Changelog

All notable changes to Wick are documented here.

[Unreleased]

Nothing yet — notes for the next release go here.

v1.9.0 — Graceful Upgrades & Workflows

Released on 2026-09-10

Added

Zero-downtime binary replacement (<app> reload): A restart closed the listening port and killed in-flight work. reload starts a successor, hands it the listening socket, and keeps serving until the successor is ready. The old process then drains and exits. Work that cannot be resumed (workflow runs mid-node, cron jobs mid-write) waits for WICK_DRAIN_TIMEOUT (default 20m), while resumable agent turns wait for WICK_DRAIN_AGENT_GRACE (default 45s). An intake baton ensures only one process accepts new work. Opt-in with WICK_GRACEFUL_UPGRADE=1; full support on Linux/macOS/BSD, with Windows and the tray falling back to stop/start. Background subsystems declare work with upgrade.Register / upgrade.RegisterResumable.
Slack: run an agent inside a thread from a workflow (slack.send_to_session): This action injects a task into the agent session bound to a Slack thread, making the turn an ordinary pool turn with status banners, tool activity streaming, and replies in the thread. slack.send_message also gains auto_reply to arm the thread's 🤖 switch. Bot messages now reach the workflow surface as message / thread_started with is_bot, bot_id, and bot_username, guarded against self-posts.
Self-update now uses the handover too: Applying a staged update now performs a socket handover when graceful upgrade is armed, replacing the binary and forking a successor while the current process keeps serving and drains. The tray keeps the classic swap + re-exec.
Built-in skill: upgrading without downtime: Ships in the binary, documenting reload vs restart, systemd lines needed for handover, binary renaming, drain wait times, registering background subsystems, proving zero downtime, and recognising failure modes.
Workflow: clear a workflow's run history from a menu: Adds a bulk action to clear all runs from a workflow's history, accessible via a 3-dot menu. state.FileStore.DeleteAll(id) is used for deletion, ignoring panel filters. The KebabMenu gains a size="sm" option.
Providers: show when each usage window resets on the card: Provider cards now display reset information (e.g., "5h 35% resets-1h") with a glyph and a tooltip for weekly and daily usage windows.
Built-in skill: HTML widget troubleshooting (wick-html-widget): Documents HTML artifact preview rules, including the one-file rule, CSP directives, widget permissions presets, the wickReadFile and wickDataTable bridges, and console message signatures.
SCM: scroll the selected repository into view and mark it: The repository list now scrolls the selected row into view when opened, selection changes, or search filters rebuild rows. The selected row also gains a check icon and accent left border.
Sessions: own a channel thread from its first message, and share it with everyone in it: ensureSession now stamps the caller as owner at creation. Session meta gains participants (all speakers), which drives visibility in "Yours", access to unscoped sessions, and a shared-thread icon.
Channels: name every channel instance and let a workflow pin one: Registry.Describe now returns one row per instance with its key, owner, and bot name. The editor renders this as a two-line row, with the caller's instance first. Channel nodes and triggers gained channel_instance to pin an action to a specific bot, and identity is cached on the instance's agent_channels row.
Source: tell the agent which repository it is working in: The "This session" block now carries active_repo, and a Source connector exposes the same selection through source_active (to re-read), source_list (to show all repos), and source_select (to switch).
Source: follow the repository being edited, and say so: The git watcher now maps changed files to their owning repository and makes that the session's active repo, ignoring writes inside .git. The prompt and MCP instructions state active_repo is a spawn-time snapshot. The Source rail icon pulses with the repo name when the active repo moves.
SCM: give the Source panel a credential: Push and Pull actions in the Source panel now borrow credentials from the Git CLI connector. The first network operation prompts for a credential, which is remembered per session, per user.

Improved

Registry: session-view rebuild 40% cheaper: Optimised the registry's session-view rebuild process by using maps.Clone and sorting order keys (LastActive) instead of IDs. This reduced rebuild time from 5.9ms to 3.5ms per request for 5,000 sessions.

Fixed

Source panel missed changes deeper than one directory: The fsnotify watcher now watches the active repository's tree in full (skipping .git and build/cache noise), capped at 4000 directories, addressing issues where changes in nested directories were not noticed. Each repo's .git is also watched.
Source rail badge showed no counter until a file changed: The last git_status per session is now cached and replayed on every page load, ensuring the badge displays a counter immediately.
Assistant message duplicated on every page reload: The stream snapshot's disk fallback now emits one cumulative text_snapshot instead of replaying assistant text as text_delta (append), preventing duplication.
A reply typed in the web UI never reached its Slack thread: The session → (channel, thread) mapping is now persisted on the session (meta.channel_ref), allowing replies to be delivered even after a restart or from sessions created by workflows.
plugin.Reloader.Stop panicked on overlapping shutdown paths: The stop channel is now idempotent, preventing double-closure panics.
Workflow subsystem was never stopped on shutdown: wfsetup.Manager.Stop now has a caller, ensuring running workflows are properly stopped during shutdown.
Slack: route events from every bot instance: The workflow event sink is now attached to all Slack instances, not just the first, ensuring all bots receive and route events correctly.
Slack: collapse repeat deliveries of one physical event: Slack payloads now carry a bot-independent event_key (channel/ts), and the router drops keys it has already seen, preventing duplicate workflow runs from multiple bots in a channel or Slack webhook retries.
Slack: action nodes resolve instance per run from trigger's bot_user_id: Workflows triggered by a specific bot now reply as that bot, preventing not_in_channel errors.
Slack: slack.channels picker offers only channels the bot is a member of: The picker now uses users.conversations instead of conversations.list, showing only reachable channels and preventing selection of un-joinable ones.
Slack: text_contains trigger now means case-insensitive substring: The text_contains filter in Slack message triggers now correctly performs a case-insensitive substring match.
Slack: editor picker no longer lists an already-selected entry twice: Editor pickers for Slack channels now de-duplicate entries, and saved chips for values set by others are rendered under a "Current" label.
UI: fail the build on missing generated assets (explicit go:embed): Generated build outputs (css/app.css, lib/wick-markdown.js) are now explicitly named in go:embed, causing a compile-time error if they are missing instead of silently shipping 404s.
UI: one clashing skill name emptied the whole / command menu: The / command menu now uses a unique key for list identity (e.g., skill:<folder>) and de-dupes by invokable name, preventing a single name clash from emptying the entire menu.
UI: Chrome warned that apple-mobile-web-app-capable is deprecated: Added the standard mobile-web-app-capable meta tag while retaining the prefixed version for iOS Safari.
SCM: count the selected repository in the Source badge, not the session: The Source rail badge now reflects the changes in the currently selected repository, falling back to the session total when none is selected.
Files: file panel explorer-shaped search and sort: The file panel's filter is now scoped to the level being viewed, with a "Subfolders" toggle for recursive search. Ordering now follows standard file manager rules (folders first, Name/Recent/Type), and the search box includes a clear button.
Files: file panel header counts the folder you are in, not everything loaded: The file panel header now accurately counts the entries in the current folder, rather than a cumulative count of all loaded entries as folders are expanded.
SCM: make the selected repository one answer, per session: The active repository selection now lives on the session (meta.scm_repo) and is included in the git_status snapshot, ensuring consistency across the panel, badge, and server.
SCM: name the active repository on the collapsed Repositories header: The collapsed repository list header now displays the active repo's name and branch, providing context without needing to expand the list.
SCM: give the collapsed repository name the room it needs: The active repo's name on the collapsed header now sits right after the count, taking up the remaining row space, improving readability.
Git connector: policy refusal arrived as normal reply, not transport error: gitConnectorOutput now reads policy verdicts (ok:false, verdict "deny") first, preventing false "Pulled" messages.
Git connector: pull and checkout now exempt from protected branch policy: These non-mutating operations are no longer gated by protected branch policies.
Git connector: stale .git/index.lock blocked commands; now retries after clearing old/unheld locks: The Run command now retries once after clearing stale .git/index.lock files that are both old (>10m) and unheld.
Git connector: pull with no branch now falls back to current branch: The pull operation now correctly defaults to the current branch when none is specified.
Git connector: discard on repo with no commits now uses git rm --cached: The discard command now correctly handles repos with no commits by unstaging with git rm --cached.
Agents: load the file panel one level at a time (recursive listing cut off): The Context panel now loads directory contents one level at a time via GET /files?path=, applying the 5000-entry cap per directory rather than globally, ensuring all top-level repos are visible. Server-side search for "Subfolders" mode is also implemented.
Agents: the @-mention index cap increased from 20000 to 200000 files: The @-mention index now supports a significantly larger number of files, preventing silent omissions in large sessions.
Agents: refresh on SSE heartbeat now strictly sequential, not parallel: File panel refresh requests triggered by SSE heartbeats are now sequential, resolving intermittent "Transport error" issues from parallel requests.
Agents: pull op description updated to reflect exemption from protected branch: The description for the pull operation in the git connector documentation has been corrected.
Agents: policyshow test for checkout exemption fixed: A test verifying checkout exemption from protected branch policies has been corrected.
Upgrade: log-pipe cleanup waited unbounded for EOF: The log-pipe cleanup no longer waits unbounded for EOF from inherited pipes, preventing the old process from hanging after a drain.
Upgrade: successor inherited parent's log pipes, causing SIGPIPE: Successor processes now fork with real stdio, preventing SIGPIPE errors when the parent exits and stopping child boot output from being copied to the parent's log.
SCM: repository list no longer drags itself back to the selection on re-render: Auto-scroll in the repository list now fires only when the reason for selection changes, and stands down for 5 seconds after manual scrolling. A pill appears to guide users back to the selection if it's out of view.
Agents: a scroll away from the bottom now wins the race against an arriving turn: Upward scrolling in the chat panel now immediately releases the "stick to bottom" pin, preventing the thread from jumping back down when a new turn arrives mid-gesture.
Tests: unbreak the suite on a real host (provider/claude, provider/codex tests): Test hygiene fixes, including ensuring CLAUDE_CONFIG_DIR independence, gating codex integration tests behind WICK_CODEX_E2E=1, and fixing a race in upgrade TestTrackerWaitsUntilZero with an atomic counter.
Memscope: shim unit name carries nanosecond stamp for uniqueness: The memscope shim's unit name now includes a nanosecond timestamp, preventing clashes when exec replaces the shell in place.
Git connector: reset and branch_create with checkout fixed for git 2.43 compatibility: Addressed compatibility issues with Git 2.43 by ensuring ValidateCommitish refuses leading - and using plain documented forms for reset and branch_create arguments.
Memscope: quote what the shim interpolates to prevent script injection: The shim now safely quotes interpolated values like RealBin and slice arguments using sh(), and Provider.Name through shimSafeName, preventing shell script injection from hostile names or paths with spaces.
Web: carry embedded build outputs (app.css, wick-markdown.js) in git to allow compilation without a frontend toolchain: public/css/app.css and public/lib/wick-markdown.js are now committed to git, allowing go build and go test to succeed on fresh checkouts without requiring a frontend build toolchain.

v1.8.1 — Providers & Fixes

Released on 2026-09-08

Fixed

Slack: continuation chunks posted plain: Overflow chunks of a long reply were previously prefixed with an _(cont.)_ marker; they are now posted as plain follow-up messages with no prefix.
Custom connectors: session instances now honor config field defaults: An operation whose URL template referenced a config field with a declared default (e.g., base_url) previously failed with rendered URL "..." is not http(s) on fresh session-workspace instances. This occurred because custom connectors read config directly from the instance map without applying defaults. Custom connectors now fall back to the field's declared default when no value is stored (applied in ctxMaps), matching built-in connector behavior which uses entity.MapToStruct for default substitution. This resolves issues where instances appeared "ready" but operations failed until config fields were manually reset, even if they matched their defaults.
Websocket upgrade behind Nginx for login TTY: Fixed an issue where the login TTY websocket failed to connect behind Nginx. Proxies forwarding the client's Upgrade: websocket header often rewrote the Connection header to keep-alive. The gorilla websocket Upgrade() function required the upgrade token in the Connection header, leading to a 400 error. The fix restores the upgrade token before processing the handshake, enabling the terminal to stream correctly.

Added

Providers: connection badges on the list page: Each provider instance card now displays its connection state (Connected / Not connected), associated account email, and two nested usage rings. The inner ring represents a rolling 5-hour window, and the outer ring a rolling 7-day window, with both percentages spelled out. This allows distinguishing instances of the same type without needing to open each one's detail page. Provider types without a usage API (e.g., codex, gemini) show only the badge and email. This feature is backed by a new GET /api/providers/connections endpoint that efficiently returns account and usage data for all instances in a single request. Usage is probed once per distinct credential directory and results are cached for 60 seconds. The endpoint is deliberately separate from GET /api/providers to ensure the list page loads quickly, with badges filling in asynchronously. See Providers ▶ Connection badges.

v1.8.0 — Providers & Fixes

Released on 2026-09-07

Added

Providers: Reconnect via login TTY: The provider detail page's Connection panel can now run claude's interactive /login inside a wick-owned terminal, streamed live to the browser (xterm.js over a websocket) — no separate Web Terminal / SSH session needed. The OAuth login link is parsed out and offered as Copy/Open, an authorization-code field types codes into the CLI, and success/failure are detected and timestamped. The session is TTL-bound: 5 minutes by default, +5 minute extends, 30 minute hard cap, auto-killed on expiry. The panel also shows the connected account (email/org/plan) and claude's usage windows, read from the instance's own credential files (CLAUDE_CONFIG_DIR / CODEX_HOME-aware). codex/gemini show account status only for now; wick is unaffected. See Providers ▶ Reconnect (login TTY).

Improved

Providers: detail page sections collapsed by default: Configuration, Extra Args, Env, and Recent Sessions on the provider detail page now start collapsed behind a clickable summary header; Recent Sessions defers its request until first expanded instead of loading on every page visit.

Fixed

Slack: no more duplicated/truncated replies on mid-turn follow-ups: Sending a follow-up message while the agent was still streaming a reply superseded the in-flight turn but dropped its pointer to the live Slack message, causing finalizeReply to post a brand-new message and strand the streamed one mid-word. The live message pointer now carries over to the new turn, so the reply is edited in place instead of duplicated.
Slack: long replies no longer split mid-link or mid-code-block: Chunking a long reply could previously cut inside a <url|label> link or a ``` fenced code block, leaking raw URLs or breaking formatting across both halves. Chunk boundaries now skip over these spans and prefer a blank line, then a newline, then a space before falling back to a hard cut.
Windows: no more DNS resolver override: /etc/resolv.conf never exists on Windows, so wick's network bootstrap always read that as "no nameserver configured" and replaced Go's resolver with a direct-UDP fallback to public DNS (1.1.1.1 / 8.8.8.8) on every Windows install. Networks that block outbound UDP port 53 to public resolvers (common behind corporate firewalls/VPNs) then failed every outbound call. Wick now skips this step entirely on Windows, where the stdlib resolver already talks to the OS DNS APIs directly.

v1.7.3 — Plugins & Autosave

Released on 2026-09-04

Added

Autosave commit method: Added a new method to immediately save without a prior schedule.
Project Settings Form: Updated event handlers to use the new autosave commit method for selects and toggles.
Provider Picker: Enabled selection of instances even with an empty model list through a default model button.

Improved

Plugin release pipeline:
- Separate target knob + rebuild-all: Plugin builds now read the BUILD_TARGETS_PLUGINS Actions variable (falling back to BUILD_TARGETS, then the shared default), allowing plugins to ship a wider OS/architecture set than the Wick binary.
- The manual release-plugins.yml run no longer requires a plugin name; an empty value or all rebuilds every plugin.
- A new force option allows re-releasing already-tagged versions by replacing/extending the zips on their existing releases (e.g., to backfill a newly added architecture).

v1.7.2 — Channels & Files

Released on 2026-09-04

Added

REST channel background mode: POST /chat/completions and POST /responses now accept "background": true (or metadata.background: "true") to return immediately with "status": "queued" instead of waiting for the agent to complete. The reply lands in the session history; pair with conversation and read it back with a follow-up request. See Channels ▶ REST.

Improved

REST channel: concurrent requests on one conversation now queue instead of erroring: A second request on the same conversation while an earlier one is still in flight used to return 409 session busy. It now queues FIFO behind the in-flight turn, like a chat channel message, and each request gets the reply to its own message — even if an earlier request was cancelled client-side. See Channels ▶ REST.
Slack channel upload_file now supports binary files and is more robust:
- The upload_file action in the Slack channel now correctly handles application/x-www-form-urlencoded for files.getUploadURLExternal, resolving a previous issue where no uploads worked.
- Added support for uploading binary content via path (reading from disk) and content_base64 (inline bytes) inputs. The path input is confined to Wick's agents directory with symlink resolution and containment checks for security.
- Addressed a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in file uploads by ensuring path validation and file reading occur through a single, secure handle, preventing symlink race conditions.
- Fixed a bug where a semicolon ; in the desc= prose within Wick struct-tags silently truncated schema descriptions, affecting 61 tags. A test has been added to prevent future regressions.
- The content input source for uploads is now explicitly named, and the InputSample uses <agents-dir> instead of a hardcoded path.
- Documentation for the semicolon rule in config-tags skill has been updated.

v1.7.1 — Trace UI

Released on 2026-09-02

Fixed

Trace tool cards no longer spin forever on large results: A tool result large enough to be spilled to a sidecar file was previously rendered as perpetually running because the frontend inferred completion from inline text, which was absent. Completion is now correctly inferred from the existence of the result event. The spilled payload is fetched lazily when the result is expanded; collapsed cards display their size (e.g., '16.8 KB — click to load') to avoid including large data in the trace index. Payloads capped by traceEventMaxBytes include a truncation note. This fix covers DetailView and SubAgentModal. Live-built blocks fall back to text presence, and old traces remain unaffected.
Lazy-load spilled tool_use input: Fixed an issue where tool_use cards with large, spilled inputs incorrectly displayed 'no input'. The tool input is now lazy-loaded upon expansion, with collapsed headers showing an 'input N KB — click to load' hint. The 'no input' message only renders when there is genuinely no input. This also includes a fix for the loadTraceEvent test helper type.
Retain spilled-input todo cards: todo calls whose input was spilled were previously removed from the flat trace and merged checklist. Such cards are now retained in the flat trace as generic cards, displaying 'input N KB — click to load'.

v1.7.0 — Trace Improvements

Released on 2026-09-02

Improved

Turn trace shows narration and why a tool ran: Expanding show trace on an assistant turn now interleaves the narration text the model streamed between tool calls, positioned where it actually occurred, instead of showing bare tool cards with no context. Tool cards also surface the call's description field next to the tool name (an MCP mcp__<server>__ prefix is stripped from the display, full name on hover), with duration/time moved to the right of the header. See AI Agents ▶ Turn trace.

Fixed

Job runs cancelled by user now correctly show as 'cancelled': Resolved a race condition where deliberately canceled job runs would sometimes incorrectly show an 'error' status instead of 'cancelled'. The system now consistently records the run as cancelled when a user stops it.

v1.6.0 — Job, Session, Migrate

Released on 2026-08-28

Improved

Faster restarts on Postgres: Startup now skips the full AutoMigrate catalog scan when the schema hasn't changed since the last boot. It checks a fingerprint stored in a new single-row wick_schema_state table instead, dramatically reducing startup time. A full migration is automatically triggered if the fingerprint is missing or doesn't match. No configuration changes are required.

Added

Jobs can be cancelled mid-run: A Cancel button is now available on a running job's page and in the manager SPA's job detail view. This action cancels the run's context, marks the run as cancelled (a new status distinct from Success/Error), and returns the job to an idle state. The Cancel button also serves as an unstick action for jobs stuck showing running without any actual activity (e.g., after a crash). Stuck jobs are now automatically swept on every worker tick and at bootstrap, including disabled jobs. Disabling a running job will also cancel it.
Your sessions / All sessions tabs: The Sessions page and sidebar now default to displaying your own chats, along with chats on tickets assigned to you when in ticket mode. A new tab allows widening the view to include everyone's sessions. Both lists now support scroll-to-load for more items, replacing the old paging mechanism. The sidebar's former per-project session-count pill has been replaced with a Yours/All toggle, which is cookie-persisted and resets to 'Yours' upon a project switch. The ticket board's Untracked rail also gains the same Yours/All split (filtered by ?untracked_owner=me on GET /api/projects/{id}/tickets), plus scroll-to-load paging. The ticket board itself is now viewport-locked, with each column scrolling independently under pinned headers. The GET /api/sessions endpoint has been enhanced with ?owner=me and ?offset= parameters, and its response now includes total and has_more fields.

Changed

Ticketed sessions default to their ticket: For sessions attached to a ticket, the system prompt now directs the agent to treat that ticket as the conversation's primary subject. Agents are prompted to first read the ticket and its notes, then follow a matching skill, before resorting to ad-hoc exploration across sessions.

Fixed

Cancelled runs reliably show as cancelled: A race condition could sometimes cause runs stopped via the Cancel button, a job disable, or a shutdown to finalize with an error status instead of cancelled. This has been resolved; cancellation is now reliably finalized as cancelled in all such cases. Runs that end due to a timeout will continue to finalize as error.

v1.5.0 — Tickets

Released on 2026-08-26

Added

Tickets now feature a markdown body (description), supporting entity creation/PATCH, MCP operations (truncated in list, full in get), ticket.updated diff tracking, and a 600-character excerpt injected into the session system prompt.
Introduced a show_on_card flag for schema fields, allowing specific fields to be displayed on board cards.
Custom action buttons under Integrations, configurable with a label and URL, rendered on every ticket page. A click POSTs the ticket as a ticket.action event via the webhook dispatcher, including SSRF guard, retry, and synchronous outcome reporting.
Documentation for ticket body, card fields, and custom buttons.

Improved

Board UI revamped with fixed-width, horizontally scrollable columns that center when they fit, status-dot headers, and a full-width card view.
Ticket page UI revamped with a two-pane layout (work column + properties rail), a markdown description editor, sessions capped at 5 with a "show more" option, notes displayed as a comment thread, a trash-icon delete option, a breadcrumb top bar, a floating bottom-centre composer, and ?ticket= URL synchronization for back/forward browser navigation.

Fixed

Webhook secrets are now redacted from board and detail configuration responses.

Dev

The development environment now serves /public from disk under WICK_DEV_REPO_ROOT, allowing Tailwind rebuilds to apply without recompiling the server.

v1.5.0 — Ticket Descriptions, Card Fields, Custom Buttons

Released on 2026-08-26

Added

Tickets gain a markdown description: A ticket now carries a body alongside its title — editable on the ticket page and rendered as markdown. POST /api/projects/{id}/tickets and PATCH /api/tickets/{ticketID} accept body (an explicit "" on PATCH clears it; omitting it leaves it unchanged), and the ticket_create / ticket_update MCP ops on the Tickets connector accept it the same way. ticket_get returns it in full; ticket_list truncates it to 280 characters so a board listing doesn't pay for long descriptions per row. A 600-character excerpt also rides in the session's system prompt so an agent knows what a ticket is about without a tool call. See Ticket Integrations.
Per-field control over what shows on the board card: Ticket schema fields gain a Card checkbox (Project settings → Ticket system → Custom fields), off by default. Only fields marked Card appear on the kanban card; the full set — plus any value written outside the schema — stays on the ticket's own page. See Projects → Per-project settings.
Custom ticket buttons: A project can add its own buttons (label + URL) under Project settings → Ticket system → Integrations → Custom buttons. Each appears on every ticket's page; clicking one POSTs the full ticket as a ticket.action event to that button's URL through the same delivery machinery as ticket webhooks (SSRF guard, retries), and the click reports back the delivery outcome. ticket.action is not subscribable from a regular webhook — it only reaches the button's own URL. See Ticket Integrations → Custom buttons.
Ticket board and detail page revamp: Kanban columns are now fixed-width in a single horizontally scrollable row. A ticket's page is reorganized into a main column (title, description, sessions capped at 5 with "show more", notes) plus a properties rail, with delete moved to a trash icon and the open ticket reflected in the URL (?ticket=<id>) so back/forward and sharing a link both work.

