987).
Failed-task retry action and exposed task action capabilities.
CLI pagination metadata across paginated commands (commit 2b7cd7).
Native cgroup v2 I/O telemetry with procfs fallback and Delegate=yes unit templates (#1032, commits 032db8/33401a).
Database concept schema with SwissQL profile documentation (#1008).
Skill file save preserving supporting files and config on update (#1021).
Tool registration in meta.json with automated navigation check (#1011).
Behavior-focused Go tests for asset subsystems, agent task paths, SSH/daemon/upgrade CLIs, runtime-guard config branches, and destructive ticket branches (#985-#1023).
End-to-end journeys for the asset, shortcuts, and widget feature flags (#988, #989, #990).
Three-tier asset ontology docs, ssh-asset linkage guide, and refreshed mop skill snapshot aligned to CLI v2.2.8.

Changed

Job Schedule UI uses sentence-style trigger copy, native time pickers, and weekday pills (#991).
Feature flags load dynamically from workspace settings; the deprecated effective endpoint was removed (#977).
Agent task history supports search by ID with in-place transcript view (#1033, #1030).
Skill editing requires explicit save and preserves supporting files plus config (#1021).
Archify guided flow uses the term "flow" consistently across locales.
CI workflows gained upload timeouts, retries, and WeCom failure alerts (#998).
Ticket breadcrumbs normalize to the canonical entry; the header uses the pagination total (#1040).
apps/web is upgraded to a current Next and Fumadocs baseline.
Asset topology presentation gains wheel zoom and column-based node popup docking (#1001).
IT asset ontology is documented as a three-tier hierarchy (concepts, predicates, tools) with a new tools suite.
Channel integration honors enablement flags consistently and unifies outbound proxy handling.

Fixed

Topology shows a guidance empty state when the asset set contains non-logical assets (#1042).
Telemetry for agent tasks streams in-flight and persists on termination, including early terminations (#1037).
Unassigned scope excludes downstream infrastructure recursively so only true unassigned assets appear (#1025).
Asset empty-state card no longer shows the placeholder app when there are none, and unassigned assets are aggregated (#1020).
Channel proxy handling, outbound persistence, and enablement are honored across integrations.
Revision audit hooks catch missing definitions and the listing accepts an exact-version filter (#1035, #1036).
Daemon unit templates carry Delegate=yes so cgroup v2 delegation works on systemd-managed deployments (#1032, commit 032db8).
Agent tasks run inside dedicated cgroups and the cgroup launcher closes its FDs deterministically in tests (#1010, commit 33401a).
Reported tool names are capped so a runaway tool cannot overwhelm daemon logs (commit ed977e7).
Job Schedule weekday pills are abbreviated and the preview wording is clarified (commits 0eb53aa/c94344).
Documented tools are registered in the root meta.json and the navigation is verified in CI (#1011).
Workspace FAB children identify consistently across views.
Daemon license handler reuses the pending request id rather than minting a new one.
Channel direct sends are persisted; channel enablement takes precedence over stubs.
The security page lists reserved system breadcrumbs uniformly.

Security

Sandwich prompt enforces content scoping and detects common probing patterns to prevent credential or instruction leakage (#1014).
Frontend storage isolation improvements (carry-over hardening from v2.2.7) remain in effect.

Upgrade Notes

Operators who rely on the deprecated /effective feature-flag endpoint must migrate to reading the workspace settings page directly; the endpoint is removed in v2.2.8.
Asset definitions now have an audit history visible in the workspace UI; reviewers can compare and roll back to any prior version.
Resource guard is now backed by cgroup v2 with Delegate=yes injected into systemd unit templates. Self-hosted deployments on systemd older than v244 should upgrade systemd or run the resource guard in user-only mode.
The runtime_guard and asset feature flags are loaded dynamically; verify they appear in workspace settings before relying on guard breaches or asset topology in production.

v2.2.7 — 2026-09-19

Highlights

IT asset ontology and topology graph — 17 authoritative concepts and 7 canonical predicates with strict JSONSchema attribute validation, weighted Dijkstra and BFS shortest-path solver, multi-hop neighborhood traversal, and a CLI surface (mop asset apply/inspect/resolve/topology/path/concept list|get). Ships with the mopheus-assets builtin skill and trilingual documentation (#515).
JumpServer SSH provider — First SSH provider with mop ssh list|exec|upload. Resolves authorized assets and accounts before connecting, supports connection users, scripts, environment variables, private-key and Connection Token authentication, JumpServer node-tree caching, and SFTP upload via KoKo (#964).
Grouped runtime configuration templates — Runtime config files are modelled as CLI groups owning one or more files. The mes-cli group now exposes both ~/.mes/config.yaml and the sensitive ~/.mes/token.env with encrypted storage. Adds mop user config-file render|get|delete and grouped Web UI rendering (#950).
Channel installation messaging and skill — New mop channel install, bind, chat, and send flows with installation-aware agent authorization, outbound persistence, the mopheus-channel-messaging builtin skill, and E2E coverage.
Channel retention cleanup — New channel_retention cron-driven cleanup endpoint plus repository and service plumbing to purge stale outbound records and orphaned installation state (#934-adjacent).
Daemon session-inherited breakpoint resumption — Adds original_agent_task_id lineage, Tier 1 orphan attempt resumption, Tier 2 multi-hop ancestor session inheritance, Antigravity conversation persistence into workspace provider-state, and structured retry prompt guidance (#936).
Swagger API documentation — Documented HTTP endpoints with generated Swagger assets, optional Swagger UI, Bearer auth metadata, and centralized environment parsing across runtime configuration.
Asset and runtime-guard feature flags in workspace settings — Adds the missing asset (IT Asset Ontology) and runtime_guard (Runtime Task Guard) flags to workspace features, renames widget to "Ticket Widgets", and orders features alphabetically to match the Admin Site (#970).
Hardened frontend storage — Survives browsers and embedding contexts where localStorage or sessionStorage are denied, read-only, or exhausted (#961).
WeCom release notifications — The release workflow now posts a success message to WeCom when the configured webhook secret is set.
Asset topology explorer agent skill — mopheus-assets lets agents query, resolve, and navigate enterprise asset topologies for incident response and blast-radius analysis.

Added

IT asset ontology, topology graph, and concept validation (#515).
mop asset command suite: apply, inspect, resolve, topology, path, and concept list|get.
IT asset documentation in English, Simplified Chinese, and Japanese with an Excel asset ledger template.
JumpServer SSH provider with mop ssh list|exec|upload and engineering documentation (#964).
Grouped runtime configuration templates with nested Files entries and the mes-cli/token.env sensitive template (#950).
Channel installation messaging, binding CLI flows, outbound persistence, and the mopheus-channel-messaging builtin skill.
Channel retention cleanup cron job, repository support, and workspace-scoped retention configuration.
Daemon session-inherited breakpoint resumption with retry lineage and Antigravity conversation persistence (#936).
Swagger docs and env config with optional Swagger UI integration.
asset and runtime_guard feature flags in workspace settings and the useFeatureFlags hook (#970).
runtimeGuard and asset flags alongside the existing widget and memory flags.
DingTalk integration screenshots and refreshed setup guide.
BSD-sed-compatible online CLI install scripts.
Lark audio-message download fix and media download lifecycle logging for DingTalk and WeCom.
Workspace feature-flag ordering in Admin Site and Workspace Settings to match the canonical list.
Config-file submenus and SkillFileTree directory-node file creation controls in the Web UI.