Security

Webhook secrets no longer leak through board/detail responses: GET /api/projects/{id}/tickets and the ticket detail API previously returned a project's ticket integration config, including webhook secrets, to any board viewer. Both now redact secrets before the response leaves the server.

v1.4.3 — Conversation Pagination

Released on 2026-08-26

Added

Agent conversation history loads incrementally: The agent conversation page now opens with only the latest 20 turns instead of the full transcript, and loads older turns automatically as you scroll to the top (scroll position stays anchored), with a "Load older messages" fallback button. GET /api/sessions/{id}/conversation gains ?limit=N and &before=<turn_id> query params plus a has_more field in the response; calling it with no params still returns the full history, so existing integrations are unaffected. Traces remain lazy-loaded per turn as before.

v1.4.2 — Enhancements

Released on 2026-08-25

Added

Source Control repo list scrolls instead of overflowing: The Source Control panel's Repositories section now caps its expanded list at roughly 5 rows with vertical scroll, and shows a Search repositories filter (matches name or path) once there are more than 5 repos. Previously every repo rendered inline and pushed the rest of the panel down. See Source Control ▶ Multi-repo support.
Tickets can adopt an external id: POST /api/projects/{projectID}/tickets and the ticket_create MCP op now accept an optional id, so a ticket mirroring a record elsewhere can carry that record's identity instead of a minted T-XXXX code — the source system addresses the ticket by the id it already holds, with no mapping to store. An id must fit [A-Za-z0-9._-] within 64 characters and is kept verbatim; .., path separators, leading dots, and the reserved T-XXXX form are refused before it is ever used as a directory name. A uuid is folded to its dashless lowercase form, so the two shapes Notion hands out for one page cannot become two tickets, and a second create from the same page is refused rather than duplicated. Lookup by an adopted id stays a direct file read — nothing scans the board. Omitting id is unchanged. See Ticket Integrations ▶ Adopting an external id.

v1.4.1 — Web UI

Released on 2026-08-25

Fixed

Resolved an issue causing a "first-click hang" on macOS (especially with Bluetooth headsets) when navigating pages. This was due to new AudioContext() synchronously blocking the main thread while waking the audio output device. The two-tone chime is now played using a pre-rendered WAV via HTMLAudioElement, which initializes asynchronously, eliminating UI jank while maintaining the same notes, envelope, and gesture-gated autoplay unlock.

v1.4.1 — Chime Hang Fix

Released on 2026-08-25

Fixed

First click after navigation could freeze for several seconds: The lifecycle notification chime primed a AudioContext on the page's first click/keydown/touchstart, and constructing one blocks the main thread while the OS wakes the audio output — multi-second hangs were observed on macOS with Bluetooth output. The chime is now a pre-rendered WAV played through an HTMLAudioElement instead, removing the blocking construction. Same sound, same autoplay-unlock gesture gating — no other behavior change.

v1.4.0 — Agents

Released on 2026-08-25

Fixed

Crash-recovery notices now actually restart the agent: The recovery notice sent after an unexpected agent death (crash or OOM kill) was delivered as a system turn, which the pool deliberately buffers without spawning. This meant the agent was never brought back and the notice sat unread until the next human message. Recovery turns now spawn on their own, restoring both automatic crash respawn and immediate OOM notification.
Memory kills by the host are no longer blamed on the agent's limit: An agent killed by the global OOM killer (machine out of memory) was previously reported as having exceeded its own memory limit — even when its measured peak was below it — and was never retried.
- The cgroup's oom and oom_kill counters are now read separately. Only a kill triggered by the agent's own ceiling is classified as an OOM (and is not retried).
- A kill from outside the agent's individual limit (either due to the combined agent limit, detected via the agents slice's own counter, or the machine running out of memory) now correctly stays a retryable error whose message names the actual cause.
- Recovery notices now carry the exit's actual reason sentence (including the memory cause and measured figures) instead of a generic "unexpected exit," so a restarted agent knows to change its approach rather than repeat the allocation that got it killed. The OOM notice also now tells the agent to relay operator advice to the user and keep the smaller-approach remedy for itself.
- Documentation for the memory-guard page and the wick-resource-limits skill has been updated to distinguish between own-limit OOM, combined-limit OOM, and host OOM, and clarify their retry behaviors.
OOM kills labeled correctly in Recent Spawns: A memory kill was previously logged with exit_reason: "unknown" instead of oom in the spawn log. This has been corrected.

v1.3.0 — Agents, Tickets, Tools

Released on 2026-08-25

Added

Tool webhook endpoints: Tool modules can now open an unauthenticated, JSON-only subtree under their own mount via r.WebhookGroup(prefix), allowing external systems to deliver callbacks without a session cookie. Handlers receive a *tool.WebhookCtx and are responsible for their own authentication. Declared endpoints are listed on the tool's manager settings page with copy-ready URLs.
Ticket integrations: A project's ticket board can now be wired to external systems from Ticket system → Integrations.
- Outbound webhooks POST a signed (X-Wick-Signature, HMAC-SHA256) JSON event on ticket create/update/status change/assign/delete/session attach/detach/note-add and on the sweeper's followup/auto-resolve actions. Webhooks include 3 retries over ~30s, a per-endpoint delivery log, and an SSRF guard refusing private/loopback/link-local addresses.
- A new REST API toggle enables Personal Access Token authentication against existing ticket REST endpoints for that project, allowing outside systems to create and move tickets without a browser session. See Ticket Integrations.
Jump to ticket from a chat: The conversation header's view menu now offers a direct jump to a chat's associated ticket (or to the board, if not on one). This option is only shown on projects with ticket mode enabled.
Sender identity: Slack, Telegram, REST, and the web composer now resolve message senders from their transport envelope, carrying it as a structured sender field on the turn, separate from the message text.
- A new agents.sender_visibility setting (Agents → Session Identity; off / name default / name_id / full) controls how much of this identity is repeated into the model's copy of each message via a [from: Name] line; the dashboard always shows the full sender regardless.
- The conversation UI displays a name/channel chip and colour-stable avatar initial for messages from someone other than the reader, using a neutral bubble instead of the "you" green. See Channels ▶ Sender identity.
Telegram identity mapping: Telegram now maps senders to wick accounts similarly to Slack, using the same channel_auto_register switch and approval gate. As the Telegram Bot API does not report email, the sender's numeric ID becomes a reserved-domain stand-in (e.g., 8812@telegram.local) for lookup.
- Behaviour change: An unknown, pending, or unapproved Telegram sender now receives a reply naming the missing step instead of silently running as the channel owner. See Channels ▶ Telegram ▶ Sender identity mapping.
Silent replies built-in skill: A new built-in skill (wick-silent-replies) teaches agents when and how to use the [silent] reply marker, including specific prefix rules and scenarios where silent replies are appropriate or not.
Wick-docs built-in skill: A new built-in skill (wick-docs) provides agents with an evergreen pointer to relevant documentation, including a machine index of docs pages, the changelog, GitHub releases, and the running build version. The catalog block injected into provider prompts has also been raised to 8KB to accommodate a growing skill library.

Fixed

Custom MCP-proxy connectors: Object and array arguments are now forwarded to the upstream MCP server in their original JSON type instead of being stringified, resolving "expected object, received string" errors when such parameters were used with text/textarea widgets.
Notes panel ordering: Notes are now ordered by last activity (edited or created, whichever is newer) instead of creation time, ensuring the panel order reflects the displayed timestamps.
Ticket sessions and chat scoping:
- A ticket's session list is now ordered by last activity, newest first.
- Selecting a ticket on the board now scopes the next chat to that ticket. The project-landing composer names the selected ticket in its placeholder and footer, with an option to start a chat without a ticket.
- Auto-create rules are now validated when saved from the ticket-config API, rejecting uncompilable regular expressions immediately.
- The ticket name in the composer placeholder is now clipped at 32 characters to prevent long titles from pushing UI elements off-screen.
- The project options now explicitly carry ticket_enabled for client-side UI logic.
Agent pool race condition: Resolved a WaitGroup misuse race where wg.Add could conflict with wg.Wait during agent exit, ensuring proper synchronization.
Sender identity feature fixes:
- The web composer now correctly stores sender information for dashboard messages, which previously had no sender.
- The wick provider now re-applies the [from: …] line on replay for resumed or compacted threads, ensuring sender identity is preserved.
- Telegram messages no longer render as being from "somebody else" due to missing WickUserID.
Tool webhook robustness:
- Webhook body reads are now capped at 1 MiB (DefaultMaxBodyBytes). Over-cap bodies will error rather than truncate, preventing signature verification failures from misreporting "bad signature."
- Corrected CfgBool documentation and parsing behavior: "yes"/"on" values are now correctly identified as false by strconv.ParseBool, consistent with widget storage.
- JSON encoding failures for webhook responses are now logged instead of being silently discarded.

v1.2.0 — Agents, UI, Connectors

Released on 2026-08-24

Added

Custom Connector Building Skill: A new built-in skill has been added to guide agents through the lifecycle of creating custom connectors. This skill assists with decision-making (e.g., when to choose a Go connector over a custom one), explains critical workflow steps (like the plan-then-confirm process), clarifies access considerations (non-admin owners and initial tag access), and identifies scenarios that still require manual intervention via the dashboard (e.g., OAuth-scheme MCP servers, user credential handling).

Fixed

Slack Agent Identity Handling:
- Resolved an issue where Slack-started agents could intermittently run as the synthetic admin instead of the sender. The session owner is now stamped before any sendFn is triggered, preventing a race condition where the first spawn of a new thread might fall back to the shared internal MCP token and maintain admin identity for its lifetime.
- Slack dispatches now thread the resolved Wick user through the request context (via WithCallerUserID), allowing the agent pool to differentiate messages by sender. This ensures that processes spawned for a specific principal are correctly recycled and reused, rather than reusing processes holding incorrect identities for different users.
- A Slack message whose sender cannot be resolved to a Wick account, and for which no channel owner can be identified as a fallback, is now explicitly refused with a warning. This prevents unintended privilege escalation by running such messages as the synthetic admin, which has broader access than intended.
UI Rendering for Slack Content:
- The conversation view now correctly renders Slack mrkdwn links (e.g., <https://example.com|label>) as clickable anchor tags, instead of displaying the raw angle-bracket string. This improves readability and usability for relayed Slack text.
- Improved the conversation view to render Slack-style emoji shortcodes (e.g., :mag:) as their corresponding glyphs from a small fixed table, while preserving unrecognized codes or timestamps (like 11:52:09).
- The conversation view now also correctly displays bullet-dot lists (using "•" or other ASCII markers) that might have lost newlines during transport, by treating lines with two or more " • " separators as flattened bullet lists and reconstructing them for proper rendering.
CLI Binary Resolution: The AI paste parser for custom connectors no longer fails with exec: "<binary>": executable file not found in $PATH when CLIs (e.g., claude) are installed outside the system's PATH. The provider.ResolveBin function now includes scanning known OS-specific install locations as fallbacks after checking for binary overrides and PATH. This ensures CLIs installed via npm or curl (e.g., in ~/.local/bin) are correctly found.
Built-in Skills Registration: Built-in skills (e.g., /wick-notes, /wick-tickets) are now correctly mirrored into the CLI providers' skills directories (~/.claude/skills, ~/.codex/skills) on every sync. This ensures that these skills are registered as slash commands and are discoverable by the CLI providers, and are correctly pruned when dropped in later versions.
Custom Connector Deletion: Fixed an issue where deleting a custom connector left a "ghost card" in the dashboard and prevented the re-creation of a connector under the same key. Deleting a custom connector now correctly unregisters the live module from both the workflow and core registries, ensuring all traces are removed and the connector key is freed for future use.

v1.1.0 — Identity & Ticket Management

Released on 2026-08-23

Changed

User Identity Handling for Agents
- Fixed an issue where agent sessions started from Slack were incorrectly running as a synthetic administrator due to the session owner not reaching the token minter. Session ownership is now recorded on every message, backfilling older threads.
- Wired Codex to the MCP server, enabling wick_list, connectors, and wick_me for Codex agents using per-session credentials.
- Removed WICK_STRICT_MCP, as per-user identity makes it obsolete.
- notes_list/notes_add/etc. now resolve the author to a display name instead of a UUID.
- Ticket operations return assignee_name alongside the existing assignee ID.
- A new Ctx.UserName(id) helper is available for connectors to resolve user IDs to display names.
- Unresolvable or system IDs (like legacy "agent") now display as "unknown user" for clarity.
Server-Side Ticket Filtering and Untracked Sessions
- The board's ticket list is now filtered server-side. GET /api/projects/{id}/tickets accepts ?statuses=a,b (for specific columns) and ?assignee=<id>|me. This reduces client-side processing by fetching only relevant cards.
- The Untracked rail is now opt-in, requiring ?untracked=1 to be sent, while its count is always returned. In the Kanban UI, Untracked moves from a rail with a collapse chevron to a filter-bar chip, off by default. TicketFilter.HideUntracked / hide_untracked is renamed to ShowUntracked / show_untracked to match.
- New dedicated agent operations: ticket_mine lists the caller's own tickets (resolved server-side), and session_untracked lists conversations not attached to any ticket. These operations refuse to widen their scope if no signed-in caller is present.
- Fixed an untracked sort bug that caused the "newest first" page to desynchronize.
Enhanced Notes Management and UI
- Note actions (Edit and Delete) are now consolidated behind a "more" menu button. Deleting a note requires confirmation.
- Note bodies now render as Markdown, using a tighter style. The edit box provides a monospaced, roomy view, with Ctrl+Enter to save and Esc to abandon.
- The Notes rail tab now displays a count badge, with hidden notes counted separately.
- When editing a note, the entire row is dedicated to the input field, temporarily hiding other controls (checkbox, hide toggle, "more" menu, author line) to prevent accidental clicks and maximize typing space.
- Notes in the panel now list newest-first (agents still receive them oldest-first for chronological context).
- Fixed rendering issues where prose lines became separate paragraphs, ordered lists restarted incorrectly, quotes leaked markers, and custom CSS conflicted with Markdown renderer styles.
- The side panel's resize handle now works on all rail tabs (not just source diff) and allows widening up to two-thirds of the window.
Improved Rail Layout and Side Panel UI
- Conversation rail panels are now folded by name (instead of count), ensuring consistent visibility. Hidden panels are explicitly named.
- Panel visibility is now persisted correctly, distinguishing between an unconfigured state and an empty (all unfolded) state.
- The "More" button badge now correctly counts hidden panels, and the list within "More" only shows hidden panels. The "Arrange mode" is removed.
- Panels can be dragged between the main strip and the "More" menu. The "More" panel now opens upward.
- The side panel's content now respects the rail's fixed position, using margins instead of padding to prevent scrollbar misalignment and dead space.

v1.1.0 — Caller Identity Everywhere

Added

Codex agents reach wick's tools as the real user. A codex spawn previously had no MCP wiring at all — no wick_list, no connectors, no wick_me — so an agent on that provider had none of wick's surface. It now receives the same per-session credential claude gets, authenticating as the human behind the session.
The shape differs from claude by necessity: codex has no --mcp-config equivalent, so the server is registered with TOML config overrides and the bearer is read from an environment variable named in that config. A useful side effect is that the token never enters argv, which is world-readable in process listings.
My tickets, and untracked sessions. ticket_list gains mine / assignee filters, plus two named ops for the questions people actually ask: ticket_mine (the caller's own tickets) and session_untracked (conversations attached to no ticket at all).
mine resolves the user server-side from the credential, so no user id is passed or accepted — a model cannot read someone else's queue by supplying an id. Tickets nobody owns stay on ticket_list with assignee=unassigned; that is a different question from an untracked session, and the op descriptions say so rather than leaving a model to guess.
Untracked-ness is checked against the ticket's own session list, not the denormalised session.Meta.TicketID back-pointer — a pointer left behind by a deleted ticket would otherwise hide a session that is untracked, which is exactly what the op is asked to find.

Fixed

Notes were attributed to "agent" instead of the person who wrote them. One conversation could show Admin for a note added in the web UI and agent for the identical act through an agent, and once two people shared a conversation their notes were indistinguishable. Notes now record the caller's user id, which the UI resolves to a current name, so a rename is reflected on old notes. Calls with genuinely nobody behind them (cron, system jobs) record unknown and render as "unknown user" — the old value named an actor that does not exist.
wick_me reported wick-agent-internal instead of the real user. Sessions started from Slack ran as the synthetic admin — full connector visibility, no tag filtering — and retrying never helped. Two causes, both fixed:
- The session owner was written to disk but the in-memory registry was never refreshed, while the per-spawn credential is minted from that registry. So the owner was recorded correctly and every later spawn still fell back to the shared internal token. Only a server restart could clear it, which is why the symptom looked permanent.
- The owner was only stamped on a session's first message, so any thread created before per-user identity shipped never got one. It is now stamped on every message — idempotent, and it backfills those older threads on their next reply.

Removed

WICK_STRICT_MCP. The flag decided whether a spawn passed --strict-mcp-config, as one process-wide value applied to every spawn. That stopped making sense once each spawn carries its own per-user credential: a single global switch cannot express a per-user decision.
It was also never a security boundary. wick injects its own MCP server per spawn, so isolation only ever dropped the user's other MCP servers — it never restricted wick's own tools, which are enforced server-side by tags and per-op access. wick now always merges; use WICK_DISABLE_SHARED_MCP to turn the loopback injection off entirely.

Notes

gemini still has no MCP wiring. Its CLI's support is unverified, and the existing spawn code documents its own argv as best-effort, so it was left alone rather than built on an assumption.

v1.0.0 — User Identity & Channels

Released on 2026-08-23

Added

Per-user MCP identity: An agent's MCP calls now run as the wick user behind the conversation instead of one shared admin principal. Each spawn carries a credential minted for its session owner, so connector access control and tag filtering finally apply to a normal chat. Previously, every user's spawn authenticated as the same synthetic admin and was indistinguishable from every other. Sessions with no owner (cron, system jobs, rows predating ownership tracking) keep working on the old fallback.
wick_me tool: Reports who the current MCP connection is authenticated as — user_id, name, email, role, is_admin, is_owner, approved — resolved server-side from the caller's credential. It also returns filter_tag_ids, so an agent can explain why a connector is missing from wick_list rather than insisting it should be there. is_system and is_local_cli distinguish non-human principals (cron jobs, and wick mcp serve, which binds to the first admin by design). See MCP ▶ Caller identity.
Slack sender identity: A Slack thread now becomes a session owned by the wick user behind the sender — the same identity they would get by opening it in the web UI — so the agent runs with that person's connector access. The join key is the sender's email, which requires the users:read.email scope on the Slack app; without it, senders cannot be matched and messages are refused with email is required. Guests, bots, and senders with no readable email are always refused, and the check runs before the agent spawns. See Channels ▶ Sender identity.
Channel auto-register (Agents settings → Session Identity, channel_auto_register, default off): Creates a wick account for a Slack sender whose email has none. The account arrives unapproved, never admin, and with no password — Slack vouches that the address is on the workspace, not that the sender controls it, so an admin approving it under Admin → Users is what turns one claim into the other. The switch is install-level rather than per-channel on purpose: channel config rows are per-owner, so a per-channel toggle would let any user who adds their own bot create pending wick accounts.
Merge channel accounts: Channels that report no email (Telegram) cannot be matched to an existing wick user, so a sender there necessarily arrives as a separate account with a synthetic …@channel.local address. Admin → Users now flags such rows and offers Merge accounts to fold one into the person's real account, moving its channel connections across and deleting the source. Merging is a human decision on purpose — the only other signal is a display name, and merging two people who share one is worse than leaving them apart. Merging away an admin or owner is refused, since a merge deletes the source account.
Approval notices reach admins too: When a user is approved, the other approved admins are notified alongside the user. Approval is the moment an account gains access, so this serves as an audit trail.
Channel connections: Wick now records which chat account belongs to which user — channel, workspace instance, account id — so it knows where a person can be reached. The account page gets a Channel connections panel listing each linked chat account with a Pause switch; pausing is enforced when a notification is sent, not merely shown in the UI. The web dashboard is not listed, since every user can always be reached there.
Account notifications: Approved admins are notified when someone registers through a channel and needs approval, and the user is notified when their account is approved. Both go out over browser push and every un-paused chat connection, so the notice reaches the channel the person is actually watching. Delivery is best-effort — a failed Slack DM never fails the approval or the registration.
View as user (impersonation): Admins can switch into an approved non-admin account from Admin → Users to see wick exactly as that user does, with a persistent banner and a one-click way back. Impersonating another admin or the owner is refused, so no single admin account becomes a route to the others, and both directions are logged with both user IDs.
Slack honours the Agents tool permission: After identifying the sender, the Slack path applies the same CanAccessTool check on /tools/agents that the dashboard applies, so a user who cannot open Agents in the web UI can no longer get one by messaging the bot. Approval is checked first, then Agents access, and each refusal names its own fix — a pending account is told to wait for approval, an approved-but-ungranted one is told to ask for the grant.
Caller-change recycle (agents.respawn_on_caller_change, default off): When a second user sends into a session already running for someone else, the subprocess is restarted so the new turn runs under that user's own identity. A live subprocess carries the credential of whoever spawned it — it sits in the process argv and cannot be swapped in place. Off by default because recycling costs the process's in-memory context.

Changed

Connector list is a catalogue, not an inventory: Every registered connector type is now listed for every user, even with no instance configured. Previously, non-admins only saw a connector once an admin had created an instance, so on a fresh install the list was empty for them with no way to discover a connector or ask for one. Cards carry only name, description, and operation count — instance-level tag scoping is unchanged. System connectors and admin-disabled types stay hidden.
Per-session MCP credentials are now revoked when their subprocess exits, rather than remaining valid until their TTL.
Slack health check covers the email scope: Test Integration now probes users:read.email explicitly. That scope fails silently — users.info still succeeds without it and just returns a blank email — so nothing else in the check could reveal it, and every sender would be refused with email is required while the operator had no idea which scope was missing. It fails only when no member has an email; partial coverage is reported as a note, since real workspaces have members with no address on file.

Fixed

Duplicate accounts from a renamed channel email: A Slack sender was matched to a wick user by email only, so editing their Slack email and messaging again registered a second wick account for the same person. Identity is now resolved from the channel account ID first — which never changes — and falls back to email only when no link exists yet. An existing link also wins over a conflicting email, so changing a Slack email to someone else's address cannot take over their account.
Sign out doing nothing: The logout button could silently fail — no navigation, no request, nothing in the console. The form is intercepted to unsubscribe push notifications first, and that path awaited navigator.serviceWorker.ready, a promise that never rejects. When the service worker failed to activate, it hung forever and the re-submit was never reached. The unsubscribe is now raced against a short timeout, and signing out no longer depends on push cleanup succeeding.
The per-connector detail endpoint had no system or disabled check, so a guessed key returned metadata for a connector hidden from that user. It now answers unknown connector without confirming the key exists.

Notes

Non-admin users lose the admin-only MCP tools (wick_skill_*, wickmanager operations) they previously received for free while every agent spawn authenticated as an admin. This is the intended effect of per-user identity, but it is a visible change.
codex and gemini have no MCP wiring at all, so per-user identity does not apply to them yet. Guard tests now fail if MCP is added there, as a reminder to build it per-user from the start.

v0.40.1 — Board Columns

Released on 2026-08-22

Added

Custom board columns: Ticket statuses are now defined per project as an ordered list of custom stages, allowing teams to name their own workflow stages (e.g., triage → coding → shipped).
- Exactly one column must be marked as the finished (terminal) stage. This is crucial for auto-resolve to move completed work and for the stale-followup timer to correctly identify work that should no longer be nagged. Board configurations missing a terminal column will be refused.
- Renaming a column's display label is free.
- Removing a column that still holds tickets is refused, preventing tickets from being stranded.
- Leaving the column list untouched preserves the built-in open, in_progress, waiting, and done set.
- The default status for new tickets (ticket.Create) is now taken from the project board's first column, rather than defaulting to "open".
- The board, ticket page, and conversation rail dynamically draw their columns from the project configuration, with column accents following board order and the terminal stage always indicating completion.

Changed

Documentation: Updated stale references to fixed ticket statuses within the tickets connector, stale-followup settings, and the wick-tickets skill to correctly reflect the new per-project board columns and terminal status logic. Specifically, ticket_update and ticket_create now point to project-defined columns, stale-followup uses the project's terminal column, and wick-tickets no longer lists only the four built-in statuses as valid.

v0.40.0 — Tickets & Notes

Released on 2026-08-22

Added

Tickets as entities, with notes, and a project settings revamp:
- Tickets are now their own on-disk entities (projects/<id>/tickets/<T-XXXX>/) holding zero or more sessions, rather than a field on the session itself. This allows a fresh session to continue an existing ticket's status, assignee, fields, and notes.
- A kanban board on the project page shows tickets as cards, including an Untracked rail for chats not associated with a ticket. Tickets can be dragged between columns to change status, chats can be dragged onto a card to attach them, or onto a column to create a new ticket. Board filters (statuses, assignee, view mode) are saved per user per project in UserMetadata, preserving individual views. The board is optimized to only render visible items, showing totals without holding all data.
- Tickets support automated lifecycle management: stale tickets past a follow-up window will wake the session's agent with the project's follow-up prompt, while idle tickets past an auto-resolve window will close.
- For enabled projects, sessions initially without a ticket are automatically adopted as open, making the feature retroactive. Ticket mode is per project and off by default, ensuring no changes to existing projects.
- Notes are a separate markdown subsystem, scoped either to a ticket (shared by every session on it) or to a standalone session. Each note has an audience (ai/human/both) and an optional hidden flag. Note bodies are never injected into the system prompt; sessions receive a fixed-size pointer naming the ticket and note count, with agents reading necessary details via MCP. Notes travel with a session when attached, moved, or detached.
- Two new MCP connectors, tickets and notes, have been added. They are kept separate to allow granular control over permissions (e.g., granting note-taking without full board access). The wick-tickets and wick-notes built-in skills are also included. The earlier wick_ticket_get/wick_ticket_set meta-tools are removed in favor of the tickets connector.
- Per-project auto-create rules allow new sessions to automatically receive a ticket based on origin, channel kind, and a contains/regex match on their first message. Rules are tried in order, with the first match winning, enabling disabled narrow rules to carve exceptions out of broader ones.
- When deleting a ticket, the system now asks what should happen to its associated chats, providing a count. Moving the last chat off a ticket offers to remove the ticket's husk, but actions that destroy conversations always require confirmation.
- Project settings have been revamped with single-column sections, collapsible editors displaying their setting in the subtitle, and background auto-save without a dedicated Save button. A delayed save indicator ensures fast saves do not paint a spinner.

v0.39.10 — Session Management

Released on 2026-08-21

Improved

Enhanced session management by introducing scoped resume IDs.
Improved provider switching capabilities.

v0.39.9 — Agents & Skills

Released on 2026-08-19

Changed

Shipped Skills Reachable from Claude and Codex:
- Wick's embedded how-to skills are now stored in Wick's own skills directory (~/.<app>/skills/) alongside user skills, rather than the private ~/.<app>/builtin-skills/.
- claude and codex now utilize --add-dir to include Wick's skills directory. A generated catalog (containing skill name, description, and absolute SKILL.md path) is injected into claude's system prompt and codex's soul.md, enabling these agents to discover and access shipped skills.
- Skill directory refresh is now content-addressed (MD5 comparison), preventing unnecessary rewrites and preserving mtime for unchanged files. User skills in the shared directory are untouched. Stale shipped skills are only pruned if dropped by the embed and still marked as "MANAGED BY WICK".
- Shipped skill names continue to be excluded from sync, upload, and push operations, preventing unmanageable copies in ~/.claude/skills or ~/.codex/skills.
- claude and codex skill directory resolution now correctly honors $CLAUDE_CONFIG_DIR and $CODEX_HOME when set.
- InProvider now correctly reports shipped skills as present for all providers, resolving their visibility in the / composer. These skills are also no longer listed in MissingProviders to avoid inviting unfeasible sync actions.
Agent Scope Naming Uniqueness:
- Agent scope unit names now incorporate Wick's process ID (PID), ensuring uniqueness across Wick restarts (e.g., claude-agent-<pid>-1). This resolves "Unit already loaded" errors and prevents spawn loops that occurred when the spawnSeq counter reset.
Enhanced Agent Visibility and Session Management:
- The Resources page now includes a "Wick / Outside Wick" badge, clearly identifying which agents were spawned by Wick versus those from external services. This helps in understanding which uncovered agents can be managed directly through Wick's features.
- Expanding an agent's row on the Resources page now displays the owning session and provides a clickable link to it, for agents actively managed by Wick's pool.

v0.39.7 — Skills & Agents

Released on 2026-08-19

Agent Memory Management

Fixed

Agent process detection on Windows, where memreport.Roots now compares via BaseName to accurately match executables like "claude.exe".

Changed

The memory limit enforcement method is now split into two independent switches: on spawn (for agents Wick starts) and on path (for any agent invoked via a shim).
Existing configurations using auto or scope are now migrated to on spawn, and wrapper to on path, preserving current behavior without requiring config rewrites.
The generated shim sets MemoryHigh=infinity and MemorySwapMax=0, ensuring throttling rather than abrupt termination.
Shim creation and removal processes no longer call sudo; commands are returned as text for manual execution. Uninstall is a two-step process to prevent temporary breakage.

Added

A new "Coverage" panel on the Resources page, prominently displaying the count of uncovered processes and commands to bound them.
Individual agent rows now include limited/no-limit chips, reflecting their actual cgroup memory status.
Memory limit scans now report every matching process on the machine, not exclusively those started by Wick.
An AGENT_NO_CGROUP escape hatch and fall-through logic for scenarios where systemd-run or XDG_RUNTIME_DIR are unavailable.