Changed

Outbound channel delivery hardened with retry semantics, key/reason registries, and scope enforcement across all integrations (#911 follow-ups).
Channel installation store retains user-profile snapshots across binding-token rotations and rebinds.
mop profile and config files are resolved from a global baseline plus per-workspace overrides; templates are now server-owned.
mop channel CLI gains install, bind, chat, and send subcommands with installation-aware agent-task authorization.
Frontend storage falls back to in-memory state when localStorage or sessionStorage are unavailable, read-only, or exhausted (#961).
Runtime picker dropdown hides disabled and unusable runtimes (#926).
Web admin settings and workspace settings now show asset, git, memory, runtime_guard, shortcuts, and widget features in a canonical order.
Skill search uses a CJK-friendly multi-keyword builder; ticket list context menu and detail actions use a slimmer layout.
Provider session sources and task-history metadata propagate via the canonical session record and dedupe assistant messages.

Fixed

secretredact masks Bearer, Basic, and Token values in sensitive assignments while preserving the authentication scheme.
Channel install rebinds preserve user profiles across binding-token rotations (fix(integrations) series).
Channel media gates no longer block retryable delivery and respect agent execution scope.
Front-end storage no longer crashes in private browsing or sandboxed embedding contexts (#961).
Tiptap preserves fenced code blocks inside nested list items (#941).
Comment trigger preview is silent when no agent is triggered and no named blocked targets exist; agent chips render with source attribution and click-to-skip/click-to-restore hints (#934).
Comment team-leader unavailable reason only emits when the assignee is a team.
Daemon task-token check no longer inverts on E2E host environments (#928).
Daemon sandbox creds, profile-recovery records, and Antigravity runtime sandbox isolation now share consistent boundary handling.
Ticketing: child tickets are unlinked (parent_ticket_id = NULL) on parent ticket deletion within the deletion transaction (#942).
Agent task retry preserves trigger-comment fields and lineage.
Workspace deletion cascades RBAC data and cleans user_role / team_member rows.
Cron scheduler shutdown is hardened against double close; private binds are unified with the scheduling loop.
Config-file save failures surface localized fallback messages in the frontend.
mopheus channel CLI install messages align with the Web UI installation wizard.
Antigravity streaming text deltas aggregate at step boundaries to reduce overhead (#896 follow-up).
mop user config-file templates correctly displays grouped templates and individual file paths.

Security

Bearer, Basic, and Token credentials in env-var-style assignments are masked while keeping the authentication scheme visible.
Integration audit table no longer leaks sensitive labels.

v2.2.6 — 2026-09-12

Highlights

Google Antigravity CLI provider — Native runtime support for the agy CLI with auto-detection, stream-json pipeline, live transcript streaming, conversation resumption via --conversation <id>, and next-turn steering, hardened by runtime sandbox isolation and step-boundary streaming aggregation (#874, #894, #896).
Interactive decision widgets for tickets — Single-select, multi-select, and confirm-action widgets in ticket comments and timelines with optimistic concurrency locks, audit log, workspace feature flag, the mopheus-ticket-widgets builtin skill, and a slim-prompt micro-spec (#860, #907).
Workspace-scoped user profiles — Environment variables and configuration files are isolated per workspace with encrypted values, server-owned templates, binary previews, and the mopheus user env / mopheus user config-file CLI surface (#901, #885).
Filesystem sandbox enabled by default — The daemon now activates the filesystem sandbox unless explicitly opted out via MOPHEUS_DAEMON_SANDBOX=false|0|off; the new policy survives restarts and is covered by regression tests (#906, #843).
Quartz schedule triggers for jobs — Add cron_dialect=quartz triggers with ? day-of-month/day-of-week semantics, optional startAt/expiresAt boundaries, an interactive schedule editor with future-run previews, and dialect-aware CLI help (#884).
Credential and auth redaction — Agent output redacts embedded credentials, auth environment values are masked before logging, and the integration audit table no longer leaks sensitive labels (security hardening series).
Channel async outbound delivery and scope enforcement — Channels ship messages asynchronously through a centralized lifecycle flow, drop non-retryable media gates, and enforce agent execution scope (#911, channel refactors).
Retained worktree registry — mopheus repo worktree list|prune reconciles bare-repo sidecar metadata, supports per-workspace and per-ticket selectors, and safely reuses or evicts worktrees with dirty/unpushed detection (#905).
Comment trigger previews and label-driven UX — Tickets expose live comment trigger previews, render the ticket creator and creation timestamp below the title, and standardize the My Tickets filter on a shared canonical constant set (#909, #923, #921).
Structured inbox cards for automated runs — Automated job-run and agent-task failure notifications now ship structured cards with quick actions and a direct transcript link (#868, #840).

Added

Antigravity CLI provider with stream-json pipeline, transcript streaming, conversation resumption, and agy brand logo in the provider picker (#874).
Interactive decision widgets with optimistic state, audit log, React components, multilingual localization, and a mopheus-ticket-widgets builtin skill (#860).
Workspace-scoped user environment variables and configuration files with encrypted storage, server-owned templates, and binary read-only previews (#901).
Quartz schedule triggers, multi-select schedule editor, future-run preview API, and locale-aware humanized schedule text (#884).
Retained worktree registry CLI plus local daemon list/prune endpoints with workspace scope (#905).
Async outbound channel delivery with a centralized lifecycle outbound flow.
Comment trigger previews in ticket timelines (#909).
--label and --labels flags on mop ticket create and mop ticket update (#918).
mop chat channel list to inspect channel bindings and provider scoping.
mop feature list and mop feature check commands plus a read-only mop profile family (list, show) (#858 and follow-up).
mop daemon upgrade flow with manifest-driven atomic reinstall.
Workspace-scoped email configuration and dispatch delegation plus an attachment-limit summary in workspace settings.
Job run notification cards with structured details and a direct link to the originating run (#868).
Agent task failure notifications with a "view transcript" action and listing of failed runs in the inbox (#840).
Ticket creator display name and creation timestamp rendered below the title (#923).
Agent avatars in the web agent list.
Topic session-id copy button in chat.
Long chat message input on the CLI; agent chat routing for sessions with provider-aware selection.
Decision widget micro-spec inlined in the slim prompt and the mopheus-ticket-widgets skill reference (#907).
Sandbox mount plan fix and explicit daemon sandbox opt-out values (#843, #906).
Sandbox credential isolation, profile recovery isolation, and Antigravity runtime sandbox isolation (#894).
Subscription propagation for provider session IDs and persistence across restarts (#885).
My Tickets default-to-all-scope toggle and canonical filter constants (#921).
Scoped user shortcut commands, Pi provider RPC migration, and the Antigravity brand logo.
CLI job create --cron-dialect quartz with start-at and expires-at boundaries.
Chinese ChatOps integration blog guide for Mopheus Chat and Event Jobs.
Provider integration guide and Antigravity provider documentation in EN/ZH/JA.
Security boundaries guide in the project documentation.

Changed

Daemon defaults the filesystem sandbox to enabled; only an explicit environment opt-out disables it (#906).
Inbox notifications rearchitected around an orthogonal toolbar with unarchive and scoped batch actions; automated job-run and agent-task failures now ship structured cards with quick actions (#868, #840).
Channel outbound delivery is asynchronous with centralized key/reason registries; agent execution scope is enforced and non-retryable media gates are dropped (#911).
mop profiles and config files resolve a global baseline plus workspace overrides by path; templates come from the server instead of client-side hard-coding (#901).
Daemon worker tasks persist their state across restarts, defer Claude cache cleanup, and isolate sandbox credentials and profile recovery records.
Skill search uses a CJK-friendly multi-term builder; ticket list context menu and detail actions use a streamlined layout (#900).
Agent-builder wizard supports conversational AI agent creation with bundled prompt templates; workspace onboarding remains a 7-step flow with idempotent re-runs.
Provider session source and task history metadata now flow through the canonical session record for assistant-message dedup.
Workspace files hub preference for grid/table view is persisted across navigation.
Provider workspace state is isolated per agent so MCP usage tracking stays per-tenant.
Antigravity streaming text deltas aggregate at step boundaries to reduce overhead (#896).
Antigravity runtime preserves the native HOME under sandbox and recovers fresh sessions on stream interrupt.

Fixed

Agent output redacts embedded credentials; auth environment values are masked before logging (fix(security) series).
Integration audit table no longer leaks sensitive labels.
Channel media gates no longer block retryable deliveries and respect agent execution scope (#911).
Channel session source metadata is consistently recorded across the canonical session record.
Ticket discussion timeline supports quote replies and a unified activity history.
Mobile job dialog scrolls correctly inside the Mopheus shell.
Job assignees are isolated by workspace so cross-workspace triggers cannot fire.
Job cron expressions with empty cron fields now use Quartz-compatible wildcards so schedules never stall.
Comment IDs round-trip through widget choices so the floating submission bar preserves user state.
Failed agent task runs surface in the inbox with a transcript action instead of being hidden (#840).
Quick stop button is restored on the ticket execution run row.
Onboarding wizard no longer leaves the body with stuck pointer-events after skipping (#846).
Antigravity streaming interruptions preserve completed turns and recover with a fresh session.
Pi provider resumes sessions via RPC with capability checks (#887).
Antigravity runtime captures premature exits and preserves the native HOME under sandbox.
Workspace teardown cleanly removes worktree sidecars and CodeGraph snapshots.
Workspace sandbox settings survive background daemon restarts and explicit opt-out values (#906).
Sandbox credentials are isolated from the host; profile recovery records are isolated per workspace.

Security

Filesystem sandbox enabled by default for the daemon (#906).
Agent output redacts embedded credentials; auth environment values are masked in logs and audit tables (fix(security) series).
Sandbox credentials, profile recovery records, and Antigravity runtime state are isolated from the host.
Provider workspace state is partitioned per agent so cross-workspace data does not leak through provider caches.

Upgrade Notes

The daemon now enables the filesystem sandbox by default. Operators that previously disabled it via environment must explicitly set MOPHEUS_DAEMON_SANDBOX=false (or 0/off, case-insensitive) on the daemon process; otherwise sandboxing stays on and matches the new default.
Workspace-scoped user environment variables and configuration files require the schema bump introduced in this release. Pre-existing global profiles remain the baseline; new workspace overrides take effect after migration.
Quartz schedule triggers are opt-in per trigger. Existing Standard five-field triggers continue to use the legacy grammar; reverting a migration is refused while Quartz rows exist to keep persisted expressions readable.
Interactive decision widgets require the widget workspace feature flag; comments degrade to standard syntax-highlighted code blocks when the flag is disabled or unset.
Antigravity CLI is required at agy (or MOPHEUS_ANTIGRAVITY_PATH) to use the new provider; the CLI must be invokable with --input-format stream-json --output-format stream-json --dangerously-skip-permissions.

v2.2.5 — 2026-09-05

Highlights

Event-driven jobs with causal loop containment — Jobs subscribe to internal events (comment.created, ticket.created, …) with structured filters. A causal ancestor graph prevents recursive trigger loops, and event payloads now expose self-describing enum names, ticket context, and ticketPriority for accurate routing (#795, #805, #806, #811, #813, #814, #817, #808, #809).
Subagent lineage and lifecycle tracking — Subagent runs persist parent lineage, Claude subagents track lifecycle transitions, and the scheduler coordinates subagent final results. Provider workspace state is isolated per agent, and Codex MCP calls are recorded alongside Claude usage (#767, #803, #828, #830).
mop CLI skill and release sync workflow — A new mop CLI skill ships with the release sync workflow so agents scaffold PRs, sync release artifacts, and discover model enums without bespoke scripts; using-codegraph now mandates a worktree prerequisite and ships MCP-compatible guides (#616/#820, #746).
File attachment access control and isolation — Attachments enforce workspace-scoped CanView/CanEdit/CanDelete capabilities in queries and storage paths, with origin labels that include the parent ticket identifier and short ID (#730/#734, #731/#733).
Short ticket identifiers — Tickets expose a stable short ID alongside the UUID, mirrored across CLI, web, and mop outputs (#818).
Topic lifecycle management — A first-class topic lifecycle API lets workspaces archive, restore, and clean up topics with audit-friendly state transitions (#824).
User SSH config management — Members register SSH config files delivered into sandbox tasks via the runtime config file pipeline, with native OpenSSH composition (#740).
Skill invocations and synthesis — Every skill invocation is recorded for auditability, distilled memories can be synthesized into reusable skills, and a daily-usage rollup powers workspace analytics (#737, #754, #822).
Daemon telemetry, snapshots, and worker recovery — Daemons collect per-task resource telemetry, emit durable worker completion snapshots, and filter recovery by workspace so a restart never picks up a foreign runtime (#766, #776, #786).
Release artifacts on Huawei OBS — Release images and license notices publish to Huawei OBS, accelerating installs in mainland China regions.
Standardized workspace UI — Workspace list, header, integrations settings, brand icons, and confirmation dialogs follow a unified card container layout with inline page headers, batch actions, platform-sectioned integrations, and delete/archive dialogs with explicit consequence warnings (#741, #758, #761, #791).