Shipped Skills Reachable from Claude and Codex

Changed

Wick's embedded how-to skills now reside in Wick's own skills directory (~/.<app>/skills/), alongside user-defined skills, instead of the private ~/.<app>/builtin-skills/ directory.
claude and codex now include Wick's skills directory via --add-dir and receive a generated catalog (name, description, absolute SKILL.md path) injected into their system prompt or soul.md for skill discovery.
Skill refresh is now content-addressed (MD5 comparison), ensuring user skills are never touched and unchanged shipped files retain their modification times. Stale shipped skills are only pruned if dropped by the embed and marked "MANAGED BY WICK".
Shipped skill names are explicitly excluded from sync/upload/push flows to prevent unmanageable copies in ~/.claude/skills or ~/.codex/skills.
claude and codex skill directory resolution now respects $CLAUDE_CONFIG_DIR and $CODEX_HOME environmental variables for accurate pathing.
InProvider now correctly reports a shipped skill as present for all providers, and shipped skills no longer appear in MissingProviders.

v0.39.6 — Slack

Released on 2026-08-18

Added

Slack Lists Operations:
- Introduced a new "Lists" category to the Slack connector, wrapping Slack's slackLists.* API.
- Includes read operations: list_lists, get_list, list_list_items, get_list_item.
- Includes destructive write operations: create_list, create_list_item, update_list_item, delete_list_item. These are OpDestructive and disabled by default on every instance.
- Note: list_lists utilizes Slack's files.list method with types=lists and requires the files:read scope, as Slack does not provide a dedicated slackLists.list method. This is documented in the scope map and operation documentation.
- Other Lists operations require lists:read or lists:write scopes.
- Slack Lists are a paid-plan feature.
Slack Custom API Escape Hatch:
- Added a "Custom" category with a new custom_api_call operation.
- This operation allows calling any Slack Web API method for which the connector does not have a dedicated operation.
- The operation is OpDestructive and disabled by default on every instance.
- Configurable via two new connector fields:
  - CustomAPIMode: Defaults to allowlist, can be set to all.
  - CustomAPIAllowlist: Specifies allowed method names, supporting trailing * for wildcards.
- Calls are validated: method names are checked against URLs, slashes, traversal, and query strings to ensure requests only target Slack. A token key in params is rejected to enforce the use of instance credentials for authentication.
- The custom_api_call operation is intentionally omitted from static opScopes mappings; its required scopes depend on the specific Slack API method called, and Slack's missing_scope error acts as the runtime check.
- Blocked calls fail before any outbound request, providing an error message that names allowed methods.

v0.39.5 — Agents

Released on 2026-08-18

Added

Memory Guard Raw CgroupFS Fallback:
- Implemented raw cgroupfs as a fallback mechanism for memory guard enforcement on Linux hosts that do not run systemd as PID 1 (e.g., containers, Fly.io Machines).
- The backend detection now ranks systemd-run first, then probes for cgroupfs.
- The cgroupfs path re-execs the Wick binary (wick __agent-exec) to join the cgroup and then exec into the target agent process, preserving PID and PGID for teardown.
- Added 30 new tests for the memscope and memguard components.
Embedded How-To Skills:
- A set of user-facing "how-to use Wick" skills (connectors, plugins, workflows, agents, rich output, Slack replies) are now embedded directly within the binary.
- These skills are extracted to ~/.<app>/builtin-skills/ on boot and during skill sync.
- Built-in skills are read-only, outside the normal sync rotation, and wipe their directory before extraction to ensure only current versions are present.
- SkillInfo now includes a Builtin field to distinguish shipped skills from user-installed ones.
Wick Resource Limits Skill:
- Introduced a new user-facing wick-resource-limits skill, serving as the guide for operators on applying and understanding resource limits.
- This skill clarifies measure mode behavior, platform-specific enforcement capabilities (Linux-only enforcement, but reporting and recovery everywhere), key resource measurements, and best practices for applying suggested limits.

Fixed

Documentation Dead Link:
- Corrected a dead link in env-vars.md pointing to the connector plugins guide, resolving build failures.
CgroupFS Scope Leaks:
- Resolved an issue where cgroupfs scope directories were leaked after agent exits. MemGuard.ReleaseScope now calls RemoveCgroupScope to clean up these directories.
- Corrected the readv1.go doc comment regarding the cgroup v1 reader.
Platform-Specific Test Assertions:
- Moved a Linux-only test (TestMemGuard_CgroupFSBackendReExecsSelf) from the general memguard_test.go to memguard_cgroupfs_linux_test.go to prevent failures on non-Linux platforms.
Folder Skill Sync & Provider Catalog:
- Fixed a bug where skill synchronization ignored folder skills, resulting in empty skill menus for providers. Sync() now correctly walks folders and merges files based on recency.
- Corrected the logic for matching provider types to directory labels, ensuring skills are correctly listed under the "wick" provider.
- Addressed catalog truncation for the wick provider, which previously limited descriptions to 8KB, causing skills to be omitted. Descriptions are now trimmed per skill to ensure all are listed.
- Fixed skillEntrySync to resolve file changes by individual file mtime rather than folder mtime, preventing older files from overwriting newer ones.
- Invalidated skill caches after sync/upload operations to ensure UI updates reflect current skill lists immediately.
- Improved skill copy reporting by adding SkillsCopied to the Result structure.
Skill Frontmatter Parsing:
- Fixed parsing of skill frontmatter to correctly handle leading HTML comments and YAML block scalars (folded and literal styles), which previously caused incorrect skill metadata (empty names, literal >- descriptions).
Built-in Skill DirLabel:
- Corrected the DirLabel for the built-in skills directory to "built-in" instead of the app name, preventing them from being mistakenly treated as user-installed skills.
README Listed as Skill:
- Ensured dot-prefixed README files within skill directories are correctly skipped during skill scanning, preventing them from being listed as skills.

Changed

Memory Guard Documentation:
- Updated memory guard documentation to reflect the cgroupfs fallback, clarifying enforcement capabilities on systemd-less hosts.
- Replaced the Linux-only section with a table detailing requirements and reporting differences between systemd-run and cgroupfs backends.
- Documented that cgroup v1 has no oom_kill counter, so OOM kills via this backend cannot be explicitly reported.
- Clarified that systemd contention controls (CPU, task, IO) do not apply to the cgroupfs backend.
- Removed the unused scope method from memory_guard_method config, as it behaved identically to auto.
- Enhanced the wrapper description, noting it bypasses aggregate ceilings and affects OOM reporting.
- Updated the agent-resource-guard development skill to reflect current capabilities.
Skill Sync Logic:
- When a skill name exists in both built-in and user-installed directories, metadata now resolves from the built-in copy, ensuring shipped skill descriptions are authoritative.
- Skill catalog truncation for the wick provider now trims individual skill descriptions rather than the entire list, ensuring all skills are listed even with long descriptions.

Removed

Unused Skill Management Functions:
- Removed Upload() and DeleteFromAll() functions from skill management, as they had no callers and Upload did not correctly handle skill folders.
- Removed the dead SplitList branch in DirLabel.

v0.39.5 — Memory Guard

Released on 2026-08-18

Agents

Added

Memory guard works on hosts without systemd: Enforcement previously required a reachable systemd user session, so on a host whose PID 1 isn't systemd (a Fly.io Machine, a bare container) agents ran unguarded. Wick now probes a second backend — raw cgroup v1 via a writable /sys/fs/cgroup/memory — and uses it when systemd-run isn't available. The ceiling is enforced by the same kernel mechanism and is exactly as hard; what the fallback can't do is confirm a kill, because cgroup v1 has no counterpart to v2's per-group OOM-kill counter, so such an exit keeps the generic reason rather than claiming a kill it can't prove. The systemd backend stays preferred, and a machine with neither still says so plainly instead of implying protection that isn't there. See Memory Guard ▶ Linux only.

Changed

memory_guard_method no longer offers scope: It was documented as "wick always applies it", but nothing in the code ever distinguished it from auto — both took the identical branch, since only wrapper was ever tested for. The dropdown now offers auto and wrapper, the two values that actually behave differently. A config that already stores scope keeps working and behaves as auto, exactly as it always did. The wrapper description now also spells out what wick stops doing under it: the combined slice ceiling and the CPU/task/IO controls are never written, and an OOM kill is reported as a plain stop rather than naming the limit it broke.

Fixed

Scope directories no longer accumulate on the cgroupfs backend: systemd-run is passed --collect, which reaps a transient scope as soon as its last process exits; raw cgroupfs has no daemon behind it, and scope names carry an increasing sequence, so every spawn left a permanent cgroup directory behind — unbounded growth on a long-running host, each group holding a little unreclaimable kernel memory. Scopes are now released on the agent exit path, after the exit stats are read (removing the group takes its accounting files with it). A group that still holds a process refuses to be removed, which is the correct outcome: an agent that outlived its wick stays contained.

v0.39.4 — Process Termination

Released on 2026-08-17

Added

End a process from the Resources page: The process explorer's row menu can now end a process, or every process sharing an executable name, from /tools/agents/resources (admin only). Wick itself and PID 1 (init) can never be targeted, and a group kill stops at 25 processes and reports what it skipped. Sends SIGTERM on Unix; on Windows, which has no equivalent for an arbitrary process, it ends it outright via TerminateProcess. Protected processes (Wick itself, PID 1) are visually marked in the UI with a badge and a hover explanation, and their row menu replaces the "End" option with the reason for refusal. Refusals are logged and the API responds with a 200 status and the reason in the body, providing server-side visibility into why a process was not terminated.

v0.39.3 — Agents

Released on 2026-08-17

Improved

Process Explorer:
- Added command lines for each process, enhancing identification of ambiguous processes (e.g., multiple "node" or "python3" instances). Command lines are read from /proc/<pid>/cmdline on Linux and the full image path on Windows.
- Search functionality now includes process command lines.
- Command lines are displayed sparingly: they are dropped if identical to the process name, truncated to one line, and expand on click for full, selectable text.
- The process explorer now refreshes every 10 seconds, matching the summary cards, to ensure data consistency.

Fixed

Resolved a false positive in wick-agent status that incorrectly reported "running (via systemd)" on hosts without systemd (e.g., Fly.io). Source detection no longer solely trusts the INVOCATION_ID environment variable; it now requires confirmation from systemd's own resources (/run/systemd/system) or falls back to checking PID 1's name. This fix affects only the informational label; the underlying enforcement path was never impacted.

v0.39.2 — Agent Resources

Released on 2026-08-17

Agent Resource Guard Skill

Added
- Comprehensive documentation for the agent-resource-guard skill, detailing its design rationale, key invariants (measure writes no slice limits, MemoryHigh/swap pinned, no guessing an OOM, no min() on the per-instance limit, append-only ExitReason), and important frontend considerations.
Improved
- Clarified documentation to prevent common misinterpretations, specifically regarding "measure mode writes nothing" (it withholds limits but records usage in full) and "why swap must stay off" (prevents thrashing and ensures process termination rather than merely being unpredictable).
- Added dedicated sections addressing common misreadings ("Easy to read backwards") and outlining "What survives without scopes" with a per-capability table for environments like containers and Termux.

Resource Monitoring & Management

Added
- Per-process list for agents: Agent resource rows now expand into a task-manager view, displaying individual processes (process, PID, parent, memory) within the agent's tree. Processes are ordered heaviest first, capped at 12, with ties breaking on PID for stable ordering.
- Disk capacity monitoring: Reports available disk space for the WICK_DATA_DIR path. Displays "Available" alongside "Free" to account for filesystem reservations (e.g., ext4's slice for root) that an unprivileged wick cannot use. Supports Linux, macOS, and Windows.
- Chart hover readouts: Sparklines on the Resources page now display a crosshair and a tooltip with the exact value and timestamp when hovered. The tooltip uses HTML to preserve aspect ratio.
- Machine-wide process view: Introduced a new section displaying the top five processes by memory, CPU, and disk, alongside a searchable, paginated explorer for all processes on the machine. Processes are grouped by executable and ranked by current rate (not lifetime counters).
- Windows support for machine-wide process listing and total machine memory readings, extending measurement capabilities beyond Linux.
- Agent crash recovery: Agents now automatically restart on ExitError (up to 3 times in 10 minutes) and are notified to continue their conversation, making crashes otherwise invisible from within the session. Exits due to OOM are deliberately not restarted, prompting the agent to adopt a smaller approach.
- Wick's own OOM protection: The wick daemon's oomscore is now lowered in enforce mode to protect it from being targeted by the kernel's OOM killer, ensuring core daemon survival.
Improved
- Disk usage bars now visually indicate pressure: yellow past 75% and red past 90% capacity.
- Disk pressure is graded by considering both percentage and absolute free space, preventing false alarms on large disks with ample remaining capacity.

v0.39.1 — Agents

Released on 2026-08-16

Fixed

Corrected the serving of the "Resources" bundle for the Agents UI. The Single Page Application (SPA) asset handler was updated to use the correct base path, resolving a 404 error when the bundle attempted to load.
Added a sidebar icon for the "Resources" entry within the Agents navigation.
Ensured the "Resources" entry correctly triggers the auto-expansion of its parent "More" group when navigated to.
Introduced new tests to verify the SPA asset serving and the proper rendering and functionality of the navigation link.
Addressed a CI issue by making the "Resources" SPA test skip execution when the frontend bundle has not yet been built, ensuring compatibility with the release pipeline's test order.

v0.39.0 — Agent Resources

Released on 2026-08-16

Agents

Added

Kernel-enforced memory guard for agents: A new memory_guard_mode (off default / measure / enforce) places each agent subprocess in its own systemd scope. This ensures that runaway processes (e.g., leaked browser, bad loops) are killed by the kernel without affecting Wick or other agents. It is configurable per-agent, with total and tool-command memory ceilings, a minimum-free-memory floor that queues new spawns, and contention controls (CPU weight/quota, max tasks, IO weight) on the shared agent slice. Ships off by default—behavior is unchanged until opted in. Linux only (requires a reachable systemd user session); degrades cleanly and reports when systemd is unavailable. A provider instance can also set its own memory limit, potentially exceeding the global default. See Memory Guard.
Resource usage analytics + Resources page: A new admin-only /tools/agents/resources page displays a live per-agent memory/CPU/disk table, trend charts, and suggested limits with an apply button. This is backed by an optional in-memory usage history (on by default) bounded by a retention window and a hard point ceiling. See Memory Guard ▶ Usage History.
wick memory report CLI: Reads /proc directly to report per-agent memory usage (including browsers/tools started by an agent) and suggest limits, with an optional --watch/--for mode to capture peaks over time. This works even when the memory guard is off. See CLI Reference.
Clearer OOM exit reason: When the guard kills an agent for exceeding its memory limit, the exit reason surfaced in chat and the spawn log now names the measured peak and the ceiling it broke, instead of a bare "agent stopped".

Fixed

Sampler lifetime leak: Addressed a goroutine leak where the resource usage sampler ran on context.Background(), preventing its proper termination during server shutdown.
Zero-limit OOM message: Corrected the Out-of-Memory (OOM) exit reason message for agents killed by an aggregate slice limit or machine memory exhaustion. Previously, it incorrectly reported "its 0 MB memory limit." The message now accurately names the cause and reports the measured peak when available.
Suggested limit headroom rounding: Improved the headroom calculation for suggested memory limits. The calculation is now performed in bytes and rounded up, ensuring that even small limits receive the intended 30% headroom and are never at or below the observed peak.

Ops

Changed

wick install service's systemd unit now rate-limits restarts: The systemd unit now includes StartLimitIntervalSec=300 and StartLimitBurst=3 to rate-limit restarts. This prevents a crash-restart-crash loop (e.g., due to repeated OOMs) from restarting invisibly forever, instead surfacing as a visible failed unit.

Infrastructure

Added

WICK_DATA_DIR to relocate the entire data tree: Introduced the WICK_DATA_DIR environment variable to establish a single root for all data (configuration, database, logs, agents, skills, plugins, and control sockets). This allows users to easily relocate the entire application data tree away from ~/.<app>/. This override takes precedence over userconfig.Dir and the rule for wick.yml being next to the binary. The gate --config output now explicitly prints the resolved data_dir and its source.

v0.38.6 — Wick

Released on 2026-08-14

Added

Per-model Custom HTTP Headers for Wick Provider:
- Introduced a new Headers field for Wick models, allowing users to define custom HTTP headers for their requests.
- These custom headers are applied last over the adapter's own headers (including authentication), enabling use cases such as custom proxy authentication schemes or explicit control over client fingerprints like User-Agent.
- The parsing is lenient, accepting formats like curl's --header 'K: V' or simple "K: V" lines.
- Model discovery now incorporates these headers, ensuring that gateways requiring specific headers for /models endpoints function correctly. The model picker re-fetches listings as headers are typed, allowing models to be discovered before saving.
- The "Copy as cURL" feature now merges custom headers, ensuring that the generated command accurately reflects what Wick sends.
- Advanced options sections, including raw config and custom headers, now open collapsed by default, with a badge indicating when a section holds a value.

Documentation

Added documentation for the new Custom headers field, detailing its last-wins-over-auth semantics and its effects on model discovery and copy-as-curl.

v0.38.5 — Agents & Widgets

Released on 2026-08-13

Agents

Added

Per-model custom HTTP headers on the built-in wick provider: each wick model's Advanced options now has a Custom headers field — one Key: Value per line, or a pasted curl --header fragment (flags/quotes/continuations are cleaned up automatically). Headers apply last, overriding even the adapter's own auth headers (Authorization / x-api-key / anthropic-version), so a fronting proxy can use its own auth scheme or spoof User-Agent. Also honored by model discovery and the "copy as curl" reproduction. See Custom HTTP headers.
Scheduled messages can be project-scoped: a schedule no longer has to nudge one pre-existing session. Pass project_id instead of session_id and each fire opens its own session in that project, so a recurring job starts from clean context every run — the natural shape for "every Monday 9am, write the weekly report". A new session_mode picks how the target is resolved per fire: existing (the previous behavior, still the default with session_id), new (generated session per fire, the default with project_id), or template (session named by rendering session_template against the fire time — daily-{date} — so fires within the same day share one session). Available on wick_schedule_message, a session's Scheduled tab, and the Scheduled page. See Scope: where a fire lands.
Scheduled page: scope filter + click-through detail/edit: /tools/agents/scheduled gained a scope selector (All scopes / Project jobs / Session nudges), a Project jobs stat tile, and grouping by project for project-scoped rows (with a link to the session the last run landed in). Clicking any row opens a detail dialog showing status, cadence, next/last run, provenance and the last error — and, for a live schedule, editing its timing, message, max runs, and (for a project job) its project and session mode, with a live preview of the resulting session name. The same dialog is available from a session's Scheduled tab.
run_now: fire a schedule immediately: new action=run_now on wick_schedule_message, and a Run now action on live rows in both UIs. It makes the schedule due and pokes the runner so the fire lands in seconds instead of at the next poll — the practical way to test a schedule instead of waiting for the clock. The schedule's definition is untouched: a recurring job advances from this fire exactly as from a natural one, and a paused schedule is resumed by the call. See Testing a schedule.
reschedule can now move a schedule between session and project scope: name a project_id to turn a nudge into a project job, or a session_id to pin a job to one conversation. The move is authorized against the new target and the row's owner is re-stamped to match the new scope, so it cannot be used to park work inside a project you can't reach. Changing a schedule's kind (one-shot ↔ recurring) is still refused.
list gained status and limit: action=list now returns only live schedules (pending, active) by default and truncates each row's message to a message_preview, so asking "what is scheduled?" no longer returns every cancelled schedule from months ago with its full multi-thousand-character prompt. Pass status=all (or a comma-separated subset) and limit (default 50, max 500) to widen it.
Active project in sidebar auto-centers: The Projects list is capped at max-h-40, so with many projects the scoped one could sit off-screen on page load. The active row is now marked and the container scrolled to center it.

Fixed

run_now's response no longer looks like it moved the schedule. A manual run borrows run_at to become due, and the response was reporting that borrowed value — so next_run_at read as "now", exactly as though the cadence had been overwritten. It now always reports the schedule's own next fire, with a separate manual_fire_pending flag for the extra run in flight, and a note spelling out that nothing changed.
paused is readable as a status. A paused schedule reported status: "active" with a separate paused flag, so anything reading only status saw "active" for something that would never fire, and there was no status value to filter on. The API now reports status: "paused" (still stored as active + flag, since a paused schedule keeps its place in the cadence) and accepts status=paused in list.
A cancelled-but-never-fired schedule no longer outranks real history in listings. Cancelling before the first fire leaves the future fire time on the row, and sorting on it put those rows above schedules that had just run — with a small limit, pushing the actual history out of the result. Listings are now tiered: live (soonest first), then finished-that-ran (most recent first), then never-fired.
list gained target_session_id, and session_id's meaning is documented. session_id matches everything related to a session — including project jobs merely created from it, which deliver elsewhere — so it couldn't answer "what will actually land here?". target_session_id is the strict filter; both are now described in the tool schema.
A manual run's session is no longer named like scheduled fire zero. In session_mode=new, run_now produced sch-<id>-0 because a manual fire doesn't advance the run count — off by one against the 1-based scheduled series and easy to confuse with the first real run. Manual fires now get sch-<id>-manual-<n>.
Lifecycle errors name the actual state. reschedule/pause/resume on a finished schedule said only "schedule is not in a state that allows it"; it now reports which state (e.g. "schedule is done — only a live (pending/active) schedule can be changed").
Delivery-latency claim corrected. The tool description said fires land "typically 3-6s" late; the real lag is the distance to the next 30s poll tick, so anywhere from ~0 to ~30s. Stated accurately now, along with the fact that lateness never accumulates.
Recurring schedules no longer drift. For an interval schedule, fire N is now anchor + N × interval — the series is fixed at create time and no individual fire can move it. Previously the next fire was computed by adding the interval to whenever the last one actually landed, so an hourly schedule delivered 4 seconds late (poll granularity) drifted 4 seconds every hour, and a single pause/resume re-anchored it permanently: resuming an hourly job at 10:50 moved every future fire to :50. Resuming now lands on the slot the schedule would have hit anyway (11:00). Cron schedules were never affected — the expression is the series. See Cadence is absolute.
run_now is a true dry run. It no longer consumes max_runs or shifts the next fire — the note printed on create said it changed nothing, and now that is actually true. A manual fire stamps last_run_at and a separate manual_runs counter, so a max_runs: 1 schedule still gets its one scheduled fire after you have tested it, and a one-shot still fires on its own schedule.
Schedule listings are ordered usefully. Live schedules come first with the soonest fire at the top, then finished rows newest-first. A single run_at DESC put the furthest-future schedule first and, once limit applied, cut the imminent fires off the bottom while keeping months-old history.
The cron timezone is reported instead of having to be probed. Every cron schedule now carries cron_timezone (e.g. Asia/Jakarta (UTC+07:00)), named in the create response and shown in the detail dialog. The zone was documented but never stated per-schedule, so the only way to learn it was to schedule a probe and watch when it fired.
reschedule really does move a schedule between scopes. The tool description advertised it; the implementation refused it. Now allowed, with the new target authorized and the row's owner re-stamped to match the new scope.
source_session_id is exposed. A project job has no session_id, so this is the only link back to the conversation that created it; it was recorded but never returned.
Docs/prompt: seconds and delivery timing. The system prompt now mentions that run_at/every accept seconds (+30s), the project-scoped modes, and run_now. The tool description states the baseline that delivery is polled, so every fire lands a few seconds (typically 3–6s) after its nominal time.
A reaped session no longer kills a recurring schedule: previously a recurring schedule whose target session had been reaped failed permanently on its next fire ("target session not found"). Project-scoped schedules create their target session, so they cannot be orphaned this way. Session-scoped schedules keep the existing fail-fast behavior.
A project job is no longer visible only from the session that created it: project jobs now appear (and can be paused, cancelled, or edited) from every session in their project — they belong to the project, so moving to a sibling conversation no longer makes them vanish. Previously they were only reachable from the creating session or the global page.
Finished schedules no longer report a fire time a century away: the runner parks run_at ~100 years out while a fire is in flight, as a guard against a crash between claim and delivery re-firing the row. That internal sentinel leaked into the API and UI once a schedule finished, so a completed schedule read as "next run in 2126" and sorted ahead of everything in a run_at ordering. Terminal transitions now restore the real time, and the API publishes a next_run_at only while a schedule can still fire.
Sub-minute cadences display correctly: a 30-second interval rendered as "every 1m" (it was rounded to minutes before formatting); it now reads "every 30s".
Docs: run_at accepts seconds, and cron's timezone is stated: relative durations always supported seconds (+30s), but only minutes and above were documented. Cron expressions are matched against the server's local wall clock — now called out explicitly, since a report set in the wrong zone is hours off.

Widgets

Added

Opened tabs can escape the artifact sandbox: Previously, a widget link opened with allow-popups still carried the frame's opaque origin, leading to Origin: null for the destination site and issues with CORS/localStorage. A new allow_popup_escape knob is introduced, enabling popups opened from a widget to escape the sandbox's opaque origin. This knob is off by default under secure policies, on under unsecure, and opt-in under custom policies. It implies and is gated on allow-popups.

v0.38.4 — Connectors & Manager

Released on 2026-08-12

Connectors

Added

Playwright Browser: idle auto-close for live sessions (playwright_browser): a live session now closes itself after a period with no activity instead of staying resident until an explicit session_close (or reboot). New BrowserIdleTimeoutMin config (default 1 minute; named-profile sessions get 8x that value; -1 disables). session_list reports idle_seconds and auto_close_in_seconds per session, and the session-cap error on session_open now names the blocking session and its countdown instead of a bare count. See Idle auto-close.
Playwright Browser: optional orphan process sweeping: new BrowserKillOrphans config (off by default) also terminates browser processes under the session directory that no live session claims — children an engine forked on its own, or a re-forked PID the recorded one no longer matches. Ownership is decided by --user-data-dir, so a browser launched outside the connector is never touched. See Orphan sweeping.
Eight playwright_browser maintenance/admin ops (session_endpoints, extension_list, extension_install, extension_remove, browser_status, browser_install, browser_update, browser_uninstall) are now ConfigOnly — hidden from the MCP tool surface while remaining reachable from the manager UI. See Manager-only operations.

Fixed

Playwright Browser: zombie processes and stale profile locks: live-session launches weren't calling Process.Release(), leaking zombie processes on Unix. A browser killed without a clean exit (OOM, kill -9, host restart) also left Chromium's singleton lock files pointing at a dead PID, which made the next launch against that profile fail; they're now cleared automatically once the PID they name is gone.
Git CLI: checkout argv broken on git 2.43: checkout was invoked as checkout --end-of-options <ref>, a terminator position git 2.43 doesn't recognise — parsing fell through to pathspec matching, so the checkout silently never happened (2.44+ accepted it, which is why this passed testing on newer machines). Now emitted as checkout <ref> --, the portable form; since -- doesn't stop option parsing, checkout validates its ref through the same check branch_create uses so a flag-shaped ref is still refused. The two checkout -b branch-create paths also had a misplaced terminator that guarded nothing; it's now correctly placed before an optional start-point. See Git CLI ▶ What is guarded.

Manager

Fixed

html= widget checkboxes always submitted checked: the field collector read every named control's .value, but for a checkbox that's the static markup attribute, not its checked state — so an unchecked box still submitted as affirmative. Concretely, the git connector's policy editor checkbox for "Allow force push" re-enabled itself on every save regardless of whether it was ticked. Checkboxes and radios now follow HTML form semantics: unchecked contributes nothing, checked contributes its value (or "on"). See Config tags ▶ html — server-rendered widget.

v0.38.3 — Agents

Released on 2026-08-12

Fixed

Per-channel-instance Project setting ignored on Slack: Wick can host several bot instances of the same transport in one process (one per owning user), all sharing a single dispatch closure. Previously, that closure would re-read the project binding by channel type alone, returning an arbitrary agent_channels row. This meant that two Slack bots configured with different Projects could silently land in whichever project came back first.
- Each channel instance now stamps its own configured project onto the dispatch context via WithChannelProject, reusing the mechanism REST already had for per-request overrides. This ensures the per-instance ProjectID setting actually takes effect.
- The dispatch closure now reads the project from the context instead of querying the database, dropping a query per message.
- Typed ProjectID fields, which were previously inert for Slack, Telegram, and REST channels, are now correctly utilized. Slack's Hash() function also now includes ProjectID to ensure hot-reload fingerprints invalidate correctly on project changes.
- Configuration changes made in the UI for a channel instance (e.g., changing the project) are applied on the next message without requiring a restart, as the configuration is read under each channel's existing mutex.
- Existing sessions are unaffected and retain the project they were created with; only newly created sessions pick up this fix. The session pool will backfill Meta.ProjectID only when it is empty.
- Documentation has been updated to clarify per-instance project routing for Slack, Telegram, and REST channels.
- See Projects ▶ Slack / Telegram / REST default project.

v0.38.2 — Agents

Released on 2026-08-11

Agents

Added

Configurable Content-Security-Policy for HTML widgets: The Content-Security-Policy (CSP) applied to HTML artifacts (file artifacts and inline ```html blocks) is no longer hardcoded.
- A new Widget config group (global, under Agents config) now allows setting a secure, unsecure, or custom mode:
  - secure: This is the default mode, which is byte-identical to the previous fixed policy, blocking all directives and disabling popups.
  - unsecure: This mode opens every directive to HTTPS and enables popups, intended for trusted projects only. Per-directive fields are ignored when in this mode.
  - custom: This mode exposes granular, per-directive controls for frame-src, img-src, media-src, connect-src, and script-src (for external scripts only; 'unsafe-inline' is unconditional for internal scripts), plus a popups toggle and a host allowlist.
- An empty or unrecognized mode will resolve to secure.
- Projects can override the global policy from their settings page. A project's allowlist appends to (never narrows) the global one.
- Policy validation is now handled by a ConfigValidator hook on the shared configs.Service write path, ensuring validation across all config modification interfaces.
- HTML artifacts dynamically react to policy changes. The setWidgetPolicy observable triggers a rebuild of the srcdoc and remounts artifacts, ensuring inline scripts re-run under the new CSP.
- See HTML artifact Content-Security-Policy for comprehensive documentation.

v0.38.1 — Connectors

Released on 2026-08-11

Connectors

Added

Git CLI connector plugin (git): Runs the local git binary against repositories already on disk, enabling GitHub, Bitbucket, GitLab, and self-hosted servers through the same operations. It features 24 agent-callable operations across Read, Branches and Commits, Network, and Destructive categories. Access is gated by a two-layer policy engine (global fallback plus per-repo overrides matched on host/owner/repo or local path), covering branch name patterns, commit message patterns, protected branches, force push, and a per-subcommand allow-list for the raw escape hatch. Credentials never touch disk (HTTPS token via an askpass helper by default; .git/config is never rewritten). A new policy_show operation reports every rule in force for a repository before an agent acts. A new allowed_repo_roots config field optionally bounds every repo_path and clone destination to a set of directories (symlinks and .. resolved first); if empty, it's unrestricted. See Git CLI.

Manager

Fixed

Hidden config fields (used internally by html= widgets to write sibling config through {fields}) are now sent to the SPA, flagged and with their value withheld, instead of being dropped from the schema. This prevents a widget's own writes to its hidden fields from being silently discarded.

MCP

Fixed

Dropdown enums in tool schemas now correctly split on | as documented, instead of ,. This addresses cases where dropdown=a|b|c fields were previously emitting a one-element enum.
Boolean config/input widgets now declare type: boolean in the schema instead of type: string.
A wick_execute batch entry now reports ok: false when the operation itself reported failure in its response envelope, instead of showing ok: true with the failure nested inside result. Policy refusals inside a batch call are no longer indistinguishable from success at a glance.

Fixed

Intermittent "cached plan must not change result type" errors on Postgres: This issue, occurring when running the server and worker as independent toggles in tray mode, could trigger a schema migration while other components were already serving queries on the same database, leaving their connections with a stale plan. Migrations now run once per database (not just once per process) on a dedicated connection, and queries that still hit a stale plan are retried once automatically. The per-database guard added for this was itself keyed by a heap address that Go can reuse, which could make a freshly opened database (including on-disk SQLite) look already migrated and skip its schema; it's now keyed by handle identity instead.

v0.38.0 — Sub-agents & Approvals

Released on 2026-08-09

Sub-agents

Added

continue op (wick_agent_continue) allows carrying a stopped delegation further in its own session, preserving its transcript. Turn and token grants are added to what the delegation already spent, not reassigned over it. delegate gained a continue_id shortcut for this behavior.
progress op (wick_agent_progress) enables a sub-agent to report its mid-task status, waking the supervising agent without ending its own turn. delegate gained a supervised flag to request these reports from a sub-agent.
list_agents now also returns instances — all sub-agents that exist in the conversation, including finished ones, allowing a leader to continue or message an existing sub-agent instead of spawning a new one.
collect on a still-running delegation now returns progress (a peek at its in-flight work) and last_report (its latest progress note) instead of an empty pending result.
A Continue button has been added to the Sub-agents rail panel, appearing on any stopped row. It prompts for the next action and sends the sub-agent back to work in its own session. It explicitly warns if the transcript could not be resumed, preventing a follow-up from being written under false assumptions.

Changed

Messaging a stopped sub-agent is now allowed for every terminal status (not just done); the recipient resumes in its own session with its transcript intact where possible.
list_agents for a leader now lists sub-agents by parent (who the leader delegated to), while a sub-agent still gets its own tree.

Fixed

Claude spawns failing on Windows with "The filename or extension is too long": The system prompt is now passed via --append-system-prompt-file (a per-session file) instead of inlined on the command line. Wick's preset alone (~28KB) could push the command line arguments past Windows's 32767-character CreateProcess limit, causing claude spawns to fail with a misleading error.
Sub-agent supervision silently no-op'd: The X-Wick-Session-Id header for sub-agents was incorrectly derived from its storage directory's basename instead of its flat session ID. This caused ops like progress and report_result to fail for sub-agent calls, making supervised=true ineffective and collect's progress/last_report always absent. SessionID is now carried through SpawnOptions to ensure correctness.
Delegation & Agent Execution Reliability:
- Inaccurate Results on Peer Messages: report_result now takes precedence over the closing prose when a peer message was delivered mid-run, preventing the reply to a peer message from being recorded as the final answer to the original delegation.
- Stop did not stop: The Interrupt operation now unconditionally kills any running agent process before returning, preventing sub-agents from continuing work invisibly after being stopped. PartialText now falls back to the last progress note, and turns_used is re-read before writing a terminal status to prevent backward updates.
- Pending collect replies: collect on a running delegation now accurately reports last_report when available, states when nothing has been reported (and mentions supervised=true to enable reports), and advises stop instead of message for intervention. It also adds last_report_at for better context.
- Stranded Runs on Lost Done Events: Terminal events (Done, Error) in DelegationStream now block rather than being dropped when consumers are behind, preventing runs from being stranded. The event buffer size has been increased to 512. A sweeper now finishes delegations whose agent processes are confirmed GONE, recording existing work to prevent permanent stranding.
- Abandoned-run sweep eating new runs: The sweep now includes a three-minute grace period for newly started delegations and considers a recent progress report as an indicator of liveness, even if the agent process is temporarily absent (e.g., respawn-per-turn providers). This prevents the sweeper from prematurely terminating healthy, just-started, or between-turn runs.
- Loss of Work and Turns on Kill/Error: On kill/error finishes, the freshest last_report is now appended to the result (or becomes the result if nothing was streamed), clearly labeled as not a completed answer. turns_used now correctly uses max(our Done count, provider num_turns).
- Max Turns clamping: A delegation request exceeding max_turns is now silently clamped. The clamp is recorded on the row and surfaced as turns_note on the delegate reply, ensuring transparency.
- Raw Provider Line Loss: The SSE bridge now carries the raw provider line (containing token usage and provider-specific turn counts) in memory, ensuring that tokens_used and agent turn counts are accurately billed and reported for delegations.
- Supervised Runs Closing Prematurely: Supervised sub-agents that have filed progress but no report_result are now nudged to continue on turn-boundary narration (text that indicates ongoing work) instead of being closed with a done status. Unsupervised one-question delegations still close on text. Stop on a terminal row now always kills any surviving agent first. Failure paths now consistently return a degraded envelope (structured:false, confidence:unknown). Turn numbers are clarified as "tree turns" (pooled budget) vs. "per-delegation cap".
Frontend & Streaming Improvements:
- One dev-reload watcher and connection for all tabs: A process-wide hub now manages a single fsnotify watcher, fanning rebuild events out to subscribers. All tabs now share one _dev/reload connection via a SharedWorker, conserving browser connection quotas.
- Idle keep-alive connections server-side: A 60s IdleTimeout has been set for the HTTP server, ensuring orderly, server-initiated closure of idle keep-alive connections. This prevents requests from stalling indefinitely into dead sockets.
- Share one /stream/sessions connection across all tabs: The sidebar's lifecycle stream is now routed through the existing SharedWorker, reducing the connection cost to one for N tabs.
- Multiplex all session streams over one SSE connection: GET /stream/multi?sessions=a,b,c now carries all requested session's agent events on a single connection. This reduces the browser's SSE connection cost, preventing requests from being capped by per-origin limits.
- Mux sessions onto one stream and reap dead subscriber ports: The SharedWorker now uses /stream/multi. It also addresses leaks by unsubscribing on pagehide and reaping dead MessagePorts via their close event, ensuring that unused streams are properly cleaned up.
Permission Gate & Approval Prompts:
- Keep approval prompts open while a tab is watching: The deadline for an approval prompt is now optional and off by default, allowing prompts to stay open as long as a browser is watching the session. A 20s grace period is applied only once all tabs are gone. New knobs (approval_timeout_enabled, approval_timeout_sec) are introduced. Internal timeouts (gate binary's socket read, Claude's PreToolUse hook) have been raised. approval_resolved is now broadcast on all exit paths.
- Gate every shell tool, and key approvals by the command: PowerShell commands are now correctly gated as commands (not paths). Any tool carrying shell text is gated as a command, using the tool_input payload. An empty command key (MatchKey returning "") is now impossible to inherit, ensuring such commands are always asked about. The audit trail now names the real interpreter.
- Refuse a command with guidance, and answer prompts by keyboard: A new refusal mechanism allows keeping the agent's turn alive and providing a correction back to the model, in addition to the hard block. The approval prompt now takes focus on arrival and offers keyboard shortcuts (A, S, W, N, B, Enter, Esc) for various actions.
- Keep shortcut hints off small screens: Shortcut hint chips and the note's shortcut line are now hidden below the sm breakpoint on smaller screens. The shortcuts themselves remain wired for keyboard users on tablets.
- Keep the approval prompt inside the viewport: The approval dialog is now capped at viewport height using dvh and made a flex column, allowing the detail body to scroll while the header and action row remain visible.
- Count channels as viewers, and stop waiting when nobody is there: The grace period for prompts now starts short and only widens once a viewer has been observed. An opt-in ApprovalResponder has been added for channels (like Slack/Telegram) to count as viewers, allowing their buttons to remain active. This ensures prompts wait for human interaction but block promptly if nobody is attached.
- Restore an open approval prompt after a page reload: Pending approvals are now fetched on page mount, and the modal is reopened if the server indicates a request is still waiting, preventing agents from being blocked invisibly after a browser reload.
Process Management:
- Never spawn with a nil buffer: spawn now resolves the buffer through bufferFor, which lazy-creates and reads any PendingInput from disk. Drain is also made nil-safe as a backstop.
- Force-kill the whole tree when graceful teardown fails: taskkill is now used with /T /F to walk and forcefully terminate the entire process tree, preventing orphaned worker processes (e.g., from launcher-shim binaries) from continuing to run after a Stop command.

v0.37.0 — MCP & Connectors

Released on 2026-08-07

Custom MCP Connector Management and Per-Instance Authentication

Added

Ability to rename and delete custom MCP connector definitions from the header kebab menu. Deletion requires typed confirmation and cascades to instances and credentials.
A dedicated endpoint for renaming MCP connector definitions ensures key immutability and preserves instances, access tags, and MCP tool IDs.
Per-instance authentication actions (Connect, Re-connect, Test auth) are now available in the instance row kebab menu, driven by a new mcp_auth field per row.
ProbeInstance verifies credentials for a single instance row without affecting the connector's overall LastTest status.
Refused or expired authentication tokens are reported as ok=false (a verdict on credentials, not a check failure).
Instance rows flag broken authentication in red (expired with no refresh, or refused probe), overriding the account chip for clearer status.
resync-tools now accepts an optional instance_id to probe using that specific instance's account; an instance from another connector is refused.

Fixed

Popup login flow for re-connecting instances: The callback now correctly closes the popup rather than redirecting, using a Popup flag in the login session. The MCP flow has its own popup helper signaling over wick-mcp-oauth. Success is claimed only upon a successfully reloaded and connected row.

Improved

UI clarity for MCP connector edit forms: The tool list is now labelled as a read-only preview, and its description is marked as connector-wide, pointing to the per-instance AI description.
Long cURL-imported connector descriptions now wrap instead of overflowing the card.

Connectors

Added

Platform tag support for connector modules, enabling better categorization.

v0.36.4 — Sub-agent Banners

Released on 2026-08-07

Fixed

Slack sub-agent banner display and liveness: Addressed four defects in the sub-agent progress relay.
- Relayed Thinking events now render correctly; the parser now splits the researcher → Thinking label on its separator, preventing collapse to "Working".
- The banner no longer pings Slack indefinitely after a turn ends. Liveness is now based on an explicit running flag, preventing the keep-alive ticker from being revived post-Done/Error.
- Sub-agent activity labels now age out after 90 seconds to a neutral "Working" state, rather than indefinitely asserting the last activity if a child goes quiet mid-run. The sub-agent's name remains visible.
Silent leader kill on detached sub-agents: When a leader agent is killed, and its detached asynchronous sub-agents continue working, Slack now posts a single notice naming the surviving sub-agents. This message is subsequently edited as they finish, providing continuous status without spamming. (Telegram does not implement this.)
[silent] marker in Slack replies: Slack now strips a leading [silent] marker from replies before posting, aligning with the web UI behavior. This prevents the literal marker text from appearing while maintaining the existing detection for entirely suppressed silent turns.

v0.36.3 — Fixes & Improvements

Released on 2026-08-04

Fixed

Sub-agent progress frozen on Slack: A delegated sub-agent's status events were previously addressed to its own session, which had no active thread, causing events to be dropped and the Slack assistant banner to appear frozen on "Delegating: …" for the entire child run. Sub-agent progress (tool use, tool results, thinking) is now relayed to the nearest ancestor session with a live turn and shown labelled with the sub-agent's name, e.g., researcher → Reading store.go. The child's reply and any error still arrive only through the delegation result. This change also includes a documentation note for the Slack banner. Telegram has no equivalent banner and is unaffected.

Changed

CLI Model Catalog:
- Refreshed the CLI model catalog.
- Added gpt-5.6 tiers and gpt-5.5-agentic models to the codex.
- Included the full claude-* model names alongside existing short aliases; both ID styles remain supported for --model <id>.
- Added a _readme block to models.json to document its contract, detailing the multi-layer merge strategy (embedded / remote / disk cache) where the newest updated_at wins, and explaining how forgetting to bump a date can cause edits to be silently lost, or how deleting an entry might allow the remote layer to restore it.
- Updated the embedded-baseline test to assert the gpt-5 prefix, allowing for future catalog refreshes without requiring test edits.

v0.36.2 — Sub-agents

Released on 2026-08-04

Fixed

Sub-agent Provider/Model Inheritance: Addressed issues where sub-agents failed to inherit their provider and model, often falling back to global defaults or running on incorrect instances. Provider and model now travel as a unified provider.RunTarget through the inheritance chain (role's pair, parent conversation's, then project's). This also resolved the "No runnable model for the wick provider" error.
Sub-agent Modal Theming: Corrected dark mode theming for the sub-agent modal, ensuring its background, breadcrumb separator, and backdrop now correctly follow the dark theme. The image card renderer also received similar fixes.
Sub-agent Liveness Indicators: Ensured that a conversation's liveness indicators (sidebar dot, header badge) reflect ongoing sub-agent activity, preventing a dormant appearance when only sub-agents are working. Delegated work is now explicitly rendered in teal, with a new header badge showing the sub-agent count.
Provider Dropdown Clipping: Resolved an issue where the provider dropdown in the quick-change dialog would clip, forcing the dialog to scroll. The dropdown now uses position:fixed for correct rendering and handles external clicks, re-anchoring on UI changes.
Wick Model Names on Agent Rows: Displayed human-readable names for wick models on agent rows and in the quick-change dialog's closed trigger, instead of their internal registry IDs. Raw IDs are preserved for deleted or renamed models to ensure visibility.
Sub-agent Result Delivery: Ensured that a sub-agent's result is delivered back to the leader using the conversation's own provider and model, rather than falling back to a per-type default. This involved resolving empty agent names to the session's active agent and correcting how child agent entries are named.
Provider Models Editor Columns: The provider configuration editor now correctly retains id and description columns for the models field, preventing data loss and ensuring proper round-tripping for different field types.
Test Synchronization: Synchronized access to kills and tokens in delegation tests to improve reliability.

Improved

Sub-agent Role List UX and Visibility: The project's Sub-agents tab and the global Sub-agents page now use a unified AgentProfileRow with panelled sections, matching the General tab. Provider and model are explicitly stated as chips on the row, with "provider default model" for roles without a specific pin.
Quick-Change Dialog for Provider/Model: Introduced a new quick-change dialog for roles, allowing users to rapidly update a role's provider and model. The provider and model chips on the agent row now act as direct shortcuts to this dialog.
Role Locking Legibility: Locked roles remain clickable for read-only viewing, but destructive actions (Delete) and modification options (disable toggle, quick change) are now rendered disabled rather than hidden, providing clearer feedback.
UI Responsiveness: The global page's rail width was increased to 320px to better accommodate the new provider/model chips.

Refactored

Sub-agent Role List Unification: The agent profile rows and related rendering logic were unified across the project-level Sub-agents tab and the global Sub-agents page, ensuring a consistent look and behavior wherever a role appears.

v0.36.1 — Agent Orchestration

Released on 2026-08-03

Added

Mention-driven investigation workflow:
- Using @name at the start of a line now dispatches to a live agent handle, starts a new sub-agent for a role key, or shows the leader a "Routed to @name" chip when mentioning itself to prevent re-delegation.
- Sub-agents now run one at a time by default (previously 4 in parallel). Async delegation requests are queued instead of being refused. A sub-agent waiting on its own child releases its slot, preventing deadlocks in one-at-a-time rooms.
- Sub-agents report back through a structured report_result operation (including summary, findings, quoted evidence, confidence) instead of prose alone. If report_result is not called, the closing message becomes the summary with "unknown" confidence.
- memory_mode (no_history / state_summary / relevant_chunks / full_history) explicitly defines what a sub-agent is told.
- Each delegation tree can now hold an incident record (evidence, hypotheses, next actions), created lazily. Evidence is stored and deduplicated, but findings are not automatically merged.
- A checker loop is introduced, built on seven seeded roles (log-investigator, code-investigator, docs-investigator, data-validator, evidence-checker, client-response-drafter, incident-supervisor). This loop rounds evidence past an evidence-checker until it's confirmed, contradicted, or escalated. Validation for reports is split into Go logic for well-formedness and round completion, and the evidence-checker role for evidence validity. An empty or unrecognized verdict escalates.
- The workflow is bounded by new Max iterations / Max runtime / No-evidence-rounds settings under Agents settings → Sub-agents.
- Sub-agents now learn the roster at spawn, making messaging operations immediately usable.
- See Sub-agents ▶ Mentions and The investigation loop.
Agent-to-agent messaging:
- Every agent in a delegation tree now has an address (@main for the leader, deduplicated role keys for sub-agents).
- The sub-agents connector gains message (kind=tell or ask), reply, stop, and list_access operations, allowing a running agent to be messaged, asked a question, or stopped without re-explaining its task.
- The ask operation blocks for a reply, while tell returns immediately. If a recipient ends its turn without replying, its closing text is promoted to the answer to prevent hanging the sender.
- Queued messages arrive as one batched turn, only at a turn boundary.
- A delegation that receives a message continues running instead of closing on its pending answer.
- An exited sub-agent is resumed on message delivery. If its transcript cannot be recovered, the sender is informed the agent is answering fresh.
- A hop limit (default 10 consecutive agent-to-agent messages between human turns, configurable under Agents settings → Sub-agents along with Ask timeout and Inbox cap) guards against agents looping. A human turn or the rail panel's "Allow 10 more" button refills it. Hitting the cap stops messages, not agents.
- Every message delivery includes the live roster and remaining turns, tokens, and hops, informing agents of their budget.
- The rail panel's Sub-agents tab gains a "Between agents" message thread.
- The composer's @ menu now lists agents ahead of files; picking one inserts the mention and prompts the leader to use that agent.
- can_delegate is now enforced.
- See Sub-agents ▶ Talking to other agents.
create_agent is now create-or-patch:
- Calling create_agent again with a role's existing key updates that role, rather than requiring every field again; omitted fields keep their current value. It now accepts every sub-agent field.
- It also accepts allowed_tags (to narrow a role's tool access — see the new list_access op), can_delegate, allow_take_over, and mode. list_access returns tags a caller may grant, intersected with the caller's own permissions.
- The full provider list is now served to the role editor.
- New Locked flag for sub-agent roles: roles can be locked from the editor, preventing editing, deleting, or re-creation with the same key.
Sub-agent Session Nesting & UI Improvements:
- Sub-agent sessions are now nested on disk within their parent's folder (<parent_id>--sub-<12 hex>), allowing deletion of a conversation to remove its entire delegation tree. Nested IDs use 12 hex chars to prevent Windows path limits.
- Clicking a sub-agent row in the rail panel now opens its transcript in a modal, rendered with the same ConversationThread as the main conversation, including thinking blocks and tool cards. A sub-agent's own sub-agents push onto a breadcrumb inside that modal.
- The entire rail card is now a single click target, including the result preview.
- Sub-agent rows and agent-to-agent messages now include timestamps. Live sub-agents are dated by when they started, and finished ones by when they ended.
- Liveness indicators on the rail panel now spin to show active progress.
- GET /stream/sessions now provides live updates for the sidebar.
Top-level wick_agent_* tools: Sub-agent connector operations are now surfaced as top-level wick_agent_<op> tools (e.g., wick_agent_delegate, wick_agent_collect). This reduces the tool call hop count from two to one, preventing models from drifting to provider-native multi-agent features.

Changed

Async sub-agent results now arrive labelled as a sub-agent (source subagent) with the agent's handle and elapsed time, rather than looking like the user typed them.
Sub-agent sessions are now pre-titled from their task instead of showing a generic placeholder.
Sub-agent delegations no longer block the caller by default; an unstated mode now resolves to background (async), returns a delegation_id, and wakes the leader via the session sink when the result lands. foreground (sync) is now an opt-in for short lookups. Existing roles were migrated to background by default, except for evidence-checker and client-response-drafter.
The immutable prompt served to agents has been split into three audience-specific files (immutable.md, immutable_main.md, immutable_subagent.md). This reduces a sub-agent's immutable prompt from ~7.3k to ~2.6k tokens by removing irrelevant instructions.

Fixed

A mention could be dispatched twice: The router now runs in the send path and appends a [routed] marker, which the leader reads before the message and renders as a "Routed to @name" chip, preventing duplicate delegation.
Wick provider: sub-agents on a live model set could fail to spawn: The sticky default model is now resolved on every branch for live model sets. An entry that cannot resolve to a concrete model ID is skipped with a message pointing at Providers → Wick, preventing "model is empty" errors from vendor SDKs.
A dismissed autocomplete menu could reappear: Autocomplete dismissals are now remembered against the trigger position, preventing the popup from reappearing until a fresh trigger is detected.
Delegation not surfaced without a page reload: The Sub-agents rail roster now refreshes immediately on wick_delegate / wick_delegate_collect tool events. A spinning ring on the rail tab now indicates active sub-agent work.
Boot markers not persisting: One-shot boot markers for seeded roles and background-default migration are now properly declared as hidden config rows, ensuring they persist across restarts and preventing re-running on every boot.
Multi-agent work drifting outside Wick: Codex multi-agent features are now disabled by default for Wick spawns (-c features.multi_agent=false) to ensure that all multi-agent orchestration is managed by Wick's sub-agents surface or mentions, preventing unmanaged child agents and hangs.
Minor fixes: A semicolon in a wick:"desc=..." tag no longer truncates max_tokens' description, and a report_result path now fails closed when the delegation service is unavailable.

v0.36.0 — Agents & Connectors

Released on 2026-08-02

Multi-Agent Planning & Delegation

Changed

Multi-Agent Planning Documentation Consolidated: The sub-agent-delegation/ and multi-agent-rail/ documents have been merged into a single, linear internal/planning/todo/multi-agent/ document. This resolves previous contradictions, specifically regarding the sub-agent transcript location (now uniformly on the right-rail tab), and provides a cohesive design covering roadmap, concepts, runtime, UI, implementation steps, prior art, and appendices.
- Documentation details verified against code: Sessions are file-based, pool.Kill stops all entries under a session prefix (highlighting the need for a future KillAgent), and agent.Stop performs a hard-kill without a SIGTERM grace period.
- Prior-art findings from routa/stoa/multica were condensed to inform decisions on returning partial work as tool results, distinguishing queued from running cancellations, and ensuring concurrent completions win by design.
- Added plans for wick-image-gen (text-to-image as a tool over the existing wick provider) and escape-analysis notes.
Sub-Agent Roles Scoped and Connector-Driven: Sub-agent roles are now project-scoped, moving from global, admin-only settings to editable configurations accessible via a new, fixed internal/connectors/sub-agents connector.
- AgentProfile now includes ProjectID, with uniqueness based on (project_id, key). Project roles can shadow global ones.
- A GORM AutoMigrate fix explicitly drops the old unique index on key to prevent constraint violations during database migration.
- New UI pages/tabs are available for managing global and project-scoped sub-agents, sharing a common editor component.
- Delegation operations (list_agents, delegate, collect, create_agent, tasks) are now exposed through the sub-agents connector, enabling discovery, admin pages, tag visibility, and run history. create_agent is now project-scoped.
- The system_prompt and project.Defaults.SystemAddon settings have been revived to properly configure child sessions.
- strict_mcp, allowed_native_tools, and can_delegate are now documented as unwired controls, correcting previous erroneous claims about strict_mcp as a host-MCP escalation path.
- Security: The X-Wick-Session-Id header now takes precedence over a model-supplied session_id for consistency in determining the session tree, tag inheritance, and accessible project roles.
Thread-Safe Delivery Tracking: A mutex has been added to recordingDeliverer to ensure thread-safe delivery tracking for delegation operations.