Added

Internal event triggers with causal loop containment; runtime attaches causal ancestor context and grants event broadcasts (#795, #814).
Event payloads enriched with ticketId, shortId, workspaceSlug, ticketPriority, and self-describing enum *Name companions (#805, #806, #817).
Job triggers tab visualizes event filter rules; manual trigger disabled for event jobs (#808, #809).
Subagent lineage table, Claude subagent lifecycle tracking, subagent turn coordination, provider workspace state isolation, and Codex MCP call recording (#767, #803, #828, #830).
Immediate agent interaction steering (#788).
Short ticket identifier column, API, CLI, and mop integration (#818).
Topic lifecycle management endpoints and audit hooks (#824).
Attachment access control + visibility isolation; attachment origin display carries ticket ID and short ID (#730/#734, #731/#733).
Skill invocation tracking table, daily skill usage analytics, and memory-to-skill synthesis (#737, #754, #822).
mop CLI skill, mop_ticket helper scripts, model enum references, and release-sync workflow (#616/#820).
using-codegraph skill worktree prerequisite and MCP compatibility (#746).
User SSH config registration with cli_type-aware delivery (#740).
Daemon durable task resource telemetry plus /profile endpoint and worker completion snapshots (#776, #786).
End-to-end agent task duration in job execution history; redesigned layout with real-time sync (#735, #736).
Workspace card container, inline page headers, batch actions, platform-sectioned integrations settings, unified brand icons, and AlertDialog-based delete/archive flows (#741, #758, #761, #791).
runtime guard explain forensics CLI and extended runtime_guard_event columns.
Custom CLI upgrade manifest, forced upgrade metadata, and atomic CLI reinstall.
Unified CI build timestamps; nightly Beijing 06:00 build.
License invitation re-issue and seat reshuffle across workspaces.

Changed

Job actor carries ancestor job IDs and origin_user_id to prevent recursive triggers and keep audit trails accurate (#813).
Event broadcasts unified into a single workspace event hub; HTTP handlers fan out through one broadcaster.
Channel session source and task history metadata propagate through the canonical session record.
Skill search switched to a CJK-friendly multi-term builder with longer name columns.
Agent-builder wizard supports conversational AI agent creation with bundled prompt templates (#616).
Wizard onboarding remains a 7-step flow with bilingual demo seeds, "skip permanently" preference, and idempotent re-runs.
Inbox and ticket actions consume backend-stamped CanEdit/CanDelete viewer capabilities (#607).
Daemon scheduler coordinates subagent final results and preserves the final result after checks.
Job execution history refreshes from websocket events so external state stays consistent without polling.
Workspace files hub preference for grid/table view is persisted across navigation.
Provider session source and task history metadata participate in assistant-message dedup.
runtime guard explain output canonicalized to English with i18n dictionaries for the web UI.

Fixed

Codex usage split by model; Codex stdout usage reporting surfaces in dashboards.
Subagent message parent preserved; subthread messages filtered safely; subagent names propagated into agent-task titles.
Lark channel task replies restored after the new session record schema.
Webhook dedup conflict absorbed via ON CONFLICT DO UPDATE (#799/#800).
Merged comment count includes the trigger; empty merged comments hidden; merged comments collapse.
Browser auth uses cookies consistently; locale cookie and active language state stay in sync across hydration and settings (#727).
Transcript search and escape shortcuts no longer leak to the ticket page (#725).
ActorAvatar no longer renders UUID initials; ActorPicker carries the display name (#759).
Daemon recovery filters by workspace so unrelated runtimes do not surface (#766).
Scheduler preserves the final result after lifecycle checks, recovers preparation panics, parses lifecycle check responses, and preserves timeout after protocol close.
Install path: runtime environment probe runs at install time; online CLI preparation supported; Windows install path no longer leaks the temp env; offline Docker paths documented.
CLI upgrade reinstall is atomic and respects a custom upgrade manifest; forced upgrade metadata flows through.
WebSocket subscribers refresh on resource mutations (#712).
Refresh runtime resource counts and the daemon health port after a websocket reconnect.
Duplicate migrations are idempotent; make migrate-up after a partial apply no longer trips a duplicate-key error.
Dashboard surfaces failed task counts alongside successful ones; empty from/to date parameters render as all-time usage (#771).
Kimi stderr error codes preserved in provider session responses.
Daemon report batches preserved when the daemon response drops mid-upload.
Origin user context preserved across agent task dispatches (#691).
Ticket dependency target tickets load individually via useTicket; perspective grouping and terminology aligned.
Ticket backend ZIP export and comment resolution contracts deprecation notice surfaced in the web UI (#802).
Skill subcommand mop_ticket add-comment invokes the correct subcommand; trailing whitespace in skill scripts removed.
Trigger filters persist across reloads and guard unload.
Hardened task lifecycle and scope checks across the runtime.
Wizard onboarding skip-existing-agent migration applied so disabling onboarding cannot bypass the safety check.
Skip flaky TestCreateWorktree_CodeGraphProvisioningAndExclude when CodeGraph is not installed.
Restore ticket comment follow-up after the daemon-task scheduler deferral.
Order terminal report replay deterministically; preserve terminal completion result across restarts.

Security

Workspace events fan out through a single broadcaster that enforces origin_user_id and causal ancestor checks; jobs cannot subscribe to events outside their workspace scope.
origin_user_id recorded on every agent_task row even when initiated outside a workspace membership, so audit trails capture cross-scope actions.
Attachment access control enforces CanView/CanEdit/CanDelete in every query path; storage paths are workspace-scoped.
Webhook dedup uses an atomic upsert to prevent lost or duplicated audit records (#799/#800).

Upgrade Notes

Apply database migrations before starting the new server. Migrations 118+ cover the event trigger registry, causal ancestor IDs, ticket short identifiers, topic lifecycle, attachment access control, skill invocations, daily usage analytics, daemon worker snapshots, user SSH config metadata, and runtime_guard_event columns.
Review existing jobs subscribed to comment.created: the payload now includes ticketId, workspaceSlug, and ticketPriority — adjust trigger expressions accordingly.
Daemon upgrades should redeploy the latest mopheusd image; Linux daemons pick up the new durable task resource telemetry profile endpoint and worker completion snapshots on first heartbeat.
Release artifacts publish to Huawei OBS; installation tooling now expects the OBS-backed image tags. Update local install/env.example overrides accordingly.
Workspaces that customize attachment permissions should re-confirm CanView/CanEdit/CanDelete after migration; default capability checks now apply at the repo layer.
The mop CLI skill is enabled by default for new workspaces; existing workspaces can opt in from the skill store.
Daemon recovery now filters by workspace; ensure runtime registrations live in the expected workspace before restart.

v2.2.4 — 2026-08-29

Highlights

CodeGraph intelligence for coding agents — Coding agents on registered repositories ship with the using-codegraph skill, commit-bound sidecar SQLite snapshot caches, and incremental re-indexing during worktree provisioning (#675).
Workspace files hub — A new /[workspace]/files page consolidates every attachment across tickets, comments, and chat sessions with full-text search, category filters, grid/table views, and a universal previewer for images, PDFs, Markdown, source code, and CSV (#713).
Japanese localization — The full product UI ships with Japanese (ja) translations alongside English and Simplified Chinese, including the new files hub and agent-task controls (#706).
Runtime task resource guard and circuit breaker — Linux daemons collect per-task RSS, per-runtime totals, process counts, and full process-tree metrics via rootless cgroup v2 + procfs sampling. A 3-tier cascade merges guard thresholds; over-budget warnings ramp into kill. Every kill/warning streams structured diagnostics to the control plane, persisted in runtime_guard_event (#694, #702, #710).
Direct ticket-level Grill Me review — Trigger a 10-round self-reflective review against a ticket's title and description from the ticket header or actions menu — no comment needed (#624, #642, #620).
Personal runtime configuration files — Each user can register custom configuration files (e.g. ~/.mopheus/*.toml) which are delivered into sandbox tasks with CLI-type aware attachment, managed Ed25519/RSA SSH keys, and user-first native OpenSSH composition (#685).
Non-root daemon container (UID 10001) — mopheusd runs as the mopheus user inside the container with the matching host UID, enabling rootless cgroup v2 hierarchies (#633).
User account status controls — Workspace admins can enable or disable individual accounts; disabled users are blocked from authentication and excluded from license quota counting (#705).
Batch ticket operations — A new ticket action bar lets operators archive, assign, re-prioritize, or move many tickets at once, mirrored in mopheus ticket CLI subcommands (#653).
Backend ZIP export of ticket run data — Tickets expose a backend ZIP export of all comment threads, agent task runs, and intermediate artifacts for offline review (#667).

Added

CodeGraph sidecar snapshot cache at .codegraph-cache/<sha>.db with automatic incremental codegraph sync during worktree creation (#675).
mopheus attachment list CLI and useFilesViewStore view-mode persistence (#713).
user_config_file table and settings UI for personal sandbox runtime configuration files, managed SSH keys, and user-first OpenSSH composition, with cli_type-aware delivery.
runtime_guard_event audit table with full forensics plus mopheus runtime guard events|explain CLI (#710).
usage_agent_task_report durable receipts and usage snapshot dedupe so daemon usage reports are safe to retry.
agent_task_interaction table and broadcaster for websocket comment sync (#623).
is_griller capability on agents for Griller specialization (#620).
Tickets updates-time sorting and start-date sorting.
user.enabled column with admin enable/disable controls (#705).
Workspace-scoped user env vars at profile scope (#669).
Interactive daemon task scheduler with batch claim across runtimes (#674).
Memory hit-count with BIGINT saturation clamp (#688).
Attachment pg_bigm GIN index with CJK multi-term search.
Bulk archive/restore/delete in the inbox with explicit "delete all" confirmation (#662).
CLI --action-type flag for mopheus job update and mop install-time shortcut alias.
Mopheus and CodeGraph OSS license notices packaged into release artifacts (#676).

Changed

License invitation flow supports re-issue and seat reshuffle across workspaces.
Inbox and ticket actions consume backend-stamped CanEdit/CanDelete viewer capabilities (#607).
Agent-builder wizard supports conversational AI agent creation with bundled prompt templates (#616).
Skill search switched to a CJK-friendly multi-term builder with longer name columns.
Wizard onboarding remains a 7-step flow with bilingual demo seeds, "skip permanently" preference, and idempotent re-runs.
Channel session source and task history metadata carry through to the canonical session record (#623).
Jobs list refreshes from websocket events so external task state stays consistent without polling.
Workspace files hub preference for grid/table view is persisted across navigation.
Provider session source and task history metadata participate in assistant-message dedup so the same output is never re-emitted across agents.

Fixed

Return nil from memory task recall when the context candidate set is empty so prompts do not get a spurious "memory" attribution (#721).
Reject non-ASCII workspace slugs with a clear validation message (#715).
Show generated admin credentials in the install summary (#715).
Refresh resource mutations across all websocket subscribers; ticket updates propagate without a manual reload (#712).
Refresh runtime resource counts and the daemon health port after a websocket reconnect.
Make duplicate migrations idempotent so re-running make migrate-up after a partial apply no longer trips a duplicate-key error.
Surface failed task counts in the dashboard alongside successful ones for accurate usage diffing.
Restore server-side sorting for paginated ticket lists (#660).
Preserve Kimi stderr error codes in provider session responses (#665).
Bound durable event payload sizes for agent_task so a runaway stdout cannot stall the daemon runner.
Preserve the daemon's bound health port when starting tasks.
Restore runtimes after a websocket disconnect so daemons recover gracefully.
Preserve origin user context across agent task dispatches (#691).
Preserve daemon report batches even when the daemon's response drops mid-upload.
Skip flaky TestCreateWorktree_CodeGraphProvisioningAndExclude when CodeGraph is not installed.
Restore ticket comment follow-up after the daemon-task scheduler deferral.
Order terminal report replay deterministically and preserve terminal completion result across restarts.

Security

Workspace files hub enforces the existing Attachment viewer capability and reuses workspace scoping for every query.
Runtime guard alarm and kill events stream to a server-side audit table with dedicated forensic CLI commands.
origin_user_id is recorded on every agent_task row even when initiated outside a workspace membership, so audit trails capture cross-scope actions.
Wizard onboarding routes the skip-permanently preference through the new "skip existing agent" migration so disabling onboarding cannot bypass the safety check.

Upgrade Notes

Apply the database migrations before starting the new server. This release includes migrations 106–117 for griller agent flag, agent-task interaction history, usage snapshot dedupe, durable usage receipts, agent-task origin user, pending-task indexes, skill name length, user config files, runtime guard audit, user config CLI type, agent-task job-run index, memory recall hit count, user account status, attachment pg_bigm search index, and sensitive SSH config metadata.
Linux daemons should be redeployed as the mopheus user (UID 10001) to take advantage of rootless cgroup v2 and the full process-tree guard. Existing root daemons keep working but should be migrated promptly.
Existing workspaces can register personal runtime configuration files under User Settings → Runtime Config Files; CLI-type-aware delivery is automatic from the next task schedule.
Daemons running on Linux now report runtime guard diagnostics by default. Use mopheus runtime guard events and mopheus runtime guard explain <task-id> for post-mortem forensics.
New user account status controls let admins disable individual accounts; legacy accounts default to enabled. Disabled users cannot authenticate and are excluded from license quota counting.

v2.2.3 — 2026-08-22

Highlights

Daemon claim transport encryption — Daemon↔server claim traffic is now sealed end-to-end with per-runtime X25519 keys (issue #556). Each daemon persists its key in a dedicated keystore, the server validates the key on registration/heartbeat, and plaintext claim fallback is gated by a dual test plan with a warn-and-self-heal path.
Workspace onboarding wizard — A redesigned 7-quest onboarding flow ships with bilingual demo seeds, an opt-in demo data switch for migrations, and a "skip permanently" preference so existing workspaces do not see onboarding again. Memory distillation is enabled by default as part of the new flow.
Skill shortcuts capability — Turn rich skills into one-click executable actions callable directly from ticket headers, with a workspace-level capability toggle and explicit descriptions on the shortcuts UI (#542, #571).
Agent environment-variable encryption at rest — Agent env vars are now stored with a per-value ENC1 scheme, keeping the workspace key separate from the encrypted blobs while preserving live reads (#554).
Daemon task recovery after shutdown — Interrupting a daemon mid-task no longer strands work: the new recovery flow restores in-flight tasks on next startup, paired with refined systemctl and ownership handling during install (#585, #581).
More capable CLI surface — mopheus email send subcommand, chat message listing with cursor paging, structured nextBefore output on ticket/repo/chat commands, list pagination info, and a hard refusal to run the daemon as root by default (#547, #559, #560).