Data Tables

Added

New MCP Connector for Data Tables: A new datatable connector has been introduced, allowing workflows to interact with data tables via datatable_* nodes.
- Operations: Supports comprehensive operations including listing, creating, dropping, querying, inserting, upserting, updating, deleting, and counting rows.
- Access Control: Includes an ACL mechanism for managing data table access.
- Existing workflow connector operations related to data tables were refactored and centralized under the new datatable connector.
- Comprehensive tests were added for all new data table operations.

v0.35.3 — Features & Fixes

Released on 2026-07-28

Added

playwright_browser: default profile for live sessions: Two new instance configs make a named profile the default instead of an opt-in. DefaultProfile sets the profile used when session_open is called with no profile argument (an explicit argument still wins); ForceDefaultProfile pins every session to DefaultProfile, ignoring any profile argument passed in. Turning on ForceDefaultProfile without a DefaultProfile set fails at session_open with a clear error. Connector bumped to 0.9.0. See Playwright Browser ▶ Making a profile the default.

Fixed

todo tool over MCP + goal-only calls: Todo calls arriving over MCP as mcp__wick__todo are now recognized and merge into the checklist card, no longer leaking into the trace as raw tool cards. The conversation UI also gains a goal banner (open/done/abandoned, with an optional note) shown alongside or instead of the checklist. Releasing the goal latch with todo{goal_done:true} and no items is now accepted (the items array is only required when a call touches no goal field), and goal-only calls mid-checklist now preserve the active item attribution.
Gemini 3.x + /thinking off: Toggling reasoning off used to send thinkingBudget: 0, which Gemini 3.x models reject with 400 INVALID_ARGUMENT. Wick now omits ThinkingConfig for 3.x (and unrecognized) models, degrading to the vendor default budget instead of failing. Zero budget is still sent only on 2.x models that accept it. Note: on 3.x this means "off" isn't fully achievable — the model still thinks at its vendor default budget.
/thinking toggle no longer resets on idle/refresh: Session overrides (the /thinking popover's on/off + effort level) were runtime-only and dropped on engine exit. They are now persisted to an overrides.json sidecar in the session directory, surviving engine exit, page refresh, and Wick restarts; clearing them is now an explicit reset action.
Agent misinterpreting attached images: Updated system prompt documentation now clarifies that attached images are already inline and visible, preventing agents from attempting to "open" or "decode" them using shell/read_file.

v0.35.2 — Wick Provider

Released on 2026-07-27

Wick Provider

Added

Loop guards + goal mode: max_turns now defaults to 0 (unlimited). A turn is instead bounded by a consecutive-tool-error cap (max_consec_errors, default 20) and a wall-clock cap (max_turn_minutes, default 60), both configurable in the provider settings' new Advanced section alongside max_model_retries and model_call_timeout_sec. A cut turn now shows [wick] turn cut: … inline in the transcript instead of silently ending.
The shared todo tool gains an optional goal latch (goal / goal_done / goal_abandon fields): while a goal is open, the wick engine keeps working past plain-text replies and turns error/timeout cuts into a nudge to try a different approach — a manual Kill still stops everything immediately.
Live model sets gain a sticky default vendor model: pin one model as the default used when the set is picked without an explicit @vendor override (via the Add/Edit live-set form or a dedicated Set default model… picker). It auto-falls back to the top of the list if the pinned model disappears from the vendor. The Add/Edit live-set form now uses a single "default" radio instead of a separate control. The new-session composer can now expand live model sets.
wick is now a first-class skill provider: ~/.<app>/skills is registered alongside ~/.claude/skills etc., appears in the Skills Manager UI and sync flows and the wick session's / menu. The wick agent gets a compact skill catalog in its system prompt, reading a skill's SKILL.md on demand, and read_file now includes skill directories as read roots.
Model Capability Chips: Model pickers now surface per-model capabilities (e.g., context window, max output, vision, reasoning, tools, search) as compact badges. A global toggle and display mode are available in the provider settings' Advanced section, with capabilities shown by default.
Native Reasoning: Reasoning is now wired per-adapter from a single ReasoningEffort knob, which maps to native thinking budgets for OpenAI, Anthropic, and Gemini models.
Native Vision: Image attachments now ride as inline generative AI parts through each adapter's wire format (e.g., OpenAI image_url data-URL, Anthropic base64 image block, Gemini inline_data). The interactions log records image parts for accurate diagnostics.
Streamed Model Output: The engine now streams model output over Server-Sent Events (SSE) token-by-token by default, for OpenAI and Anthropic adapters. This is configurable via a toggle in the Wick provider settings.
Runtime Reasoning Toggle (/thinking): The new /thinking slash command opens a popover in the composer to toggle reasoning on/off and pick an effort level for the current session without sending a message. Typing /thinking on|off|low|medium|high also works as a fallback. This feature leverages a new generic, provider-agnostic session-override framework.

Fixed

Live model set's filter is now optional: leaving it empty matches all of the vendor's models (stored internally as an empty filter) instead of requiring a narrowing filter.
Editing a model (including converting a plain model to a live set, or back) now updates it in place, reusing the existing ID instead of creating a duplicate entry. The Add/Edit button label now reflects the mode ("Save model" / "Save live set").
Attachment Paths on History Replay: Fixed an issue where the model couldn't read attached files on history replay because the pool's path block was lost; turnToContent now re-appends the path block on replay, mirroring the live send.
read_file is now type-aware: image files return an "attach in chat" hint, binaries are refused, and text/SVG are read through.

Improved

Provider Picker UX: Enhanced keyboard navigation in drill-in pickers, auto-drilling into the selected live set, and added a breadcrumb trail. The /provider command now opens the picker focused for immediate navigation.
Custom Model Editing: When editing custom models, a custom Base URL is now retained when switching providers (only auto-default is refilled), and a "Saved / Replacing…" indicator is shown for stored API keys.
Quiet KVList Edits: Environment variable (KVList) edits now save quietly without reloading the detail pane, preventing focus loss or row reordering mid-edit.
AI Router Visibility: The AI Router configuration is always editable (install/running is a non-blocking indicator), showing its loopback Base URL and surfacing preferred/bound ports.

v0.35.1 — Wick Models

Released on 2026-07-26

Wick Provider

Added

Live model sets: A registered wick model can now store a discovery filter (e.g., term for includes, -term/!term for excludes) instead of a fixed model ID.
- In the composer's provider picker, live model sets appear as expandable rows that fetch the vendor's model list dynamically, narrowed by the stored filter. This introduces a 4th picker level: provider ▸ models ▸ live set ▸ expanded models.
- The composer's model picker for live sets features lazy-loading of models on drill (with caching and fallback to static models), an auto-focused filter box, arrow-key navigation, a refresh button, right-anchored popups, and second-click collapse.
- The Add-Model form on the Wick provider page now includes a Single / Multiple toggle. The Multiple option offers Live mode (which follows the discovery filter) or Manual mode (for selecting models by ticking).
The /provider command now opens the same in-composer provider picker used by the toolbar chip, unifying the experience and replacing the separate flat modal.

v0.35.0 — Features & Improvements

Released on 2026-07-26

Wick Provider

Added

Context compaction: When a session's history nears the context budget, wick asks the model to summarize the oldest turns (decisions, facts, file paths, done vs. pending) and continues with the summary in place. Includes a manual /compact command and a heavier automatic pass on request overflow.
Long-running tool calls: Shell commands no longer run under a fixed wall-clock deadline. A long command can run as a background job the agent polls for status/log instead of stalling the turn.
Curl builder for the session's Wick Interactions log: Reconstructs any logged model call as a copyable request in 4 formats (single-line, Bash, raw HTTP, JSON body), with an editable body preview, env-var display, per-part copy, and an admin-only "reveal real key" option (defaults to a $WICK_MODEL_API_KEY placeholder).
Session detail page: Features server-side search + pagination over the Wick Interactions log, upload progress + compaction indicators, and a detail modal for viewing a chip's full content without cluttering the transcript.
Live model-call observability in the interactions log: The "running" row now distinguishes an in-flight model call from a running tool call, shows a live elapsed timer and retry attempt/reason, and gains View request (curl for the call in flight, before it's logged) and Cancel call (aborts just that model call; the turn keeps going). Messages that arrive mid-turn are injected into the next model call of the same turn.
Uniform retry + per-attempt timeout across every model adapter, including Gemini: Transient failures (timeout, connection reset, 429, 5xx, unavailable) retry with backoff; fatal errors (bad key/model, other 4xx) fail fast. Configurable via max_model_retries and model_call_timeout_sec.

Connectors

Added

Connector runs are cancellable: A ✕ Cancel button on a running row in the connector History page and on a running tool call in the agent conversation UI aborts just that operation. The run settles to a new Cancelled status, distinct from Error. A cancelled/timed-out op returns an explicit, agent-readable result.
A run can no longer stay stuck running forever: A background reaper job periodically reclaims any row still running well past every legitimate op's ceiling. CancelSession aborts all in-flight operations of a live session.
Interrupted tool state: A tool call on an interrupted/cut-off turn now reads "interrupted" instead of an eternal running spinner.

Playwright Browser

Added

CloakBrowser Pro (cloakbrowser-pro): A second stealth-Chromium engine alongside the existing free cloakbrowser. It is managed by the official cloakbrowser CLI + a license key (CloakLicenseKey). The free engine is hard-capped to 1 concurrent live session (CloakBrowser's free-plan limit); the pro engine follows the configured MaxLiveSessions once its license resolves to a paid tier. The cloak_use_cli toggle has been removed.
Browser picker gains a ⋮ menu on installed engines for Update (re-fetch the latest build) and Uninstall (remove the downloaded binary). An "update available" badge is shown for the free cloak. Version probing reads the revision from the install path to avoid launching the engine. Graceful shutdown is attempted before force-killing a process.
Named browser profiles: session_open(profile=<name>) persists login/cookies under a stable profile directory across sessions and plugin restarts. New profile_list and profile_delete operations are available, and session_list gains a profile field. Opening a profile already driven by a live session is rejected.
Record network requests: run(record_request=true) captures the HTTP requests a script triggers (method, URL, headers, cookies, body, response status/headers), filterable by URL pattern, readable back with get_request. Requests are deduped. This now works for live sessions too.
Live-browser panel: Native clipboard bridging between your machine and the remote browser in Full mode (focus pushes your clipboard in, leaving pulls the remote's copied text back out), plus a right-click Copy/Paste menu on the live view. MouseEvent.detail is forwarded as clickCount for double/triple-click selections.

Fixed

wait_for_load_state(state=networkidle) no longer stalls a run for minutes on pages that poll in the background — capped at 10s, then continues.
record_request no longer crashes the Node driver or hangs the run by reading only initializer-cached fields in the OnRequestFinished callback.
Hard Go-level deadline applied to every browser operation (ephemeral + live) plus a bounded connection close to prevent goroutines from blocking indefinitely.
browser_status flicker on the Pro engine's status row when running cloakbrowser info is resolved by passing --no-launch.
"Target closed" errors on cloak operations are fixed by resolving a fresh Playwright driver per retry attempt.
Cloakbrowser launch arguments are aligned with the official Python wrapper, restoring --ignore-gpu-blocklist on Windows and adding --start-maximized for binaries version 148 and above.

Admin UI

Changed

Boolean config fields (bool/boolean/checkbox) now render as an interactive toggle switch everywhere — clicking the label also toggles it.

Fixed

HTML widget UI-only marker data-op="__menu" no longer prevents default, allowing a native <details> kebab menu to open without selecting the row.

CLI Model Picker

Added

Per-instance model selection for claude / codex / gemini instances: An "Allow model selection" toggle plus an editable ID + description table (models), with a "Load defaults" button that fills it from the catalog. When on, the picked model is passed to the CLI via --model.
Model catalog: An embedded models.json baseline, overlaid by a GitHub-raw copy (refreshed lazily or on Rescan) and a hand-editable disk cache under ~/.<app>/ — merged per-model by updated_at (newest wins); disabled models are hidden.
The composer's provider picker gained a full type ▸ instance ▸ model drill-down (a new reusable ProviderPicker component), collapsing any level with only one choice; each model shows its description under its name. The chip also shows the selected model on switch.

Docs

Documented the built-in wick provider (claude / codex / gemini alternative talking straight to a vendor API), the CLI model picker + model catalog, the Allow shell metacharacters command-gate config, CloakBrowser Pro, named browser profiles, network capture, model-call observability, and connector cancellation.

v0.34.0 — Wick & Tools

Released on 2026-07-24

Wick Provider

Added

3-level provider picker (Type -> Name -> Model) for Wick instances with multiple enabled models.
Session-level model pinning: switching models on the same Wick instance is no longer treated as a no-op.
End-to-end WickModel.Disabled support; disabled models are hidden from the composer and not auto-picked.
New endpoints for disabling, enabling, duplicating, and a 1-token Test ping for Wick models.
Dedicated brand icon for the Wick provider in the composer's provider picker.

Fixed

Idle-timeout race that could kill Wick sessions during a model call.
Wick gate using an incorrect session ID for approval routing.
Wick incorrectly inheriting Claude's system prompt overlay.

Changed

Model rows in WickDetail.svelte are now consolidated into the shared KebabMenu component (Edit/Set default/Test/Duplicate/Disable/Delete).
System prompt split into a shared base and per-provider overlays (immutable_wick.md).
Persistent memory.md guidance added to Wick's system prompt.

Command Gate & Security

Added

Extension of the command gate to cover every Wick tool (not just shell), with in-process synchronous approval.
AllowShellMetachars configuration toggle to permit shell chaining (e.g., &&, ;, |) per-whitelist while continuing to block redirects/substitution.

Fixed

Command gate now correctly honors permission_mode=bypass.

Improved

More actionable shell metacharacter block reasons, specifying the character and suggesting alternatives.

Todo Tool (Shared MCP)

Added

Schema gains title and description fields, and optional nested substeps.
New UI: all todo calls are merged into a single checklist widget, with each item expandable to show associated tool calls that occurred while it was in progress.
Tool call duration: at/end_at timestamps from trace events are parsed and displayed in ToolCards.
TodoCard sums each item's related tool-call durations into a total.

Changed

Moved from a Wick-only native tool to the shared MCP tool surface (now available to Claude, Codex, and Gemini).
The old single overloaded step field is kept as a deprecated fallback for older traces.
The in-progress item's current activity is now shown inline in the card instead of a separate floating indicator.

New Native Tools

Added

Native read_file, write_file, and edit_file tools with line-range support.

Frontend & UX

Fixed

Duplicated text/tool_use rendering from SSE snapshot replay.
HTML file artifact retry capped to prevent infinite busy-loops, displaying a static fallback after ~2s.

Developer Experience

Added

WICK_SW_ENABLED environment toggle for disabling the service worker in development.

Improved

fe/scripts/dev.mjs debounce extended to 5s, and in-flight builds are now killed and restarted when new changes land mid-build.

v0.33.2 — Notion Connector

Released on 2026-07-22

Added

update_page_properties for notion_unofficial: Edits the property cells of an existing database row in place (status, date, select, multi_select, checkbox, relation, person, number, and more). Only the properties passed are written, leaving the rest of the row and its body content untouched. Takes page_id (the row) and properties (JSON name → value, using the same shapes as create_page). The operation refuses a plain page (one without a property schema, directing users to set_title or update_block instead) and returns unknown or read-only property names in skipped_properties rather than failing the call. Returns {id, updated, skipped_properties}. Call describe_database first to retrieve exact property names, types, and options. See Notion (Unofficial) ▶ Writing database row properties.
notion_unofficial requires an AI description to be set up: As this connector authenticates with a personal Notion session token (token_v2)—meaning every call acts as one human across their entire workspace—an instance is now considered needs_setup until its per-instance AI description is filled. This ensures there's always a record of who may use it and for what purpose. This feature reuses the existing per-instance description field (which guides the LLM) and standard readiness status: a blank description reports as unfinished in the Manager UI, just like a missing required config field, and flips to ready once completed. Setup widgets (Import, Status) bypass this gate, allowing operators to confirm the connection before enabling the instance. This is backed by a new opt-in Meta.RequireAIDescription connector flag. All authentication and advanced configuration fields (token_v2, active_user_id, user_agent, notion_client_version) are now also required; these are conveniently filled in one click by the Extract widget. In the Manager UI, when a connector requires an AI description, the section is now forced on, marked 'Required', and displays a warning when blank. The connector version has been bumped to 0.4.0. See Notion (Unofficial) ▶ AI description required.
operator_note in the connector meta-tools: wick_list, wick_search, and wick_get now include a separate operator_note field. This field carries the admin-written per-instance AI description, distinguishing it from the connector's built-in description. This allows the agent to recognize and prioritize operator-authored instructions (such as access rules, team notes, or constraints) over product descriptions. For example, a personal-token connector's note might specify who is authorized to use it. This field is omitted when blank.

v0.33.1 — Live Browser & Connectors

Released on 2026-07-21

Added

In-place block editing for notion_unofficial: The unofficial Notion connector can now edit a page's body precisely instead of only setting its title. list_blocks returns each top-level block as {id, type, text, editable}; update_block rewrites one block's text (and optionally its type) in place; delete_block removes one block — all addressed by block id, so neighbouring blocks are never touched. append_content adds new blocks from markdown at the end, or mid-page via after_block_id. Two guards keep an edit from breaking the page: update_block refuses non-text blocks (images, embeds, tables, dividers — marked editable:false), and append_content rejects an after_block_id that isn't a top-level block of the target page. Connector bumped to 0.2.0. See Notion (Unofficial) ▶ Editing page content in place.
Live browser panel for playwright_browser: The agents conversation UI has a new right-rail Browser tab (shown once an enabled playwright_browser instance exists) that shows a live view of a session — watch the screen, or switch to Full mode to click/type/log in by hand. This includes support for cloakbrowser (patched Chromium) instances. It supports pop-out/floating and fullscreen views, zoom, an address bar with chrome:// shortcuts, and a tab switcher for multi-tab sessions. The connector's manager detail page gained a matching Active sessions section (inspect/goto/kill) and an Extensions section to install Chrome extensions (.zip/.crx upload or Chrome Web Store id) into its live sessions. New MaxTabsPerSession config caps tabs per session (default 1, opt-in multi-tab) and run/session_list gained a tab input / max_tabs field to target and report on specific tabs. Connector bumped to 0.7.0. See Playwright Browser.
Increased gRPC message limit: The plugin transport's gRPC message receive cap was raised from 4 MiB to 64 MiB to accommodate larger payloads, such as base64-encoded browser extensions for playwright_browser installation.
Updated connector documentation: New documentation pages were added for loki and httpbin connectors, and these, along with playwright_browser, were registered in the sidebar and connector index.

Fixed

Connector list visibility for non-admins: A connector now stays listed for non-admin users once its type has any instance, even if every existing instance is tag-restricted from them — so they can add their own account instead of the connector disappearing entirely.

v0.33.0 — Connectors & Plugins

Released on 2026-07-20

Added

Notion Connectors: Two new plugin connectors for Notion:
- notion: Wraps the official REST API (Notion-Version 2022-06-28). Supports search, fetch (properties + markdown body via the block tree), query databases, comments, users, and create/update pages/databases.
- notion_unofficial: Reads and writes through Notion's private web API using a token_v2 session cookie (with a paste-a-cURL setup widget). Sees everything the logged-in user can see, including embedded/filtered database views. Provides describe_database (schema + options + view filter) and create_page with typed properties (date/select/relation), plus query_database, get_records, create_comment, set_title. Handles token expiry with actionable errors and retries HTTP 429 with backoff.
- Both install via <app> plugin install notion / notion_unofficial.
- A new Productivity connector tag groups docs/knowledge-base connectors.
Per-instance AI Description for Connectors: A connector row's detail page now has an AI description field. This free text can be attached by an admin to a specific connector instance (e.g., when to use it, team notes, account constraints). It auto-saves and is appended to the connector type's built-in description wherever the wickmanager connector surfaces it to an LLM (connector_list, connector_get). See Connector Module ▶ AI description.
Enhanced Connector Configuration UX:
- ConfigOnly Operations: Introduced connector.OpConfigOnly for operations that back a config-form widget (e.g., pickers, status) but are not agent tools. These are hidden from the MCP surface, blocked via wick_execute for non-test sources, and labeled "config only" in the admin UI.
- Extended HTML Config Widget: The html=<op> config widget can now return {fields:{k:v}} to fill sibling config fields and {html} for its own feedback. The connector's named <input>/<textarea> values are sent to the operation, enabling custom config form building (e.g., paste-a-cURL import).
- Loki Connector Improvements:
  - org_id and datasource_uid are now HTML pickers, utilizing ConfigOnly operations (list_orgs, list_datasources).
  - A connection_status widget shows Grafana version and reachability.
  - auth_mode (basic|token) provides conditional visibility for username/password vs. token fields.
  - Configs are regrouped into Connection, Authentication, and Datasource sections.
  - labels and label_values operations now accept optional start/end parameters.
  - Loki connector version bumped to 0.2.0.
Plugin Debugging with Reattach: Added support for breakpoint debugging connector plugins via go-plugin reattach. This allows attaching a debugger (like dlv) to a running plugin instance. A key fix ensures ClientConfig.Plugins is explicitly set during reattach to avoid "unknown plugin type" errors. VSCode launch configurations are provided for an integrated debugging experience.
Loki and Phoenix Connectors Moved to Plugins: The Loki and Phoenix connectors are now downloadable plugins (same as GitHub/Bitbucket/Google Workspace) rather than in-tree builtins. They are no longer compiled into Wick and must be installed via <app> plugin install loki|phoenix. Loki's datasource_uid is now a required field.

Fixed

Agent Visibility Gate for Shared Resources: Corrected an issue where callerProjectAccess for agents only unioned owner grants. Projects and data tables shared via filter tags (tool_tags) are now correctly visible and accessible to users carrying the matching tags, resolving 404 errors and visibility issues in the sidebar and default-project dropdown. Untagged projects/data tables remain owner-private.
Phoenix Connector Documentation: Fixed stale source paths and tier labels in the connector reference page and index, ensuring they correctly point to the plugin location and installation flow.
Tool-Call Trace Preservation: Resolved an issue where the optimistic live turn's streamed trace vanished after a turn finalized, requiring a manual refresh. The setHistory function now grafts the local turn's inline events onto its persisted twin, ensuring traces are continuously visible.
Required Field Visibility Logic: Missing() and required-completeness checks now correctly honor visible_when conditions, preventing fields that are only required under specific circumstances from being flagged as missing when hidden.
Dead Changelog Links: Fixed two dead links in the v0.28.1 changelog that incorrectly pointed to guide/agents/9router instead of the updated guide/agents/airouter.

v0.32.0 — Agents & Providers

Released on 2026-07-14

Added

Recent Spawns grouped per session, with crash detail and a log viewer: The Providers page's Recent Spawns table now groups spawns by session (one row per session, with a spawn count and latest status) instead of listing every spawn flat; clicking a session opens its spawn history, each expandable inline to the full spawn detail. A crashed spawn now shows its exit code and a stderr tail, and a process that disappeared without recording an exit event is flagged as "died, no exit event" instead of looking like it's still running. Spawn detail also links straight to a new in-app log viewer (/providers/logs?file=) for the relevant server/mcp/worker/app/gate/daemon log file, with copy-path, copy-JSON, and download actions. See Providers — Recent Spawns list.
Session connector idle TTL: Session connectors now expire by session inactivity (10 minutes of no running/queued subprocesses) instead of a daily purge job. A self-terminating sweeper reaps idle connector instances, leaves a tombstone notice ("deleted, re-create"), and provides a buffered [system] context turn to the agent on the next user message. The old session-config-purge job has been removed.
Silent replies for agents: An agent reply that begins with the [silent] marker is now kept out of every channel (Slack/Telegram/REST) and idle push notifications, but still reaches the web UI (shown with a muted-bell flag, marker stripped) and the conversation log. The registry buffers a turn's events to correctly process the marker even if split across stream deltas.

Fixed

Daemon log is now dated and actually gets pruned: The daemon's own log (daemon.log) is now written per-day (logs/daemon-YYYY-MM-DD.log) alongside the other runtime logs, and a bug that let dated log files (including the daemon's) skip retention pruning entirely is fixed — old logs are now deleted on schedule instead of accumulating forever. <app> status --log still finds the right file by tailing the newest daemon-*.log. See Daemon (background).
AI Router dashboard SSE streams no longer reconnect in a loop: The AI Router dashboard's Requests/Logs SSE streams no longer experience continuous reconnections. This was resolved by bypassing the service worker's 8-second AbortController for text/event-stream requests, widening the /airouter/* skip to include the base-prefixed mount (/tools/agents/airouter/), and adding 15-second keepalive comments and a leading : connected message to the stream handlers.

Changed

Agent replies UI uses a serif reading font: Agent replies in the web UI now render as plain serif prose (Source Serif 4, 16px / 1.5 / ~68ch measure) to make the conversation read like a text page. Only user turns retain a bubble. The rest of the app chrome and body text remains in sans-serif (Inter).
Connector catalog injection removed from system prompt: The connector catalog injection has been disabled in the system prompt. It previously listed connector keys without per-instance IDs and rendered the global registry rather than the caller's visible set; agents now discover connectors via wick_list/get/search.

v0.31.0 — AI Router

Released on 2026-07-12

Added

AI Router: multi-router (9router + OmniRoute), switchable, per-provider routing: The embedded 9router dashboard has been generalized into an AI Router page. This page now hosts multiple router backends concurrently, including 9router and OmniRoute. Each router is installed, run, and reverse-proxied on its own loopback port (/airouter/<id>/), allowing concurrent operation. A switcher is provided to flip between their Dashboard, Requests, and Settings tabs. Provider instances (e.g., claude, codex) now feature a Route through AI Router toggle, a router picker, per-slot model overrides, a custom API key, and an admin-only Advanced section that previews and allows editing of the exact effective spawn configuration (env vars / codex -c overrides) as a raw override. A new master switch (AirouterEnabled), replacing Router9Enabled, gates the entire feature, while per-router auto-start and external-API toggles are available on the AI Router page itself. Existing 9router-routed instances and settings carry over unchanged. See AI Router.
AI Router badge in the composer provider picker: Provider instances configured to route through the AI Router now display an AI Router badge within the composer's provider menu. This includes a pill next to the option in the list and a corner dot on the selected provider chip, making it clear at a glance which providers are proxied. See AI Router.