Added

Per-profile daemon install and systemctl-managed lifecycle with stream-decompressed image loading to avoid double compression.
Skill labels, workspace bundle support, and a new shortcuts feature flag.
Cross-ticket comment control and refactored workspace middleware for the agent task surface.
mopheus email send subcommand and chat message list with cursor paging.
Workspace deleted event notifies connected clients immediately.
Default agent-task timeout raised from 2h to 24h, with previous values preserved for restoration.
Distinguishing visual treatment for unconfigured values on the system config page.
Skill shortcut capability enabled by default and usable from the ticket header.
Agent-task parent wake table with deferred wakes, traces, and deduped resumptions when subtickets move between states.
Rich-text attachment preview with a source toggle (#576).

Changed

Daemon claim key package moved under a dedicated claimkey/claimcrypto path with explicit fallback and warn-and-self-heal coverage (#591, #588).
Channel session source and task history metadata are now part of the canonical session record.
Provider runtime, comment follow-up, and ACP hardening folded into the new line-protocol runner so providers share one lifecycle (#559).
Ticket dependency can be marked enforced so incomplete predecessors block assignment and status changes.
Workspace onboarding quest flow redrawn to seven steps with bilingual demo seeds and skip-permanently preference.

Security

Daemon claim transport encrypted end-to-end with X25519 + per-runtime keys; legacy plaintext mode remains for the migration window (#556, #580).
Agent env vars encrypted at rest using the ENC1 per-value scheme; key material stays out of the database row.
DingTalk binding restricted to agent owners; the previous cross-owner flow is closed.

Upgrade Notes

Apply the database migrations before starting the new server. This release includes migrations 099–105 for skill shortcuts, agent-task timeout default, daemon public-key column, workspace onboarding, memory feature default-on, agent-task parent wake, and skip-existing-agent onboarding.
Existing daemons must re-register (or wait for the next heartbeat) so they generate and persist their X25519 claim key; daemons without a public key continue to operate in legacy plaintext claim mode until they do.
The default agent_task_timeout is now 24h. Custom values are backed up to agent_task_timeout_previous automatically; restore them after the migration if the old behavior was intentional.
Run the daemon as a non-root user — the CLI now refuses root execution unless MOPHEUS_ALLOW_ROOT=1 is set.
Workspace onboarding is enabled by default; existing workspaces are marked as already-onboarded so they skip the new flow automatically.

v2.2.2 — 2026-08-15

Highlights

DingTalk channel integration — Connect DingTalk Stream bots end to end, including Stream connection mode, QR code account binding, interactive Markdown and card rendering, inbound/outbound media handling, and AES-256 secret lifecycle management.
Agent filesystem sandbox — Protect host environments on Linux using Bubblewrap (bwrap) filesystem isolation, confining agent execution to its workspace and temporary directory while preventing host and cross-workspace leakage.
Private S3 storage & presigned URLs — Support private S3-compatible buckets via SigV4 presigned URLs (s3_private), ensuring secure attachment and media asset delivery without public bucket permissions.
Ticket scheduled activation & due reminders — Schedule tickets for future activation with automatic transition to in-progress status, and track due dates with automated background reminder processing.
Template system foundation — Platform-level schema and multilingual catalog for reusable workspace, group, agent, team, and skill templates.

Added

Unbind and clear runtime assignments from agents in both UI and API.
DingTalk bot integration settings in admin configuration, /dingtalk/bind authorization flow, and channel badges.
Configurable s3_private storage mode for presigned URL delivery and private cache headers.
Ticket scheduled activation (activate_at) and due date reminder tracking with automatic background dispatch.
Push ticket updates to external channels formatted with ticket titles and clickable references.
Schema, category definitions, and multilingual translations for workspace and entity templates.

Changed

Channel architecture unified across Lark, WeCom, and DingTalk, separating outbound content rendering from transport delivery.
Team member management allows promoting and removing members by either agent ID or member ID.
Daemon dynamic health ports are persisted and refreshed reliably during daemon startup.
Optional login methods in web UI are hidden by default when unconfigured.
Centralized workspace context binding across backend HTTP routes.

Fixed

Cross-workspace agent ticket assignments are rejected to prevent cross-tenant access.
Interrupted channel media tasks are canceled cleanly to avoid stalled worker routines.
DingTalk Stream connections tolerate network disconnects gracefully during acknowledgment.
CLI ticket dependency removal uses the correct API endpoint.
System comments and cross-ticket task relationships are identified accurately.
Real-time ticket boards refresh immediately on ticket status changes via WebSocket events.
Test suites isolated from user ~/.config and HOME directories with improved execution speed.

Security

Agent filesystem visibility sandbox (bwrap) prevents unauthorized host filesystem access and workspace crossing.
Cross-workspace authorization enforced on agent ticket assignment boundaries.
DingTalk bot secrets encrypted at rest with AES-256 and seamless key rotation support.

Upgrade Notes

Apply database migrations before starting the updated server. This release includes migrations 094–098 for DingTalk channel support, private S3 configuration, ticket timing/reminders, template system schema, and ticket activation requester auditing.
To enable the Linux agent filesystem sandbox, install bubblewrap (bwrap) on host runtime machines and set MOPHEUS_SANDBOX_ENABLED=true.
For private S3 bucket deployments, enable s3_private in platform configuration so attachment downloads automatically use SigV4 presigned URLs.

v2.2.1 — 2026-08-12

Highlights

WeCom smart-bot integration — Connect WeCom bots end to end, including onboarding, identity and session binding, inbound media, outbound ticket and task updates, and bilingual administration and product documentation.
Traceable and deferred agent work — Comment-triggered tasks coalesce follow-ups, tasks can wait in a deferred state until attachments are ready, and ticket details include an interactive task-flow view for comments, delegation, downstream tickets, and task status.
Domain-aware memory distillation — Distillation supports automatic, general-only, and specialty modes, records effective skills for audit, exposes generic memory type names, and makes forced re-distillation atomic.
Stronger Agent administration — Workspace members can bulk assign runtimes, archive, restore, and transfer ownership with all-or-nothing validation; private Agent permissions are enforced server-side and the default Agent license quota is 10.

Added

Persisted ticket filters and search per user and workspace, with URL date ranges remaining authoritative and date filters applied consistently to board columns.
Skill filtering by usage and owner, a memory-distillation capability toggle synchronized with SKILL.md, and a simplified manual creation form with Frontmatter validation and actionable errors.
Redis-backed shared state for local Skill discovery and import requests in multi-server deployments, with the existing in-memory fallback for single-server deployments.
Workspace inbox unread badges, persisted sidebar collapse state, pinned-ticket access in the collapsed sidebar, memory filtered totals, and persisted floating agent-task control placement.
Channel session source and task history, workspace user binding synchronization, consolidated Agent runtime configuration, CLI interactive token login, and automatic CLI tool configuration in supported installers.