Fixed

Composer preselects the project's default provider: On the Project landing page the composer now seeds its provider from the project's configured default instead of always falling back to the first provider (claude) — matching the New Session page.
/ and @ work mid-message, not just as a prefix: The command palette (/) and file-mention (@) menus now open when the trigger is typed at the start of the line or right after a space, so you can drop a command or mention partway through a message; path-like text such as src/foo stays inert. See Agents — Composer.
Live session stream self-heals after a drop: The conversation stream (SharedWorker, with an EventSource fallback) now reconnects when a downed or restarted server closes it and replays the snapshot on reconnect, and resyncs when the tab returns from the background or the network comes back — so a stalled session recovers on its own instead of needing a manual reload.
Failed agent spawns no longer stick on "spawning": When a subprocess fails to launch, the session now tears down to idle and the failure is surfaced as an inline system error turn (persisted, like any runtime error) instead of only a request-level toast; the send itself succeeds.
AI Router dashboard streams no longer reconnect in a loop: The Requests and Logs live streams kept dropping every few seconds. The service worker was aborting the page-level EventSource on its 8s navigation-timeout and never bypassed the base-prefixed /tools/agents/airouter/ mount; it now skips any text/event-stream request outright. The stream handlers also gained a 15s keepalive (matching the conversation stream) so an idle stream isn't reaped by an upstream proxy.

v0.30.1 — Data Tables

Released on 2026-07-10

Added

Per-User Data Tables:
- Introduced data tables as a first-class, per-user resource. HTML artifacts can now perform CRUD operations (Create, Read, Update, Delete) on these tables without compromising the artifact sandbox.
- Ownership: Each schema/entity now carries an owner user ID. Tables are taggable resources keyed by slug (e.g., owner:<slug>). Access is granted via owner tags, admin-granted users, a direct-owner fallback, and AdminSeeAll permissions, applied across the /data-tables UI list, detail views, and mutations.
- Admin Grant Page: A new /admin/data-tables page allows administrators to share data tables by tag, mirroring the existing workflow sharing mechanism.
- MCP Scoping: The connector.Ctx now includes CallerUserID, stamped by connectors.Service from the session owner, gating access and attributing create ownership to the specific user.
Widget CRUD Bridge:
- JSON Row API: A new API endpoint GET/POST/PATCH/DELETE /api/data-tables/{slug}/rows is introduced for programmatic access, guarded by permissions.
- Sandboxed Widget Access: window.wickDataTable.query, insert, update, and delete methods are injected into every artifact iframe. Sandboxed widgets can't directly fetch, so the parent proxies each call using the session cookie, maintaining the same trust model as window.wickReadFile.
- Agent Prompt Documentation: The system prompt has been updated to document this new bridge, enabling agents to build database-backed widgets.

Fixed

Composer Command Palette Alignment:
- Resolved an issue in the / command menu where the description's width would collapse the command name on narrow or mobile widths. The command name now has priority and is pinned to a fixed-width column, ensuring every hint aligns in a straight second column for improved readability, especially for the skills list. File mentions (@) retain the full row for filenames.
Provider Test Flakiness:
- Fixed flaky TestRename and TestSwitch tests within the agent provider package, which were failing under the -race CI gate. This was due to a race condition where Save's async probe goroutine for reloading and rewriting config.json sometimes conflicted with subsequent synchronous test operations. A saveSeed helper now ensures this goroutine is drained after each seed Save, serializing config writes and preventing stale reloads or file access denials on Windows. (Internal stability improvement.)

v0.30.0 — Composer & Agents

Released on 2026-07-10

Added

Unified chat composer with @ file mentions and / command palette: The New Session page, Project landing page, and live session Conversation tab share a single composer component. Typing @ opens a file-search popup — scored against the session's working directory (GET /sessions/{id}/files/search) in a live session, or against the selected project's folder (GET /api/projects/{id}/files/search) on the New Session / Project landing pages, before any session exists. Typing / opens a command menu — switch provider/project, open a panel (processes/workspace/source/context), change the view (commands/approvals/raw), or run an installed skill — sourced from GET /api/composer/commands, scoped with scope=new (skills only, for pre-session pages) and provider=<type> (skills for just that provider); the skill scan behind it is cached server-side for 30s. The toolbar is now a compact + hub menu (attach, screenshot, add context, commands, project/provider/preset) plus icon-only project/provider chips, replacing the old dropdown row. See Agents — Composer.
Screenshot capture, inline image editor, and provider brand icons in the composer: The + menu's new Take screenshot action (getDisplayMedia) and an edit affordance on attached image chips both open a canvas annotator — crop, arrow/rectangle/ellipse/pen, and a blur tool for redacting sensitive detail before sending — with undo and a PNG export at the image's native resolution. The provider chip and its picker now show the Claude / Gemini / Codex brand mark instead of a generic icon (Codex swaps a light/dark SVG pair to follow the app theme). See Agents — Composer.
HTML artifacts by path (```htmlfile fence): A new fence previews a saved .html file by its session-relative path instead of pasting the markup into the transcript — same sandboxed preview (Full screen / Show code / Download) as inline ```html blocks and file artifacts, but the transcript only ever stores the path. Clicking a .html file in the Context file panel now opens the same live preview with an Edit/Preview toggle and Reload. See Agents — Artifacts.
Artifacts can read session files via window.wickReadFile: Sandboxed HTML artifacts can't fetch() (the CSP blocks it by design), so the runtime now injects window.wickReadFile(path), returning a Promise of a session file's text contents fetched by the parent page and handed back over postMessage. Lets a generated dashboard load data from a session file without loosening the sandbox. See Agents — Artifacts.
Data Tables are now a per-user owned resource: /data-tables lists only tables the signed-in user owns or was granted via an owner:<slug> tag — the same ownership model as Workflows and Skills — with admins seeing every table only when admin_see_all is on. A new /admin/data-tables grant page lets an admin share a table with other users. The agent's MCP datatable_* ops are gated the same way: a session can only reach tables owned by the human behind it, and a table it creates is owned by that user, not the shared internal agent principal. See Admin Panel — ownership.
HTML artifacts can read/write a Data Table via window.wickDataTable: Alongside wickReadFile, the runtime now injects a wickDataTable.{query,insert,update,delete} bridge into every artifact, proxied by the parent over the same postMessage channel — no fetch ever leaves the sandbox, and access is enforced server-side per table. Backed by a new JSON row API, GET/POST/PATCH/DELETE /api/data-tables/{slug}/rows. See Agents — Reading/writing a Data Table from an artifact.

Fixed

Ace code editor caret drift: Fixed the text caret drifting from its visible position in the Context file panel's Ace editor by re-measuring font metrics after the editor becomes visible and webfonts finish loading.
9router dashboard iframe now agrees with the status badge: The Dashboard tab's embedded iframe now probes the dashboard port directly (like the status badge and API proxy already did), instead of only checking whether wick itself spawned the process. A 9router started outside wick, or one that survived a wick restart, now serves the iframe instead of showing "not running — start it first" while the badge says Running.
/ command palette names no longer truncate on narrow widths: Command names in the / palette now sit in a fixed-width column so their hints (e.g. skill descriptions) line up instead of the name getting clipped to a few characters. @ file mentions are unaffected — the filename still uses the full row width.
Schedule and Slack features (review findings from PR #972):
- Correctness:
  - session_schedule_handler: Fixed a potential panic on nil dereference if a concurrent cancel occurred between the mutation and a re-fetch, by handling the error and reporting the schedule as gone.
  - pool.send: Prevented duplicate user message SSE broadcasts by tracking userMsgNotified and skipping the second call.
  - entity.ScheduledMessage: Clamped negative MaxRuns values to 0 in BeforeCreate to ensure capped recurring schedules do not become unbounded.
  - store.ClaimDue: Parked claimed rows approximately 100 years in the future instead of now+2h. This prevents re-firing of claimed rows after a crash exceeding 2 hours, ensuring an at-most-once delivery bias.
  - stream.PublishUserMessage: Added logging and graceful exit on json.Marshal errors, consistent with other publishers.
- Slack:
  - getReactions: Now rejects requests if both file and channel+ts parameters are supplied, enforcing the documented either/or contract.
  - shapeReadFile: When Slack reports no mimetype, the function now falls back to utf8.Valid to return text files inline instead of base64.
- UI:
  - Scheduled rail badge: Excludes paused recurring schedules from the live count displayed in the badge.
  - Scheduled SPA: Updated data-base fallback to use || instead of ?? to prevent API routing issues in the dev environment; changed the dev port from 5177 to 5183 to resolve a collision.
- Rejected Findings: The schedule-id "enumeration" timing concern (ids are random UUIDs, both paths return 404) and the scheduledPage notReady guard (page-shell handlers don't call notReady; the schedulesAllUI data endpoint already guards nil) were reviewed and rejected as not applicable.

v0.29.0 — Scheduled Messages & Slack

Released on 2026-07-09

Added

Scheduled messages: A new session-scoped primitive allows agents to inject messages into a session at a later time, either as a one-shot or recurring event, without involving the workflow engine. Agents can schedule via the new wick_schedule_message MCP tool (create / list / cancel / pause / resume / reschedule), specifying timing with run_at, every, or cron. Users can manage these messages via a per-session Scheduled tab or a new global Scheduled sidebar page (/tools/agents/scheduled), which lists all schedules across sessions, filterable by status and grouped by session. Messages are delivered through the normal pool send path, behaving exactly like any inbound message. See Scheduled Messages.
Slack: file ops + get_reactions: The Slack connector now includes a new Files category, offering list_files, get_file_info, and read_file. read_file downloads file bytes using the bot token, returning UTF-8 text as a string or binary/images as base64, with a max_bytes guard. Additionally, get_reactions has been added to read existing reactions on messages or files, alongside the existing add/remove operations. These operations require files:read and reactions:read scopes to be added to the bot token. See Slack connector.

Fixed

Inbound messages from channels/schedules now appear live in an open web session: Messages injected by sources like Slack, Telegram, or a fired schedule now immediately appear in an open web session, rather than requiring a manual refresh. A new user_message SSE event pushes these messages live, displaying a badge (e.g., ⏰ Scheduled / via Slack) above the message bubble to indicate its origin. See Channels ▶ SSE event vocabulary.
Session connector instances no longer stuck on "needs setup" when a required field has a default: A required configuration field now correctly registers as satisfied if its base specification includes a non-empty default value, resolving an issue where freshly-added session connector instances would display "needs setup" until a redundant edit-and-save operation.
Scheduled messages rail badge correctly counts active recurring schedules: The DetailView rail badge for scheduled messages now accurately counts both "pending" and "active" recurring schedules, ensuring sessions with only active recurring schedules no longer incorrectly show a count of zero.

v0.28.5 — Fixes

Released on 2026-07-08

Fixed

9router status reflects the real process, not just wick-spawned ones: The Settings tab status badge now probes the dashboard port directly, so a 9router instance started outside wick (or one that survived a wick restart) correctly shows Running. The installed version is now cached for up to an hour and refreshed in the background instead of shelling out to npm on every status check; the badge briefly shows Checking… on the very first load.
Plugin update no longer fails while the plugin is running: Installing/updating a connector plugin now replaces the binary via an atomic rename instead of an in-place overwrite, so updating a plugin mid-use no longer fails with a "text file busy" error. The update process now first fetches and verifies the archive to a temporary directory, ensuring that a failed download does not disturb the existing installation. The manager UI's connector card also shows live staged progress (downloading %/verifying/replacing/done) while an update runs.
Playwright Browser: CloakBrowser and CDP-reconnect skip the Chromium download: Opening a session with Browser=cloakbrowser, or reconnecting to an already-open live session over CDP, no longer triggers Playwright's own ~150MB Chromium download — only the small node driver is fetched.

v0.28.4 — Playwright Enhancements

Released on 2026-07-07

Fixed

Playwright Browser: eval marked destructive: The eval operation, which allows running arbitrary JavaScript in the page, is now gated behind the same destructive opt-in as the run operation for consistency and enhanced security.
Playwright Browser: persistent data directory: Live-session metadata, browser profiles, and CloakBrowser downloads now default to a persistent directory under the application's tree (~/.<app>/plugins/playwright_browser) instead of the OS temporary directory. This change ensures that the ~200MB CloakBrowser download, along with other session data, survives OS/Storage Sense temporary file cleanups. This behavior can still be overridden using the SessionDir configuration option.
Playwright Browser: driver install falls back to a mirror CDN: If the default Playwright download host is unreachable, the connector now retries the download once against cdn.playwright.dev before failing. Additionally, failed installations are no longer cached, meaning that the next call will retry the download instead of immediately failing, preventing the plugin from being rendered inoperable by transient network outages.
Playwright Browser: file write permissions: Fixed an issue where writeFileFrom did not correctly set execute permissions (+x) for downloaded files, ensuring executable files are properly runnable.
Playwright Browser: session ID path traversal guard: Added validation for session IDs used by readMeta, rejecting any IDs that contain characters outside of [A-Za-z0-9_-]+ to guard against potential path traversal vulnerabilities.
Playwright Browser: improved CloakBrowser installation logging: The full CloakBrowser install path is now logged to stderr, and panic recovery is integrated into the progress file, improving visibility and robustness during installation.
Playwright Browser: faster browser status polling: Caching probeVersion by executable path significantly reduces browser_status poll times from approximately 3-4 seconds to about 1 second.
Provider Storage Retention job no longer auto-enables: The provider-storage-retention job now starts disabled on fresh installs, aligning its behavior with provider-storage-sync. It can be manually enabled from Tools → Jobs → Provider Storage Retention → Settings → Enabled.
UI: HtmlField 'Loading…' flash: The 'Loading…' message no longer flashes on poll refreshes for HtmlField components; it now only appears on the initial data fetch.

v0.28.3 — Connectors & Workflows

Released on 2026-07-07

Added

Playwright Browser connector plugin: A new playwright_browser connector drives a real browser (Chromium/Firefox/WebKit, plus a stealth CloakBrowser engine) via embedded Playwright. Page-task ops (screenshot, get_content, pdf, scrape, eval) launch an isolated browser per call; a scripted run op executes an ordered list of 32 browser actions (navigation, clicks, form fills, reads, …) in one session; live-session ops (session_open / session_list / tab_new / tab_close / session_close) keep a persistent browser open across calls — and plugin restarts — reached over CDP. Maintenance ops back an admin-only browser picker on the instance's Settings page. Install with <app> plugin install playwright_browser. See Playwright Browser.
html=<op> config widget: A new server-rendered config widget lets a connector op return markup ({html:"..."}) that the admin Settings page renders read-only, wiring click behaviour back to the connector via a data-op/data-arg convention (select a value, or run another op and re-fetch). The core stays domain-agnostic — all layout and logic live in the connector. See Config tags reference.

Improved

Collapsible config groups: group=Title|Description|collapsed now supports a 3rd segment that starts a config group card collapsed on the admin Settings page — useful for advanced/rarely-edited fields so the page opens uncluttered. See Config tags reference.

Fixed

SPA connector detail dropped the group config tag: The connector detail JSON response was missing the group field, so fields configured with group=... silently lost their card grouping in the Svelte connector detail page (the templ-rendered admin Settings page was unaffected).
Workflow connector palette drills into instance + SSO account: Dropping a connector node from the canvas palette now walks connector → instance → op, expanding EnableSSO connectors (e.g. Slack) into one entry per connected account plus a Default credentials entry for the row's own config. Only fully-configured ("ready") instances are shown, ops disabled on an instance or account are hidden, and the list is filtered to instances the current user can access. A workflow connector node can now carry account_id alongside row_id to pin a run to a specific connected account; the engine injects that account's token at run time. See connector node.
New Slack trigger thread_started ("Slack: New thread"): fires only when a user starts a brand-new top-level thread, never on replies inside an existing thread. Uses the same channel/user/text filter schema as the existing message trigger. See Triggers ▶ channel.
Windows: spawning npm-installed CLI shims (e.g. codex.cmd) with a space-containing argument failed: Go's default quoting for .bat/.cmd launches doesn't match cmd.exe's own re-parsing, so an argument with a space (or a shim path under C:\Program Files\...) could fail with 'C:\Program' is not recognized as an internal or external command. Wick's internal process spawner now builds the cmd.exe command line itself for .bat/.cmd targets.

v0.28.2 — Providers & Projects

Released on 2026-07-06

Changed

DefaultProvider is now a dynamic dropdown: The agents.default_provider setting no longer offers a fixed claude|codex|gemini choice — its options are your live configured provider instances (bare type, or type/name when several instances share a type). It's unset by default and falls back to claude at spawn time, so a fresh install doesn't pin a provider the operator never chose.
Removed the operator-wide default_project_id setting: Session cwd resolution is now just: session's bound project → per-session temp dir. Personal projects (auto-created per user) now cover the old "landing" case. A one-shot boot migration prunes the stale agents.default_project_id config row.
Personal projects are undeletable: Auto-created per-user personal projects (tagged personal) are now protected from deletion, same as the built-in default project — the delete button is hidden and the API rejects the request.
- The project settings API field is_default has been renamed to is_protected to reflect this change.

Improved

Frontend build process optimized: Replaced the per-workspace vite build --watch fan-out with a single recursive fs.watch. This reduces idle CPU/RAM usage during development and rebuilds only the changed workspace on demand. An initial pass builds every workspace once with bounded concurrency.

Fixed

Channel spawns now honor the project's default provider: A session auto-created from Slack, Telegram, or REST previously always fell back to the operator-wide agents.default_provider (or claude) when spawning its first agent, ignoring the provider configured on the session's bound project. Provider is now resolved as: project default → global default → claude.
9router failed to start on Termux/Android: /9router/start could return a 504 because the process died immediately — 9router's #!/usr/bin/env node shebang doesn't resolve on Termux (no /usr/bin/env). Wick now launches it as node <entry.js> directly when a Node binary and JS entrypoint can be resolved, bypassing the shebang; it falls back to executing the binary directly otherwise.
Config save race: Concurrent writes to the same config file (e.g. a foreground save racing a background rescan) could crash with a rename ... no such file or directory error. Each save now writes to a uniquely named temporary file before renaming it into place. The "cannot be deleted" error for the default/personal project now reads "this project is protected and cannot be deleted".

v0.28.1 — AI Agents & 9router

Released on 2026-07-03

Added

9router embedded dashboard (admin-only): A new Agents → 9router page (/tools/agents/9router) lets admins install, run, and manage the 9router npm LLM-router/proxy without shell access. The dashboard is reverse-proxied through the wick origin at /9router/ with URL rewriting, so no extra port or tunnel is needed. A master switch (router9_enabled) in agent settings globally enables/disables the dashboard, proxy, and auto-start. Settings tab: Install / Update (via npm install -g 9router), Start / Stop / Restart buttons, Auto-start on boot toggle (makes 9router a boot-gate step so the dashboard is ready on first page load), and a live Logs panel. The 9router tool has been reworked into a Svelte SPA, including Dashboard, Requests, and Settings tabs, JSON pretty-print, and fullscreen analysis via the shared CodeEditor. An External API access toggle (router9_external_api, default off) controls whether the /9router/v1 proxy answers non-local calls. New Live request stream (SSE pub/sub) is captured while the Requests tab is open, and a Live log stream replaces log polling for real-time updates. Theme tracks wick's light/dark setting automatically. Requires npm on host PATH. See 9router guide.
Route providers through 9router: claude and codex provider instances now have a Use 9router toggle on their detail page (admin-only). When enabled, the spawned CLI routes its LLM calls through wick's embedded 9router proxy (/9router/v1) instead of the provider's own cloud endpoint. Per-type model slots (claude: opus / sonnet / haiku; codex: model / subagent — all optional) map to concrete 9router route IDs. The model picker fetches a live catalogue, grouped by owner. A custom API key field stores the 9router auth token encrypted at rest; blank defaults to sk_9router. See 9router — routing providers through 9router.
Unauthenticated /9router/v1 proxy: Spawned AI CLIs now reach 9router through wick's own loopback address at /9router/v1/ — no wick session cookie required. Auth is handled by the 9router API key. The endpoint is loopback-exempted from the host allowlist (same as /mcp).
Provider instance catalog picker: The provider detail page's Env and Extra Args fields now include a Browse catalog button that opens a searchable multi-select modal of known env vars and CLI flags for that provider type (claude, codex, gemini), with descriptions and default values. Selecting entries inserts them directly into the KV editor. Value cells for known env vars render as option dropdowns instead of plain text inputs. New endpoint: GET /providers/catalog/{type}.
Provider instance rename: Rename a provider instance from its detail page (pencil icon on the title). The new name must use letters, digits, or _ only; spaces auto-convert to _. On save, every project whose default provider matched the old type/name key is rewritten to the new key automatically. Live sessions keep the old provider key and must be re-selected by the user. New endpoint: POST /providers/rename/{type}/{name}.
Provider Switching (in-place): The active provider can now be switched on the current session (e.g., via a "#codex" message). This change is persisted, the subprocess is killed, and respawns on the next send. It supports named instances (type/name), rejects switching to the current provider, and records the target's context isolation. Back-to-back switches collapse to the latest.
Spawn-log Reproduce: A new feature for spawn log details allows building copy-pasteable commands for bash, PowerShell, and cmd.exe with injected environment variables inlined. Toggles are available for headless vs. interactive mode, masked vs. live secrets (fetched from a new admin-gated reveal endpoint), and full vs. short binary path, offering 24 variants. The spawn detail page has been moved into the Providers SPA as /spawns/:file, rendering the reproduce command in a shared CodeEditor. A 'Resume' toggle (Keep vs Fresh) is available and hidden when the spawn has no resume ID.

Changed

Provider dropdowns list real instances: The provider selector in the New Session composer and the Project Settings form now shows actual type/name instances (e.g. claude/work) rather than bare provider types. Picking a project in the composer auto-fills its saved default provider. Older bare-type defaults (claude, codex, gemini) are promoted to their canonical instance key at runtime without any data migration.
Spawn detail — injected env panel: The spawn detail page now shows an Injected env card listing the environment variables wick added for that spawn (instance env + 9router routing overrides). Secret values (keys, tokens, passwords) are partially masked. Recent Spawns table rows are now clickable links to the detail page.
Conversation — provider errors and warnings visible: Provider error turns (e.g. authentication failures, rate-limit messages from the CLI) now render as a distinct red error chip in the conversation instead of being silently dropped. Unrecognized CLI frames appear as a collapsible Raw event block inside the turn trace. Previously both were discarded.

Improved

Themed UI Components: The New Session composer now uses Wick's themed Select component for provider, project, and preset dropdowns, ensuring visual consistency with the application's light/dark settings.
Process Management: Process status reporting has been made more accurate, including proper reaping of dead agent processes (like resident Codex CLIs) and more precise OS state probing. Idle-fallback rows in the /processes endpoint are now correctly tagged as kind:"idle" to prevent misinterpretation, and panel refreshes are coalesced (~200ms debounce) to reduce network requests.
Conversation Reliability: An intermittent issue causing double-rendered assistant replies has been fixed by ensuring streamed live turns deduplicate against their persisted twin.
Shared Code Editor: The CodeEditor component has been extracted into @wick-fe/common-ui, leading to consistent display and functionality (e.g., JSON mode, in-editor search) across conversation file viewer, workflow script-node editor, and the new spawn-log reproduce editor.

Fixed

9router OAuth Callback: The OAuth sign-in flow for 9router was fixed to correctly build redirect_uri for Google, preventing 404 errors.

v0.28.0 — Slack & Connectors

Released on 2026-06-30

Added

Slack channel — reaction auto-reply switch: React 🤖 (robot_face) on a thread's top (parent) message to make every new reply in that thread dispatch to the agent without an @mention. Remove the reaction to stop (a run already in flight finishes; only the next reply is dropped). The switch persists to session meta and survives a wick restart — re-reacting is not needed after a restart.
- Enable on the Slack channel config page: toggle reaction_trigger_enabled, then set reaction_channels_mode (all or whitelist, default whitelist). The reaction_channels picker controls which channels honour the switch.
- Threads are still created by @mention only — the switch never starts a new session, it only gates replies to an existing one.
- Slack app must subscribe to reaction_added, reaction_removed, and message.channels events, with scopes reactions:read + channels:history. The shipped docs/slack-app-manifest.json already includes them. See the Reaction auto-reply section of the channels guide.
Config field grouping (wick:"group=..." tag): Config struct fields can now be grouped into titled section cards in the admin Settings UI by adding group=Title (or group=Title|Description) to the wick:"..." tag. All fields sharing the same title render together under one card, in first-seen order. The optional description is written once at the top of the card. Fields with no group fall into the default "Configuration" card. Applies to Slack channel config, Agents settings, connector/tool/job detail pages. See the group — config field grouping section of the config tag reference.

Changed

Connector plugin marketplace — any logged-in user can browse: GET /manager/api/plugins now requires only a valid session, not admin. Every user can see the installed + available plugin catalog. Lifecycle actions (install / update / enable / disable / remove) remain admin-only; non-admins see a "Requires admin" disabled state on the Download button and the connector detail kebab hides the Update / Uninstall / Disable options.
Access policy + per-session config — editable by instance owner: The Access Policy section and session-config override on a connector detail page are now editable by the instance owner (creator) in addition to admins. AllowOthersConfigure users are intentionally excluded — the policy controls who receives that grant. The API response carries a new can_manage_policy field that the UI reads to show or hide those sections.