Changed

Skill metadata editing now uses the complete SKILL.md source, including Frontmatter, as the canonical editing surface; database projections are derived during supported saves and import overwrites.
ZIP and filesystem Skill imports now share one discovery walker that consistently ignores macOS metadata and validates extracted paths.
Editor display preferences apply consistently to ticket, Agent, team, and scheduled-task creation and editing surfaces.
Team-leader delegation instructions now require valid mention links and a bare-@ preflight scan.
Ticket discussions gained parent/reply navigation, last-reply shortcuts, more reliable inbox-target scrolling, a more compact toolbar, and live task-graph refreshes.
Runtime lists put offline entries last and show owner display names instead of owner IDs.
Online installation is more resilient across unavailable CLI assets, Podman Docker aliases, quiet wget execution, deterministic text attachment extensions, and the PowerShell installer path.

Fixed

Provider runtime panics are contained to the affected task across Claude, Codex, KimiCode, OpenCode, ACP, and Pi; cleanup, terminal results, session IDs, and channel closure remain deterministic.
Archived subtickets remain visible from their parent while general ticket lists continue to hide archived tickets by default.
Comment dispatch handles member follow-ups, self-mentions, missing coalesced IDs, and pending/running task successors without losing work.
WeCom credential rotation and encrypted media metadata handling are safer, and missing webhook triggers no longer cause nil failures.
Skill Frontmatter styling and Markdown editing are consistent, duplicate manual Skill names produce a specific error, and local Skill request polling works across API instances.
Search keyboard navigation, empty ticket suggestions, ticket mentions, agent-task message output storage, snapshot polling, FAB placement persistence, and deferred/terminal task status filtering now behave consistently.
The CLI refuses workspace switching while operating inside an Agent task.

Security

Skill ZIP extraction rejects path traversal and applies centralized metadata filtering before discovery.
Private Agent edit, management, and ownership-transfer permissions are enforced by the server, including bulk operations with pre-validation and no partial mutation.
WeCom secret-key rotation preserves decryptability during transitions, and provider panic details remain in server logs rather than task-facing errors.

Upgrade Notes

Apply the normal database migrations before starting the new server. This release includes migrations for comment-task coalescing, deferred task status, binary task output, WeCom/channel metadata, task-flow seed data, Chinese full-text search, and channel session identifiers.
The systemd unit is now named mopheus-daemon.service; update service-management automation that still references the former unit name.
Configure the new WeCom settings before enabling the integration. Multi-server installations should configure Redis so local Skill discovery/import request state is shared across API instances.
No manual data rewrite is required for the Skill editor changes; existing SKILL.md Frontmatter becomes the canonical source during subsequent supported saves and overwrites.

v2.2.0 — 2026-08-06

New

Channel unification — Lark and Feishu consolidated under one channel engine with media-state cleanup, task-batching semantics, and workspace-scoped chat writes.
Daemon identity & new runtime — profile-tagged runtime registration, per-profile daemon identity, and a new pi-coding-agent provider.
Workspace management — batch invites that include skills, visible resource grants on runtimes, paginated roles with refresh grants, and a new resource-grant model.
RBAC resource grants — self-managed agent access for members and lifecycle operations gated by workspace scope.
Tickets & metadata — metadata CRUD via the service layer with a picker UI, comment Enter-key behavior preference, ticket list search filter, and my-tickets scope filtering pushed to the backend.
CLI surface — skill list query flags, ticket list search filter, --project-id alias on ticket commands, --description-stdin and --description-file on agent and team create.
Profile & preferences — personal preferences, notification settings, keyboard shortcut recording, and editor display-mode preferences.
Agent-task checklist — per-task run-local checklist surfaced to CLI sessions.
License CLI — template presets available in mopheus-license.

Improved

Editor behavior — Enter / Mod-Enter complementary handling, shortcuts conflict detection, and /add comment style unified across prompts.
Distillation — redistillation choices signal for memory refinement; dedup logic aligned with mopheus memory subcommand.
Activation & registration — runtime activation preserved on register; new agents default to the normal role.
i18n — workspace settings tabs translated; memory role scope label added.
Hermes channel — per-task skills cleared between agent-task runs.
Codex sandbox — macOS sandbox aligned with the Linux behavior.
Channel install flows — workspaces refresh after invitation acceptance; media state cleaned on deletion.
Output guidance — slim repo command examples aligned with current CLI flags; provider-specific task tracking guidance added.

Fixed

Cross-workspace hardening — closing leaks in team CRUD, member onboarding, agent lifecycles, jobs/triggers/runs, runtimes, inbox operations, skill CRUD, attachments, ticket pins, labels, team leaders, chat writes, Lark installation/binding, and license quota checks.
Brand rename — moclaw → mopheus across CLI, scripts, docs, and packages.
Label operation type rename — TicketLableOperationParams → TicketLabelOperationParams.
Auth — current-password requirement clarified; expired JWT sessions report a distinct error; user error codes centralized.
Daemon — graceful handling when the prior working directory is unavailable; allow owner heartbeats when the runtime is disabled; bound heartbeat drain to snapshot length.
Workspace — enforce owner-only deletion; accept pre-rename license codes; refresh workspace data on config changes.
Migration & install upgrades — preserve existing table data and custom system config across upgrades; avoid duplicating migrated environment keys; harden renamed upgrade scripts.
Skills — paginated skills list, normalized script file permissions, renewal of import orchestration.
Agent — detect kimi missing sessions from stderr and retry resume; configure ACP unattended permissions; queue agent tasks when the runtime is offline; surface Codex plan updates as tool events.
Notifications — suppress banners while focused; foreground tests allowed.
Editor — limit large attachment previews; long-comment navigation, chat copy button, group mention routing by structured ids.
Inbox — group ticket read and archive actions; scope single-item operations by workspace and recipient.
Hermes channel — keep the sidebar chat available; clean media state on deletion.
Backend — allow heartbeat and registration for disabled runtimes when the owner is active; resolve daemon claim workspace; qualify joined SQL column references.

v2.1.3 — 2026-07-21

New

Knowledge graph — AGE-backed knowledge graph with subgraph navigation, edit operations (merge tags, remove edge, update node metadata), and a RebuildGraph command.
Memory system — workspace memories written as files for agent prompt injection, retrieval guidance for agent workflows, recall by ticket context at claim time, table output with title, scoped CJK retrieval, status cleanup on memory deletion, invalidation of all memory queries on delete, hasEmbedding field, per-field editing, JSON view editor for context tags, and a --disable-memory-retrieve CLI flag.
Search — pg_bigm-backed CJK substring and multi-word tiered search for tickets, ILIKE substring fallback for CJK, and Chinese full-text search via zhparser.
Skills UX — searchable skills dialog with table view, page-entry refetch, total skill count, list search state preserved, and file mode preservation during import.
License — offline authorization enforcement and the default memory limit raised to 50.
CLI surface — tickets create accepts --parent as an alias of --parent-id and --project-id as an alias; agent and team create commands gain --description-stdin and --description-file.
Sidebar & navigation — pinned tickets shown in the sidebar and default-collapsed ticket sections with limited attachment display.
Agent-tasks FAB — expanded to six anchor positions and stacks in FabGroup, with a dedicated ticket link button and widened drawer.
Runtime import — search filtering in the runtime import dialog.
Daemon control — per-task subagent limit with prompt injection and ~/.claude/projects cache cleanup per task; subagent lifecycle event parsing.
Agent environment — task-scoped CLAUDE_CONFIG_DIR for Claude and a homeSeeder hook on cliProvider.

Improved

WebSocket client stability — refresh stale clients after deploy; invalidate the tickets-board query on ticket WS events.
Agent-task activity — restore batch usage in the task list endpoint; lazy-load messages with pagination.
Distillation prompt — strengthen memory retrieval trigger in chat mode; tighten memory CLI command references.
Editor — FAB jumps to top-left on click from bottom-right position; suppress body hydration extension noise.
Tickets UX — restore page clickability after setting parent ticket; agent task floating action button drag-to-corner behavior; absolute timestamps in comment and activity timeline.
Default prompt — slim provider prompt hardened; Claude default prompt switched from v1 to v2.

Fixed

Memory — fix V1 memory prompt paths and index format; fix searchSimilarMemories SQL parameter numbering and scope filtering; address final review findings.
Skills — preserve file modes during import; preserve script metadata during import; preserve executable skill scripts; batch agent usage lookup; refetch list on page entry; show total skill count.
Install & packaging — avoid copying downloaded archives; pull all services during online update, not just backend and frontend; harden online install scripts across platforms; update install env example.
Daemon — scope Claude cache cleanup per task; resume workflow after skill runs; detect Kimi missing sessions from stderr; retry missing resume sessions.
Tickets — validate metadata JSON filters; bind repositories to transactions; keep the board in place after delete.
Web — refresh stale clients after deploy; remove unused serverActions config; clean up final review findings.
Tickets scope — cascade delete memory_source and memory_distillation.
Agent — preserve executable skill scripts; stop ACP process after prompt completion.
Prompt — restore memory retrieval guidance references to match actual CLI flags.

v2.1.2 — 2026-07-08

New

Codex provider — Codex runtime support with full agent execution parity (MCP, sandbox, memory handling, session usage tracking).
GitHub integration — Register repositories, sync PRs and issues, link them to tickets, and drive the full checkout → code → PR → sync workflow from the CLI.
Group chat — Topics, reactions, replies, member management, mention filtering, clickable ticket identifiers, and hover cards.
Skill import — Import skills from a URL, parse from GitHub, upload a zip, or import locally.
RBAC — Observer role, role selection during member invites, and new scoped permissions.
/note command — Suppress agent triggering from a comment.

Improved

Ticket and workspace UX: dirty guards, explicit edit/save/cancel flows, context-menu pickers, identifier prefixes, terminal status cascading to subtickets.
Agent task floating action button, active-task display, and drag-to-corner behavior.
Helm chart and install/update packaging.
Marketing site scaffold (Next.js + i18n).

Fixed

Daemon WebSocket stability (fewer unnecessary reconnects; fixed 1006 on forced re-registration).
Agent task trigger-comment deduplication by thread context.
Repository query aliases, NULL scan handling, duplicate repo URLs, UUID resolution, and missing trigger thread IDs.
All-zero usage buckets no longer appear as synthetic model rows.
Long comment display, mention picker keyboard selection, timeline collapsing, and memory extraction UI.

v2.1.1 — 2026-06-30

New

Live workspace slug validation with safer random suffix generation.
Ticket ID matching in global search and clickable URLs for metadata values.
Runtime usage accuracy — task counts now sourced from runtime_daily; cache token totals surfaced in usage reporting.
Remote CLI installation and install backup tooling.
Requester and runtime info in agent run lists; dashboard activity log improvements.

Improved

Prompt metadata split into mandatory and optional tiers.
Feishu region labels unified to "Feishu" / "飞书".
Test coverage: webhooks 80.8% → 88.8%, auth 80.8% → 94.2%.

Fixed

Ticket metadata CLI parsing against response envelopes.
Runtime usage double-counting; number inputs stuck at 0 on backspace.
Attachment content-type via extension overrides; duplicate member add (409).
Browser autofill on hidden agent env-var fields; CLI session retry on 401; install health-check endpoint path.

Includes database and usage-reporting changes around runtime_daily. Apply migrations before relying on runtime usage totals.

v2.1.0 — 2026-06-25

Initial 2.x release. Detailed per-item notes were not captured at tag time.

v2.2.13 — 2026-10-31Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

SecurityCopy Anchor Link

FixedCopy Anchor Link

Breaking ChangesCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.12 — 2026-10-24Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

SecurityCopy Anchor Link

FixedCopy Anchor Link

Breaking ChangesCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.11 — 2026-10-17Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

SecurityCopy Anchor Link

FixedCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.10 — 2026-10-10Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

SecurityCopy Anchor Link

FixedCopy Anchor Link

Breaking ChangesCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.9 — 2026-10-03Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

FixedCopy Anchor Link

SecurityCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.8 — 2026-09-26Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

FixedCopy Anchor Link

SecurityCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.7 — 2026-09-19Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

FixedCopy Anchor Link

SecurityCopy Anchor Link

v2.2.6 — 2026-09-12Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

FixedCopy Anchor Link

SecurityCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.5 — 2026-09-05Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

FixedCopy Anchor Link

SecurityCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.4 — 2026-08-29Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

FixedCopy Anchor Link

SecurityCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.3 — 2026-08-22Copy Anchor Link

HighlightsCopy Anchor Link

AddedCopy Anchor Link

ChangedCopy Anchor Link

SecurityCopy Anchor Link

Upgrade NotesCopy Anchor Link

v2.2.2 — 2026-08-15Copy Anchor Link

v2.2.13 — 2026-10-31

Highlights

Added

Changed

Security

Fixed

Breaking Changes

Upgrade Notes

v2.2.12 — 2026-10-24

Highlights

Added

Changed

Security

Fixed

Breaking Changes

Upgrade Notes

v2.2.11 — 2026-10-17

Highlights

Added

Changed

Security

Fixed

Upgrade Notes

v2.2.10 — 2026-10-10

Highlights

Added

Changed

Security

Fixed

Breaking Changes

Upgrade Notes

v2.2.9 — 2026-10-03

Highlights

Added

Changed

Fixed

Security

Upgrade Notes

v2.2.8 — 2026-09-26

Highlights

Added

Changed

Fixed

Security

Upgrade Notes

v2.2.7 — 2026-09-19

Highlights

Added

Changed

Fixed

Security

v2.2.6 — 2026-09-12

Highlights

Added

Changed

Fixed

Security

Upgrade Notes

v2.2.5 — 2026-09-05

Highlights

Added

Changed

Fixed

Security

Upgrade Notes

v2.2.4 — 2026-08-29

Highlights

Added

Changed

Fixed

Security

Upgrade Notes

v2.2.3 — 2026-08-22

Highlights

Added

Changed

Security

Upgrade Notes

v2.2.2 — 2026-08-15

Highlights