Improved

Slack channel — live agent status in assistant threads: While an agent turn runs, the assistant-thread banner now shows richer progress feedback. The footer state cycles through "Thinking" / "Working" / "Idle" with an animated dot suffix. The loading bubble (loading_messages) rotates the last ~5 activity lines (e.g. "Thinking", "Running: npm test", "Reading slack.go") so users can follow the agent's current step without any configuration change.
Slack channel — streaming reply: The agent's reply streams into Slack as it is produced — wick posts a placeholder on the first text token and edits it in place every ~1.5 s via chat.update, instead of posting a single message at end of turn. No configuration change required.
Slack channel — sender label on every turn: Inbound Slack messages are now prefixed with a resolved Real Name (@handle, UXXXXXXXX): label, cached per user via users.info. Useful in multi-user threads and for matching the sender to their per-user connector when replying. Falls back to the bare user ID if the API call fails.
Slack channel — file attachment context: When a user posts files (images, PDFs, file_share events), attachment metadata (name, type, size, Slack permalink) is appended to the user turn so the agent knows what was shared and has a link to fetch the content via the Slack connector. file_share-only messages (no body text) are no longer silently dropped.
Slack connector — session-aware "Sent using" footer: The "Sent using @bot" footer on send_message and update_message now names the bot that owns the agent session, not the connector instance doing the sending. Any Slack connector row used inside a Slack-channel session credits the correct bot. Both ops accept an optional session_id input; the MCP transport also auto-injects it via the X-Wick-Session-Id header so no manual wiring is needed in workflow nodes. update_message now consistently re-appends the footer on every edit.

v0.27.2 — Connectors

Released on 2026-06-29

Added

Connector-type disable/enable switch — Admins can now hide an entire connector type from the LLM with one toggle (header kebab → Disable connector on the connector detail page).
- Disabling a type immediately removes all its instances and operations from wick_list and wick_execute, making it invisible to the agent.
- The connector remains visible in the manager UI with a Disabled badge, allowing it to be re-enabled at any time. This is distinct from the per-row Disabled flag.
- The connector list card now shows a Disabled badge and dimmed dashed styling. The detail page displays a disabled banner, inactive instance chips, and dimmed rows for disabled types.
- API: POST /manager/api/connectors/{key}/type-disable and /type-enable.
Plugin update / uninstall from the manager UI — The connector detail page header kebab now offers new options:
- Update to v{X} appears when the marketplace catalog has a newer version, indicated by an Update badge on the connector list card. An update hot-swaps the plugin binary without requiring a service restart.
- Uninstall plugin removes the plugin binary while preserving its associated rows and configuration in the database.
- Both operations are admin-only.
- API: POST /manager/api/plugins/{key}/update.

Fixed

Connector Index Card Display — Corrected an issue where listConnectors() didn't map the disabled_type field, preventing the index card from accurately reflecting a disabled connector type.
Plugin Install Refresh — Ensured that the install refresh process now awaits both list updates and confirms connector registration before clearing the spinner, resolving an issue where newly installed connectors only appeared after reopening the UI.
Session Key Prefix — Changed the session-key prefix from ":" to "-" to ensure compatibility with session IDs and Windows filenames, which consider ":" an illegal character.

v0.27.1 — CI

Released on 2026-06-28

Fixed

Resolved an issue in the CI pipeline where plugin releases were incorrectly marked as "Latest" on GitHub. The make_latest input for the release action is now explicitly quoted ("false" for plugins, "true" for core) to ensure proper string parsing, preventing plugin releases from inadvertently stealing the "Latest" badge from core Wick releases.

v0.27.0 — Plugins & Connectors

Released on 2026-06-28

Added

wick plugin catalog — A new CLI command that regenerates plugins.json from live GitHub releases. This replaces the jq pipeline previously used in release-plugins.yml, and its output uses the same Available struct the app reads, preventing catalog shape drift. See wick plugin catalog.
Plugin DefaultTags — Plugins now declare Meta.DefaultTags using the shared plugins/tags catalog. This ensures they appear in the same category grid as built-in connectors (e.g., API, Communication) without requiring any manual tag configuration.

Changed

GitHub, Bitbucket, and Google Workspace moved to external plugins: These three connectors are no longer compiled directly into the wick binary. They now ship as independently versioned and downloadable plugin binaries located under plugins/connector/.
- You can install them on a running app using commands like <app> plugin install github, <app> plugin install bitbucket, and <app> plugin install google_workspace. Each can then be enabled from the manager UI.
- Existing credential rows and OAuth tokens are preserved on upgrade; the connector will reappear automatically once the matching plugin is installed and enabled.
- The agent build profile no longer includes GitHub; it now contains only httprest and slack.
- The full profile now registers 4 built-in connectors (HTTP REST, Slack, Loki, Phoenix), down from 7.
Connector list — plugins merged into category grid: Available-to-install plugins no longer appear in a separate "Available to install" section below the connector list. Instead, they are integrated into the same category grid as built-in connectors, displaying a Download button instead of a detail link.
- If no build exists for the host OS/architecture, the button will be disabled with a clear reason.
- An Installed filter chip is available to show only connectors that are ready to use (including both built-ins and downloaded plugins).
- Category chips are derived from each connector's tags and span both built-in and plugin connectors.
Plugin install directory — The plugin scan directory now resolves via appname.Resolve(), aligning with the wick.db tree. This fixes a silent mismatch where plugins installed into ~/.wick-agent/ were not found when the binary was named differently (e.g., in a debug build or an MCP stdio subprocess). You can override this behavior with WICK_PLUGINS_DIR.
Hot-reload always active — The plugin hot-reload poller now starts even when zero plugins are installed at boot. This ensures that a plugin installed for the first time is picked up immediately without requiring a restart. Additionally, install, enable, disable, and remove operations now trigger an immediate reload.
wick plugin build --target — This command now accepts a comma-separated list of targets, such as linux/arm64,darwin/amd64,windows/amd64.

v0.26.2 — Release Management

Released on 2026-06-28

Fixed

Version check and Software Update page no longer show a misleading update badge when GitHub /releases/latest returns a plugin release tag (<name>/vX.Y.Z) instead of a core wick tag. The check now degrades gracefully — showing the current version without a badge — rather than comparing against an unrelated tag.
The "Wick vX.Y.Z" badge in the sidebar now links to the changelog page instead of the site homepage.
Release Workflow Improvements:
- Reliability: Eliminated release-artifacts job cancellations by configuring per-workflow concurrency for release pipelines, preventing races between simultaneous releases.
- Stability: Ensured core Wick releases always receive the "Latest" badge by explicitly setting make_latest: true for core and false for plugin releases.
- Robustness: Added update-branch and a 3-attempt retry mechanism to the merge-to-master step, resolving 405 "Base branch was modified" errors.
- Performance: Enabled Go's test cache by removing the -count=1 flag from go test commands, allowing unchanged packages to be skipped during subsequent test runs. Removed redundant go build steps before tests.

v0.26.1 — Plugin Builds

Released on 2026-06-28

Improved

Unified plugin build targets with the shared BUILD_TARGETS variable.
- Previously, plugin releases hardcoded build targets independently of the BUILD_TARGETS Actions variable, which already gated the wick binary build.
- Now, a single BUILD_TARGETS variable controls both wick binary and plugin OS/architecture sets, streamlining the build configuration.
The wick plugin build --target command now accepts a comma-separated list of targets (e.g., linux/arm64,darwin/amd64,windows/amd64).
The release-plugins.yml workflow now reads vars.BUILD_TARGETS with the same default and "all" semantics as release-artifacts.yml.
Added TestResolvePluginTargets to cover the new --target parsing for lists, spaces, empty items, and error handling.

v0.26.0 — Connector Plugins

Released on 2026-06-28

Added

Connector plugin platform: External connectors can now be distributed as standalone Go binaries and installed without rebuilding the host app.
- wick plugin build — compile one or more connector plugins from a plugins-style monorepo and pack each binary + manifest into a versioned release zip (<name>-<version>-<goos>-<goarch>.zip). Supports --all (all OS/arch), --changed (diff-based), and optional ed25519 signing (--sign-key). The build process enforces Meta.Key matching the folder name, strips debug info from binaries for smaller size, and decouples core dependencies. See CLI Reference — wick plugin build.
- <app> plugin install|search|list|enable|disable|remove — lifecycle commands on the running app binary for discovering the marketplace catalog, installing from a registry name / URL / local path, and toggling plugins without a restart. A hot-reload poller detects newly installed or updated binaries and wires them into the connector registry automatically. See App CLI Reference — plugin.
- Internal Architecture:
  - Introduced gRPC proto contract and codegen for inter-process communication between the host app and plugin binaries.
  - Implemented a host-side PluginManager with lazy spawning, idle-kill, concurrency caps (LRU eviction, bounded queue), crash backoff circuit-breaker, and resource limits (rlimit).
  - Added ed25519 signing primitives, manifest envelope with self-packing, and verification (VerifyManifest) for plugin integrity and trust.
  - Integrated a poll-based hot-reload reconciler that honors enable/disable states stored in an overlay table.
  - Supported streaming execution (ExecuteStream) for large results and a warm pool to keep hot connectors pinned and eager-spawned at boot.
  - Provided Ctx.Configs()/Inputs() read-only accessors for plugin transport and ResolveIdentity RPC for OAuth identity resolution.
  - Refactored the plugin monorepo path from wick-plugins/ to plugins/ (module github.com/yogasw/wick/plugins) and updated catalog/release asset URLs accordingly.
- Pilot Connectors: Initial pilot binaries for Slack and Google Workspace connectors, with OAuth enabled.
- wick plugin-keygen command for generating ed25519 signing keys.

Fixed

GitHub API rate-limit error messages (install scripts + updater): When the GitHub Releases API returns a 403/429 due to the unauthenticated 60-req/hr-per-IP quota, install.sh, install.ps1, and the in-app updater/upgrade paths now surface GitHub's own message (e.g. "API rate limit exceeded for 1.2.3.4") together with the reset time. The install scripts additionally print three workarounds: pass TOKEN=ghp_xxx (authenticated 5 000/hr), pin VERSION=vX.Y.Z (skips the API), or wait for the hourly reset.
Plugin Platform Stability:
- Improved JSON serialization for connector module manifests to ensure Operation and Module fields are correctly marshaled and unmarshaled via json:"-" tags, preventing silent data loss.
- Refined hot-reload logic to drop worker hot-reload, as workers do not have a connector execution surface.
- Enhanced security and reliability by switching the plugin manager and related tests to use safeexec.Command instead of os/exec.
- Ensured Manager.KillAll is idempotent and closes race windows during plugin subprocess termination.
- Correctly guarded nil operation handlers and ensured queued waiters are woken, rejecting new spawns during shutdown.
CI and Release Process:
- Improved robustness of plugin release detection in CI to prevent job failures when a plugin kind has no changes, by wrapping command substitutions to swallow non-zero exit statuses.
- Ensured templ files are generated before building the wick CLI from source in CI, resolving build failures on fresh checkouts.
- Streamlined release workflows to use a single entry point (release.yml), preventing concurrent core and plugin releases by dispatching the plugin pipeline only after a core release or for plugin-only changes.
- Enforced unit test completion before release preparation steps in core releases, ensuring the core chain is strictly sequential after tests pass.
- Improved CI cache efficiency and stability by using stable, version-free keys, implementing a delete-before-save strategy for cache refreshes, and serializing all release workflows into a single concurrency group to prevent cache race conditions.

v0.25.3 — Chat & Updates

Released on 2026-06-27

Added

Chat — image card gallery (imagecard fence): A new ```imagecard fenced block renders web-search image results as a masonry gallery — each image at natural height, with a favicon + domain pill. One url | caption per line; url is the only required field. Clicking any card opens a full-screen carousel with prev/next arrows, position counter ("N / M"), ← / → keyboard navigation, source-domain caption, and click-outside-to-close. On non-rich channels (Slack, Telegram) the fence degrades to readable url | caption lines.

Fixed

wick_execute batch mode over SSE/Streamable-HTTP transport: A calls: [...] batch payload sent over the SSE transport was never routed to the batch handler and was rejected with "tool_id is required". Batch calls now work correctly over both the stdio and SSE/Streamable-HTTP transports.
Flaky tests: Addressed two pre-existing flaky tests: one related to HH:mm timestamp locale dependency and another for a DetailView polling interval that was no longer active.

Improved

Software Update page — single action slot: The per-phase controls (check button, download progress bar, Apply & restart button, Restarting indicator) are now consolidated into a single top-right action slot that swaps content as the phase changes, replacing the previous stacked layout. The "no build for this platform" notice (including the expected asset name) now appears inline in the status line under the Updates heading rather than as a separate box.
Software Update page — auto-reload on restart (any tab): The page now starts polling /health and reloads automatically whenever it detects the service is in the applying phase — not only in the tab that clicked Apply. A tab that loads mid-restart (e.g., after a manual server restart) will self-reload onto the new build without a manual refresh. The poll waits for /health to go down before accepting the first successful response, so the reload always lands on the new build rather than the pre-restart process.

v0.25.2 — Upgrade & UI

Released on 2026-06-27

Added

CLI — wick upgrade --yes / -y flag: Pass -y to skip all confirmation prompts (CLI binary, go.mod dep, Dockerfile) and run the upgrade non-interactively. Useful in scripts or CI pipelines.
User menu — version + update status dropdown: The user menu now shows a version section at the bottom listing the running app version and (on non-official builds) the embedded wick framework version, each with a status badge — green Latest or amber Update available → vX. All users can see this; no admin role required.
User menu — "Software Update" shortcut for admins: When any update is available (app or wick framework), admins see a green Software Update entry at the top of the user menu linking directly to /admin/advanced/software-update. Non-admins see the version badges but not this action entry.
Software Update page — wick framework "What's new" (non-official builds): For downstream apps built against wick, the Version panel now shows a rendered changelog block ("What's new") between the embedded wick version and the latest public release. This is populated server-side from the background version cache — no live request on page load.

Changed

CLI — wick upgrade no longer auto-starts dev server: After upgrading, wick exits cleanly instead of launching the dev task. Start the dev server manually with wick dev if needed.
Version cache — background refresh: App and wick framework version checks now run in the background (on boot, then every 6 hours) and are stored in an in-process cache. The user menu dropdown and Software Update page both read from this cache, so neither triggers a network call on the request path.

Removed

GET /admin/advanced/software-update/wick-check endpoint: This live-check endpoint has been removed. The wick framework version check is now served from the background version cache instead.
Unused CI cache warm workflow: The ci-cache-warm workflow, which only warmed shared caches for pr-tests.yml, has been removed. With per-PR CI disabled and the test gate moved to local pre-push hooks and the release pipeline, this workflow was running unnecessarily on every master push.

v0.25.1 — Multi-Bot Channels

Released on 2026-06-26

Fixed

Channels — multi-bot session isolation (Slack / Telegram / REST): Two bot instances (e.g., two per-user Slack bots, even across different Slack workspaces) that happen to share the same thread timestamp, conversation key, or chat ID no longer collide on the same wick session. Each per-user channel instance now namespaces its session ID by its registry key (e.g., Slack/Telegram sessions are prefixed with slack:<owner>:<threadTS>, and REST conversations use a hash of the authenticated user) to isolate pool sessions, on-disk session directories, and reply routing. Note: Existing Slack, Telegram, and REST sessions will experience a one-time context reset after upgrading, as the new session IDs will not match the old ones, causing the next message to start a fresh context.
Channels — HTTP route fan-in for multi-instance bots: When multiple per-user channel instances expose the same HTTP webhook path (e.g., two Slack bots both mounting /integrations/slack/send), requests are now fanned into the correct instance via RequestRouter.OwnsRequest rather than the previous last-write-wins behavior that silently dropped all but one instance.

Improved

Slack — "is thinking…" banner heartbeat: The assistant-status banner (is thinking…) is now re-asserted every 45 seconds during long tool-use turns (with an immediate refresh on ToolUse or ToolResult events). Slack auto-clears the status after approximately 2 minutes of inactivity, so without the heartbeat the banner would vanish mid-run on slow tool chains. The heartbeat stops automatically on done / error or when a turn is superseded.

v0.25.0 — Platform Updates

Released on 2026-06-25

Added

MCP — wick_execute batch mode: Pass a calls array to run up to 100 connector operations in a single round-trip. Calls run in parallel (server-side concurrency fixed at 5); a failing or timed-out call never stops the rest. Each entry in the response carries {index, tool_id, ok, result|error, timed_out, duration_ms} plus summary counts. Set timeout_ms to cap per-call time (default 3 min, max 5 min). Single-call shape is unchanged. See Batch execution.

Fixed

Channels — Telegram & REST per-user instances: Each user can now configure their own Telegram bot or REST endpoint independently. Wick starts one keyed instance per owner at boot and hot-adds new instances when a user saves their config — matching the existing Slack per-user model.
Slack — access-denied DM: When a message is blocked by the access-control whitelist, wick now DMs the blocked user with a reason (identity or channels) instead of leaving the 🚫 reaction as a silent dead-end.
Slack — multi-instance bot footer: The "Sent using @bot" footer now resolves the bot display name from each instance's own token, so per-user Slack instances credit their own bot rather than a stale shared value.
Pool — double-reply on first turn: The injected origin-context turn is now deferred until after the first user message lands, preventing the agent from being spawned early and producing a duplicate reply (affected Slack, Telegram, and REST sessions).
MapToStruct — bool config fields: Reflected config loading no longer panics when boolean fields are absent from the stored JSON.
Projects — Centralized Visibility Filter: Admins can view all projects; other users see their own, untagged-shared, and tag-shared projects. Channel default-project dropdowns now list only accessible projects.
Sessions — Owner Stamping: Session owner is now stamped once upon creation, not on every message, optimizing performance.

Fixed

PWA service worker — pending-hang on boot: Static assets (/sw.js, /public/*, /modules/*) are now exempt from the boot gate. Previously, an already-installed service worker would intercept these asset fetches on a reload while boot was still in progress; the gate held every request, leaving app.css, icon.svg, and similar files stuck at "pending" until the boot restore finished. Because these paths are served from embed.FS and depend on nothing the boot gate sets up, exempting them lets the SW resolve its cache immediately regardless of boot state.
PWA service worker — stale-while-revalidate and navigation fetch hang: Added an 8-second AbortController timeout to both the SWR background refresh and the network-first navigation path. Without it, a stalled TCP connection (dead keep-alive socket, momentarily busy server) left fetch() hanging indefinitely with no error, so the asset or page never settled — visible as an asset or navigation stuck at "pending" forever. The timeout converts the stall into a rejection, allowing the SW to fall back to cache or surface a real network error instead. The SWR background refresh is now kept alive past respondWith via waitUntil.
Software Update page — Changelog rendering: Fixed an issue where the "What's new" changelog rendered as raw Markdown due to a missing /public/lib/wick-markdown.js asset.

Changed

wick build — build time always stamped: BuildTime is now injected as an -X ldflag (RFC3339 UTC, set at wick build invocation time) for every build path. Previously it relied solely on Go's vcs.time VCS metadata, which is absent inside the wick init scaffold (a git-less directory) used by the release pipeline, leaving the "Built" field showing "unknown" in all release binaries. The "Built" field on the Software Update page and in wick_info MCP output now always shows the actual compile time.

Removed

Admin — Software Update page — Commit row: The Commit field has been removed from the Version panel. Build time is now always available (see above) and more meaningful to end-users; the commit SHA is a build-internals detail not useful at the operator level. The version fields on the Software Update page are now grouped as Application / Wick / Runtime.

v0.24.1 — MCP & Connectors

Released on 2026-06-24

Added

Custom MCP connector — tool grouping via _meta: Upstream MCP servers can now specify a top-level _meta.categories legend and set _meta.category on individual tools in their tools/list response. Wick now groups the exposed operations into titled sections matching the server's intended layout. Section order follows the legend; tools with no category collect into a single untitled trailing section. Servers that do not ship _meta will retain the historical flat single-section layout, requiring no action.

Fixed

Custom MCP connector — bearer / secret-header 401 after save: Connector credentials stored as master-encrypted tokens (wick_cenc_ prefix, used for server-level secrets) were not being decrypted before outbound requests. Previously, only the per-user wick_enc_ prefix was matched during decryption, resulting in the ciphertext being sent verbatim as the Authorization: Bearer or custom header value, leading to 401 errors from upstream servers. Both prefixes are now recognised and decrypted correctly.

v0.24.0 — Software Update UI

Released on 2026-06-24

Added

Software Update page — release notes + update status: The self-update page (now under Setup → Advanced → Software Update) displays a rendered changelog between the running and latest versions, the release date, and an at-a-glance status badge (green Latest or amber Update available → vX). For official builds, the changelog range is pulled from the published changelog site; downstream apps fall back to their GitHub release notes. A View full changelog link opens the full page.
"No build for this platform" notice: When a newer release exists but ships no asset for the running OS/arch, the page now shows the version and changelog with an informational notice (recommending to build from source or ask the maintainer) instead of a hard error.
The page auto-checks for updates on load, so the latest version and changelog populate without a manual click.

Changed

The admin Configs section is renamed to Advanced (/admin/advanced); the self-update card within it is now Software Update (/admin/advanced/software-update).
Changelog and other markdown on the Software Update page now renders as formatted HTML via a shared @wick-fe/common-md bundle, served from /public/lib/ and reusable by any server-rendered page. The shared markdown renderer also learns to interpret thematic breaks (---) as <hr>.

v0.23.6 — Self-Update

Released on 2026-06-24

Added

Added or improved self-update functionality/testing.

v0.23.5 — Updater

Released on 2026-06-24

Fixed

Self-update mechanism for Termux and unprivileged Linux environments. Previously, self-update failed on Termux due to attempts to use dpkg -i via pkexec/sudo, which are not available or required for user-owned installations in Termux. The application would hang on "Restarting...". The new mechanism now performs an unprivileged installation by extracting the inner ELF binary from the staged .deb file and swapping it in place using syscall.Exec, mirroring the install.sh script's approach.
The updater now provides a clear error message if the install directory is not user-writable (e.g., a root-owned /usr/bin installation), guiding the user to re-run the installer.

Improved

Linux relaunch during self-update now preserves the original process arguments. This ensures that headless services started with specific arguments (e.g., all or server) continue to operate correctly after an update, matching the behavior on Windows.

v0.23.4 — Self-Update

Released on 2026-06-24

Improved

Internal test release to validate the self-update mechanism.

v0.23.3 — Self-Update & Admin

Released on 2026-06-24

Added

Admin System page — web-based self-update: A new System card under /admin/configs lets any admin check for updates, watch a live download-progress bar (SSE), and restart the service to apply a new release — all from the browser. Previously, self-update was tray-only; this brings the same flow to headless (<app> all / <app> server) deployments. The page also shows version detail (app name/version, wick version, commit, build time, access type, DB status) matching what wick_info reports over MCP. See Admin Panel — System.

Changed

Auto-update default changed to off: auto_update in config.json now defaults to false (opt-in). Existing installs that previously relied on the default-on behaviour should enable auto-update explicitly — via Preferences → Auto-update in the tray, or the Automatic updates toggle on the new System page.

Fixed

Self-update on Termux / unprivileged Linux: Applying an update no longer shells out to dpkg via pkexec/sudo. Self-update now mirrors the installer — it never escalates privilege. On Linux/Termux it extracts the inner binary from the staged .deb and swaps it in place (syscall.Exec), so updates work on Termux (user-owned prefix, no pkexec/sudo) and any unprivileged install. If the install directory isn't user-writable, Apply fails with a clear message instead of prompting for a password.
Relaunch preserves args after update: Both the Windows (MSI helper) and Linux (binary swap) restart paths now relaunch with the process's original arguments, so a headless <app> all / <app> server service re-serves after an update without manual intervention.

v0.23.2 — Access Control & UI

Released on 2026-06-23

Fixed

PWA Stale Layout: Non-hashed static assets (app.css, app.js, dialog.js, palette.js, push.js) are now served stale-while-revalidate instead of cache-first. This ensures updated assets are picked up automatically after a deploy on the next normal page load, resolving the issue where new deploys did not surface until a hard refresh.
Cross-Tenant Project Access Leaks: Project detail, update, delete, and SSE stream routes now enforce callerProjectAccess().allowProject(). This prevents scoped users from reading, modifying, or deleting projects they lack access to, even if the project ID is known. Endpoints return 404 (Not Found) to avoid confirming project existence to unauthorized callers.
Ownerless Projects: Projects with no owner (OwnerUserID == "") are now treated as admin-only resources. Non-admins can only access such projects if an explicit tag grant covers them, closing a loophole that previously exposed every ownerless project and its sessions to all authenticated users.
SSE Stream Access Control: The global SSE stream (/sse), which lists all active sessions, is now restricted to admins. Session-scoped SSE streams (?session=<id>) require the caller to own or have tag-granted access to that specific session.
Session Subroute Access: Remaining cross-tenant leaks for session subroutes (e.g., approvals, asks, workspace connector configurations, and SCM Git routes) are closed. Access to these routes now requires the caller to own or have tag-granted access to the specific session ID. This was implemented using a new Router.Use middleware.
Conversation UI Overlap: Resolved floating header overlap in Raw, Commands, and Approvals views by adding appropriate top offsets (pt-14, md:pt-16), ensuring their content starts below the header bar.
Markdown Enrichment Self-Healing: Improved Markdown rendering for committed-turn bubbles. Blocks like Mermaid/SVG now self-heal and re-enrich correctly after history reloads or content changes (e.g., innerHTML reset), preventing them from intermittently displaying as raw "rendering…" text.

v0.23.1 — Agents

Released on 2026-06-23

Fixed

Session detail access for tag-granted project members: Users who could see a session in the sidebar via project tag grants could not open its detail/conversation page (the route returned 404). The ownsSession() function now also checks project-scoped access (callerProjectAccess().allowSession()), ensuring consistency between session list visibility and detail access. The App Owner, admin_see_all admins, and ownerless unscoped sessions are unaffected.
Updated admin-panel.md to clarify that tag-granted project members can now open session detail pages, not just their own.

v0.23.0 — MCP & Connectors

Released on 2026-06-23

Added

Google Workspace Input Structs: Added input structs for Google Workspace operations across Calendar, Docs, Drive, Gmail, Meet, Sheets, and Slides, enhancing connector capabilities.

Changed

wick_get — three-level drill-down via selector: wick_get now navigates connector operations across three levels instead of returning all schemas at once.
- Call with id only to get the connector's category list.
- Add selector=<category title> to list that category's operations (no schemas).
- Add selector=<op key> to retrieve that one op's input_schema.
- Flat connectors with no named categories list their ops directly at level 1.
- The category and op_key argument names are accepted as aliases for selector.
- Session-workspace instances follow the same three levels.
- This change keeps large connectors (e.g., Google Workspace with 50+ ops) from dumping every schema into the LLM's context on a single call.
Documentation: Updated mcp.md and the changelog to reflect the wick_get three-level drill-down with the selector argument.

Improved

Agent UI:
- Kebab Menu: Improved behavior to flip up near the viewport bottom and portal the popup to <body> to escape per-row stacking contexts.
- Workflow List: Swapped the manual workflow-list dropdown to use the Kebab Menu, and pinned <main> with min-h-0 for smoother scrolling without a gap.
- Connector List: Added bottom padding and refined the search input to a bare style, removing the double border.
- Theme Picker: Introduced a theme picker in the agents sidebar via UserMenu(showTheme).

v0.22.2 — Connectors UI

Released on 2026-06-22

Changed

Connectors moved into the Agents UI: The connectors manager is now hosted at /tools/agents/connectors inside the Agents sidebar shell. All browser-facing /manager/connectors* URLs now 302-redirect to this new location, preserving deep links via ?deep=. The /manager/api/connectors* JSON routes and all write/mutation routes remain at /manager and are unaffected.
Agents sidebar — Connectors link: A dedicated Connectors navigation item has been added to the Agents sidebar, visible to all users.
/launcher renamed to /mini-tools: The tools-grid launcher page has been moved from /launcher to /mini-tools. A Mini Tools link is now visible at the bottom of the Agents sidebar for all users (previously, only admins saw a Settings link there).
Home tile — Connectors: The "Connectors" tile on the Mini Tools home grid now links directly to /tools/agents/connectors instead of /manager/connectors.
Connectors SPA breadcrumb: The connectors index page now displays no breadcrumb (as the heading already states "Connectors"). Sub-pages root at "Connectors". The Audit Log page shows only "Audit Log" with no root breadcrumb.
Chat block toolbar — mobile + PNG fixes: The per-block hover toolbar is now consistently visible at 70% opacity on touch/no-hover devices (phones, tablets), resolving its previous hidden state until hover. PNG export functionality now utilizes the SVG's intrinsic viewBox/width-height rather than the on-screen size, addressing the "looks like my phone screen" export bug. If rasterization still fails (e.g., due to a tainted canvas), the chart is now downloaded as an .svg file instead of silently producing no output.

v0.22.1 — Connectors

Released on 2026-06-20

Fixed

Corrected the crudcrud sample template to return []connector.Category when registering operations. This resolves a build failure in the materialized template (wick-agent) by aligning with app.RegisterConnector's updated signature, which now expects operations grouped into categories.

v0.22.0 — Connectors & Agents

Released on 2026-06-20

Added

Connector list — inline Connect + connected-account rows: Each connector row on the list page now shows a Connect / Reconnect / + Connect another button when the instance has SSO enabled and the caller may connect (no need to open the detail page). Connected accounts appear as sub-rows under the connector card; each account row has a Disconnect button (confirmation dialog) for users who own that account or admins.
Connector list — per-row kebab (⋮) menu: The per-row action buttons (History / Disable / Duplicate / Delete) are now collected behind a ⋮ kebab menu, keeping each row compact.
Connector list — Private chip: Rows that carry only an owner:<id> tag and no sharing tag now display a lock Private chip instead of the misleading Everyone fallback. Adding a filter tag flips the chip back to tag names.
Module.DefaultAccess — seeded access-policy defaults: Connector module authors can now declare DefaultAccess connector.AccessDefaults on their Module to pre-seed per-row access-policy flags (EnableSSO, AllowOthersConnectSSO, MultiAccount, AllowOthersConfigure) onto every freshly created instance. The Google Workspace connector ships EnableSSO: true, AllowOthersConnectSSO: true so a new row is ready to use Connect Account without a manual Access Policy step. Admins can still change individual rows afterwards. See Connector Module — DefaultAccess.
HTML artifacts — themed, borderless, auto-height preview: HTML file artifacts and inline ```html blocks in the conversation now render in a borderless sandboxed iframe that grows to its content (no inner scrollbar), with a floating ⋮ menu offering Full screen / Show code / Download. The iframe receives a theme bridge — CSS variables (--wick-bg, --wick-surface, --wick-fg, --wick-muted, --wick-border, --wick-accent), color-scheme, and a .dark class in dark mode — so generated HTML matches the chat's active light/dark theme. The agent system prompt instructs the model to use var(--wick-*) for theming by default. See Agents — Artifacts.
Artifact kinds — markdown and text: .md files now render as markdown artifacts (fullscreen viewer + download); plain text and code files render as text artifacts with the same viewer + download. Previously these fell through to the generic downloadable chip.
Connector build profiles: Operators can now select which builtin connectors register at boot without rebuilding the binary. Three profiles are available:
- full (default) — all 7 builtin connectors (GitHub, HTTP REST, Slack, Bitbucket, Loki, Phoenix, Google Workspace). Preserves existing behaviour.
- agent — curated subset: GitHub, HTTP REST, Slack.
- lite — no builtin connectors registered at boot. Set the active profile with <app> config profile <full|agent|lite> (takes effect on restart) or via the admin Configs page (/admin/variables, key profile). The four runtime connectors (Wick Manager, Workflow, Notifications, Custom Connector) are never profile-gated. See App CLI Reference — config profile.

Changed

Connector visibility — live tag resolution: The connector list now resolves each row's filter-tag IDs live from the database rather than from the session-cookie snapshot. A row created or duplicated in the current session is visible immediately without logout/login.
Home — default landing page: Navigating to / now redirects to the agent UI (/tools/agents/). The tools/connectors grid previously at / is now at /mini-tools (was /launcher in v0.22.0; renamed in the subsequent release) and remains fully reachable.
Admin nav — Mini Tools dropdown: The standalone Tools, Connectors, and Jobs tabs in the admin navigation bar are grouped into a single Mini Tools dropdown. See Admin Panel.

[v0.22.0] — Connector Categories

Added

Connectors — operations grouped into categories: The connector detail page (Manager → Connectors → {connector}) now renders operations as named section cards instead of a flat list. Each card shows the section title, description, op count, per-card Enable/Disable all, and a paginated op table (5 ops per page). A sticky "Sections" jump sidebar lets you jump between sections without scrolling; a global search box filters across all categories.
Custom connector builder — operation sections: The manual builder's Operations step is now section-based. Each section has a title and description, and ops can be dragged between sections. The right-hand Jump panel is a collapsible mini-map with scroll-spy highlighting that auto-expands the active section.
pkg/connector — Category / Cat(): Built-in connector authors now group operations into titled sections using connector.Cat(title, description, ops...). Module.Operations is []connector.Category; Module.AllOps() flattens for callers that do not care about grouping; Module.CategoryOf(opKey) returns the section title for a given op key. See Connector Module — Operations().
Google Workspace — Gmail, Calendar, and Meet: 18 new operations across three new categories on the existing google_workspace connector (same OAuth row, one re-consent required):
- Gmail (6 ops): gmail_list_messages (search), gmail_get_message, gmail_send, gmail_create_draft, gmail_reply (threaded), gmail_modify_labels (archive, star, mark read, etc.).
- Calendar (7 ops): calendar_list_calendars, calendar_list_events, calendar_get_event, calendar_create_event (with optional Google Meet link via add_meet=true), calendar_update_event, calendar_delete_event, calendar_respond_event (RSVP accept/decline/tentative).
- Meet (5 ops): meet_create_space (create a standalone Meet link), meet_get_space, meet_list_conference_records, meet_list_recordings, meet_list_transcripts.
- See Google Workspace connector for the full op reference.

Breaking

Custom connectors — ops storage format changed: The stored ops column is now a nested array of sections ([{title, description, ops:[...]}]). The old flat [{key, ...}] format is no longer accepted. Existing custom connectors built before v0.22.0 must be deleted and recreated. See Custom Connectors — Operations data format. Built-in and MCP-backed connectors are unaffected.
Google Workspace — existing connected accounts must re-consent: The OAuth consent now requests Gmail, Calendar, and Meet scopes in addition to the previous Drive/Sheets/Docs/Slides scopes. Accounts connected before this release will have those new ops flagged as needs scope: … in the health check until the operator clicks Connect Account again to re-run the consent flow.

v0.21.0 — MCP

Released on 2026-06-19

Fixed

Allow admins and session creators to manage session titles. Previously, only the session owner could use wick_set_title and wick_session_info to manage a session's title, which prevented administrators (including internal agents) and the original session creator from performing these actions due to ID mismatch. The system now correctly grants these permissions.

v0.21.0 — MCP session-title guard fix

Released on 2026-06-19

Fixed

MCP — wick_set_title / wick_session_info authorization: Admin principals (including the internal agent principal) can now manage any session's title without being blocked by the owner-only guard. Previously, calls made by the agent on behalf of an admin context were incorrectly rejected. Session creators and admins are now both accepted; ownerless sessions remain admin-only.

v0.20.2 — Chat UI

Released on 2026-06-19

Added

Chat — fullscreen diagram lightbox: Double-clicking any rendered Mermaid or SVG diagram opens a fullscreen zoom/pan viewer.
- Gestures: scroll or two-finger trackpad to pan; Ctrl/Cmd+scroll or pinch to zoom toward cursor; drag to pan; double-click inside to reset to fit; Esc, close button, or clicking bare backdrop to dismiss.
- On touch devices, the lightbox opens on double-tap.
- The backdrop color is switchable (auto-theme → light → dark → checkerboard) and persists across opens, ensuring diagrams on any canvas stay readable.
- The viewer recomputes the viewBox from the real bounding box, ensuring any node that spills past the declared viewBox is not clipped.
- Diagrams remain crisp vector at any zoom level (2D transform, no GPU-layer bitmap scaling).
- Includes a live zoom-level readout.

Improved

Chat — AI timestamp always visible: Assistant (AI) response bubbles now show the HH:mm stamp at all times instead of only on hover. User bubbles remain hover-only. Day separators in the thread are now static dividers.
Chat — floating day pill: A WhatsApp-style floating date pill appears at the top of the conversation viewport while scrolling and fades out after ~1.4 seconds of idle. It always shows the label for the topmost visible day group.
Chat — Diagram display: Wide diagrams and raw fallbacks within chat bubbles are now contained to prevent overflow and overlap with other UI on mobile.

v0.20.1 — Chat & Agents

Released on 2026-06-18

Improved

Chat — WhatsApp-style message timestamps: Each assistant and user bubble now shows an HH:mm timestamp on hover/focus, and a sticky centered date separator (Today / Yesterday / weekday name / full date) appears whenever the date changes between turns.
Chat — Mermaid live progressive rendering: Mermaid diagrams now render progressively during streaming the same way SVG does — partial blocks paint incrementally, a last-good-frame is preserved across token repaints, and raw source never flashes while the diagram is building.
Chat — diagram format selection rule: The agent system prompt now encodes an explicit SVG-vs-Mermaid selection rule: node/edge graphs → SVG; algorithmic diagrams (sequence, Gantt, pie, journey) → Mermaid. User overrides always win.

Fixed

Agents — ownerless "system" projects now visible: Projects with no recorded owner (created directly in the DB or by internal tooling) are now accessible to every authenticated caller, not only when the tags service is absent.
Chat — Pin as default state: The "Pin as default" button and project pinning state now reflect immediately in the UI without needing a page refresh.

v0.20.0 — Agents & Chat

Released on 2026-06-18

Changed

Agents — Admin session visibility now scoped by default:
- Admins are no longer implicitly unrestricted. By default, an admin sees only tag-granted projects and their own sessions, matching the regular-user isolation model.
- To restore the legacy unrestricted view, enable admin_see_all at /admin/variables.
- The App Owner tier is unaffected and remains always-unrestricted.
- Ownerless sessions (no recorded creator) are now hidden from everyone while admin_see_all is off, instead of being reachable by any logged-in user.
- See Admin Panel — Admin session visibility.

Improved

Chat conversation rendering:
- SVG support: svg fences or bare inline <svg>…</svg> now render as inline images. SVGs are sanitized (<script>, <foreignObject>, on* attributes, and external URLs are stripped). Lenient parsing ensures complex SVGs (with patterns, filters, gradients) render instead of falling back to raw source.
- Progressive SVG rendering: Mid-stream SVGs auto-close their open tags, allowing shapes to appear as they stream rather than waiting for </svg>.
- Streaming live turn enrichment: A dedicated renderLive action manages innerHTML and transplants already-rendered diagrams between repaints, fixing text↔image flickering with every token.
- Synchronous enrichment: Committed messages now enrich synchronously on mount (no 120ms debounce delay).
- Placeholder for pending blocks: Mermaid and SVG blocks show a "rendering…" placeholder instead of flashing raw source on load.
- Streamlined UI: Borders have been removed from the assistant bubble and rendered blocks for a cleaner, document-like appearance.
- Documentation: SVG support is now documented in the agent system prompt (render_formats.md).

Added

Per-block hover toolbar: Rendered diagrams now feature a "···" hover toolbar, providing options to Copy source, Download file, and Download as PNG.

v0.19.3 — Conversation Trace

Released on 2026-06-17

Fixed

Conversation — trace view renders correctly — The "Show trace" panel on assistant turns previously rendered each streamed thinking_delta fragment as its own separate bubble, often split mid-sentence, and grouped all thinking blocks at the top before tool cards. Consecutive thinking fragments are now coalesced into a single bubble per reasoning run, and the trace renders in chronological order (thinking interleaved with tool cards) so the agent's actual reasoning flow is visible. This improvement applies to both live snapshots and persisted traces, and it also repairs old traces that were stored with fragmented thinking events.

v0.19.2 — Fixes & Improvements

Released on 2026-06-17

Fixed

Connectors: Resolved an issue where ConnectorRun string columns, such as ConnectorID, were too short (varchar(36)) to store session-workspace instance IDs (e.g., sw_<UUID>, which are 39 characters). These columns have been widened to text to prevent "value too long" errors during run inserts. Existing columns are automatically updated on application boot.
New Session UI: Corrected a visual bug where the "No healthy providers found" banner would briefly flash on the new session page before provider options had finished loading. The banner is now gated to appear only once the provider options request has settled and confirmed an empty list.

Improved

Release Process: Enhanced the release tag bundle creation to dynamically discover Single Page Application (SPA) distribution directories within internal/. This streamlines development by automatically including new SPA hosts in the bundle and managing their .gitignore entries, removing the need for manual configuration.

v0.19.1 — Artifact Gallery

Released on 2026-06-17

Added

Conversation — Assistant Artifact Gallery — files the agent writes or edits during a turn are now surfaced as an artifact gallery directly below the assistant bubble. Up to 4 items show as a grid; more than 4 switch to a carousel. Per-kind rendering: images open a zoomable/pannable lightbox (mouse-wheel, drag, Esc/+/−/0); PDFs open inline in the lightbox; HTML files render as a sandboxed live-preview iframe; any other type shows as a downloadable chip. Detection is retroactive — no schema migration, works for existing sessions. See Agents — Artifacts.
Backend — GET /tools/agents/sessions/{id}/files/raw — new endpoint serves cwd files inline for the artifact lightbox (images and PDFs with correct MIME type; SVG with a sandbox CSP header; HTML and other types forced to download). Path-traversal protection via the same safeJoin sandbox as the rest of the agents file API.
Conversation API — artifacts[] and has_artifact per turn — each turn in the conversation API response now carries an artifacts array (path, kind, MIME type) and a has_artifact boolean. Visible in the session detail Raw tab.

Fixed

Conversation — Artifacts now render automatically below assistant turns upon completion without requiring a manual page refresh.

v0.19.0 — Agents & Manager SPAs

Released on 2026-06-16

Added

Custom connectors — "Definition updated" reload banner — the connector page (Manager → Connectors → {connector}) now shows an actionable banner when the stored definition is newer than the live module (needs_reload state). The banner includes a Reload button that rebuilds the live module from the saved definition and clears the dirty state — no page reload required. The banner is visible to any authenticated viewer, independent of edit rights. Previously this state was indicated only by a passive "· needs reload" hint on the connectors index grid.
Custom MCP connector — Re-sync tools — a Re-sync tools button is now shown on a custom MCP connector's page (Manager → Connectors → {connector}). Clicking it re-fetches the upstream server's tools/list and atomically swaps in the fresh operation set, refreshing the stored connection status. The operation set is connector-level (shared by every instance), so this is a per-connector action available to any user who can open the connector.
Custom MCP connector — connection status chip — a custom MCP connector's page now shows a Connected / Disconnected / Never tested chip reflecting the last probe of its upstream server.
Skills — hierarchical breadcrumb navigation — the Skills SPA now displays a clickable breadcrumb trail (Skills / {folder} / {nested path…}) instead of the old single back-button. Each ancestor segment is a link, so you can jump directly to any parent folder from a deeply nested skill file.
Consistent breadcrumb navigation across SPAs — the connector manager, Providers (detail & storage), Presets, and the Workflow editor now render their navigation trail through one shared breadcrumb component, so the separator, hover, and accessibility read the same everywhere instead of each module hand-rolling its own back-link.
Conversation — Raw trace tab — the Raw tab on a session detail page now renders an interactive, collapsible JSON tree of the session's turns. Turns that have a server-side trace (has_trace) automatically fetch their full per-turn tool and thinking events on demand when the tab opens, merging them into the tree as a trace field. Each node can be expanded or collapsed individually; values are type-colored (string / number / boolean / null). A Copy button copies the full JSON to the clipboard.
Providers list: Active Processes panel — when any agent is running, a table above the provider cards shows every live spawn (session ID, agent name, PID, lifecycle/substate). Hidden when the pool is empty. Also includes a list of recent spawns linking to the server-rendered detail page.
Providers list: per-provider hook actions — each provider card now has inline Enable / Disable / Test buttons for the PreToolUse Command Gate hook (shown only when the master gate is enabled). The status badge distinguishes enabled ✓, enabled (unverified), ready, and disabled states. Clicking Test fires a live probe and refreshes the card without a page reload.
Conversation — inline image thumbnails — images attached to a user message render as inline thumbnails in the thread; clicking opens a full-screen lightbox. PDF and Markdown attachments open in the file viewer.
Conversation — file viewer previews — the context-panel file viewer now shows image, PDF, and Markdown previews, and renders code files with syntax highlighting (lazy-loaded Ace editor).
Conversation — resizable Source sidebar — the SCM dock sidebar can be dragged to any width; the chosen width is persisted in localStorage across sessions.
Conversation — confirm before kill/dequeue — a confirmation dialog is shown before terminating a running agent or removing a queued session, preventing accidental kills.
Conversation — live count badges — the Context, Processes, and Workspace rail tabs show live item-count badges that update as the agent works.
Conversation — system turn pills — system/lifecycle turns in the thread render as centered pills with an optional step list instead of full message bubbles.
Conversation — lifecycle pill tracks streaming — the session lifecycle pill transitions to "working" immediately while the agent is streaming, before the subprocess state update arrives, and also reflects working from spawning state.
Conversation — lifecycle pill shows "killed" state — when a session is terminated (including when the idle auto-kill countdown reaches 0), the header pill now shows a neutral killed badge instead of lingering on "idle · 0s".
Conversation — rich assistant message rendering — assistant chat bubbles now render Mermaid diagrams (flowchart, sequence, class, state, ER, Gantt, pie, journey, and more), syntax-highlighted code blocks (highlight.js, GitHub-style light/dark theme), and KaTeX math ( $…$ inline, $$…$$ display). html blocks now render as sandboxed live-preview artifacts. Previously these all showed as plain text. Renderers are lazy-loaded on first use so they don't affect initial page load.
Chat rendering formats documented — the full set of rich formats the web Conversation tab can render (GFM markdown, highlighted code, Mermaid diagrams, KaTeX inline/display math, smart links) is now documented in Agents — Chat rendering. The same table is injected into the agent's immutable system prompt via internal/agents/system-prompt/render_formats.md so the model knows what it can reach for; editing that one file keeps the prompt and the docs in lockstep.
System-prompt assembly extracted to own package — the system-prompt builder logic moved from internal/agents/config/ to internal/agents/system-prompt/ (package rename). No behavior change; the catalog, default baseline, and immutable sections are now co-located and individually testable.
Overview dashboard rebuilt as a Svelte SPA.
Presets page rebuilt as a Svelte SPA.
Project settings rebuilt as a Svelte SPA.
Common-UI: Reusable KvList row editor component.
Common-UI: Primitive components (Button, TextInput, NumberInput, TextArea, LabeledInput, Modal, ConfirmDialog).
Common-UI: Shared Breadcrumb component.
Manager UI — "Everyone" chip shown for untagged connector rows.
Manager UI — Per-row "History" action added to connector list.
Manager UI — Search icon and '/' shortcut restored on connectors index.
Manager UI — Anchor IDs and jump navigation added to custom connector DraftEditor.
Manager UI — Two-tab "Jump/JSON" navigator restored in custom connector DraftEditor.
Manager UI — Mobile "Jump" opener (FAB) added to custom connector DraftEditor.
Manager UI — Per-account operations editor for OAuth connectors.
Conversation — Optimistic user turn rendering on send.
Conversation — Project name shown on session list secondary row.
Conversation — Empty-state message in conversation thread.
Conversation — Inline error region in approvals modal.
Conversation — Esc and backdrop dismiss for approvals modal.
Conversation — Auto-focus current wizard step input.
Conversation — Red border on invalid required wizard field in wizard.
Conversation — Folder path shown in project landing header.
Conversation — Browser tab title now set from session metadata.
Conversation — New file/directory names validated, parent expanded on create.
Conversation — Ctrl/Cmd+B keyboard shortcut toggles Context rail.
Conversation — Data-chat-path links in chat now open in file viewer.
Conversation — FileViewerModal now dismissible with Esc key and backdrop click.
Conversation — FileViewerModal now shows save-status indicator.
Conversation — Inline save error shown in WsInstanceCard.
Conversation — ContextPanel file list now shows loading/error states.
Conversation — Fallback bubble for interrupted text-less turns.

Changed

Manager UI rebuilt as a Svelte SPA — the connector manager at /manager/* is now served as a Svelte single-page application rendered inside the host chrome (shared header, theme, user menu), replacing the previous server-rendered templ pages. URLs, features, and the full /manager/api/* surface are unchanged.
Manager UI — visual realignment — connector list, custom connector builder (DraftEditor, McpServerForm, MCP SSO guidance, access toggles), jobs/tools setup banners, and audit-log headers are visually aligned to match the design-system tokens and the pre-SPA look. Common-UI primitives (Button, inputs, Select, ToastHost, KvList) use the correct radius and focus-ring tokens. This also includes visual parity restores for new-session, overview, providers, skills UIs.

Fixed

Conversation — artifact gallery now appears without a manual refresh — assistant-turn artifacts (files written or edited during a turn) were missing from the gallery after a turn completed and only appeared after a full page reload. The conversation is now refetched from the server on each SSE done/error event, so the server-derived artifacts/has_artifact data is picked up immediately.
Conversation — workspace file tree auto-syncs as the agent writes files — the workspace file tree in the session detail page previously only loaded on session open and manual refresh, so files written by the agent mid-session (artifacts, generated output) did not appear until you reloaded. The SSE handler now silently reloads the file tree — debounced at 400 ms — on every lifecycle and git_status event, so generated files appear on their own without a refresh.
Connector operation toggle no longer silently no-ops on first disable — SetOperation in the connector repo was using db.Save() which resolves to an UPDATE when the primary key is set, leaving a missing row untouched (and Enabled=false was dropped as a zero-value on struct insert). Rewritten as a GORM OnConflict upsert with a map payload so the enabled column is always written verbatim. Affects both the legacy admin UI and the new manager SPA.
Starting a new agents session no longer fails with 405 — tool root routes now accept POST/DELETE on the trailing-slash form (/tools/{key}/), not just GET. The new-session and conversation SPA POSTs to ${base}/ to create a session, which previously matched a GET-only pattern and returned 405 on Send.
Provider Detail — config saves and enable/disable toggle now work — the API call was sending a JSON body but the Go handler reads c.Form("value") (form-encoded). Every provider config save and the enabled/disabled header toggle silently no-op'd; the request now sends application/x-www-form-urlencoded.
Provider Detail — UI parity restored after SPA migration — the detail page now shows the Enabled/Disabled header toggle, a 2-column grid for simple config fields with a single Save All action, a row editor for extra_args, and a key-value editor for env (previously flattened to plain text inputs by the SPA migration).
Custom connector builder — input focus loss — typing in the McpServerForm label/key fields no longer loses focus on every keystroke (dropped the {#key rev} remount wrapper), and sticky-header now stays on top.
Custom MCP connector — "Edit definition" dead-end fixed — clicking "Edit definition" on a custom MCP connector previously navigated to a broken URL because the SPA used the connector's definition ID where the MCP server-form route expects the server's row ID. The backend draft endpoint now returns server_id in its response, and the SPA redirects to /custom/mcp/{server_id}/edit. An explicit error message is shown if the server ID cannot be resolved instead of silently landing on a not-found page.
Conversation — pending ask rehydrated on page load — an open AskUser approval card is now restored when the page is loaded or refreshed mid-turn, so the question is never lost.
Conversation — orphan tool_result turns rendered — tool-result turns that have no matching tool-call in the loaded window are now displayed as collapsed trace entries rather than silently dropped.
Conversation — Normalize null backend arrays to prevent crashes.
Skills and Providers API calls now correctly prepend base path (fixes 404).
Manager UI — SPA now applies app theme correctly.
Installation — install-rtk script no longer fails due to non-breaking spaces.
Conversation — Thinking duplicate removed from trace.
Conversation — Agent stuck spawning fixed.
Conversation — Provider/agent label missing fixed.
Conversation — Composer auto-resize, autofocus, global keydown redirect, click-to-focus.
Conversation — Jump to latest pill for scrolling, Ctrl+↓ shortcut.
Conversation — SCM Source badge now correctly reads total_changed count.
Conversation — Process list updates now rely solely on SSE lifecycle events, removing redundant 5s polling.
Manager UI — Live-disk SPA hot-reload now works without Go recompile.
Manager UI — "Access & behavior" section now correctly shown on the Operations wizard step in custom connector builder.

v0.18.7 — Workflows & Agents

Released on 2026-06-15

Added

Workflow parallel execution: Workflows can now run multiple triggers concurrently. Enable concurrency.enabled per workflow and set a global cap via workflow_max_parallel_global in Agent Settings. Each workflow has its own FIFO queue; the global semaphore caps total simultaneous runs across all workflows. Serial mode remains the default (concurrency.enabled: false). See Concurrency.
Workflow agent node — extended thinking control: A thinking dropdown (on | off, default on) and a conditional max_thinking_tokens number field are now available on the workflow agent node. off sets MAX_THINKING_TOKENS=0 (extended thinking disabled); on with max_thinking_tokens: 0 leaves the env unset (unlimited / provider default); on with max_thinking_tokens ≥ 1024 caps the budget at that value. The setting is persisted to session meta before each pool send so a reused session always reflects the current node config. This feature is specific to Claude providers; Gemini and Codex ignore these fields. The regular agent chat flow is unchanged. See Agent node — Extended thinking.

Fixed

Workflow node argument bleeding: Resolved a regression where rendered templates on workflow node arguments (e.g., Args, Headers, Query, ShellEnv, Command) would persist across multiple runs. This fix ensures that node fields are detached onto fresh copies before rendering for each run, preventing previous renders from affecting subsequent executions.

v0.18.6 — Agents

Released on 2026-06-15

Fixed

Agent Spawner Configuration: Addressed an issue where ExtraArgs and Env settings configured in the providers UI were not being forwarded from the Instance to the agent subprocess during spawning, resulting in agents running without their intended custom configurations.

Added

Instance-Level Argument Flow: ExtraArgs can now be passed via SpawnOptions, mirroring the existing ExtraEnv functionality to ensure instance-level arguments are correctly delivered.
Test Injection Utility: A new InstanceOverride in ClaudeFactory facilitates test injection without requiring modifications to user configuration files.
Enhanced Testing for Claude: Dedicated spawn_test.go added for the Claude provider to specifically validate spawner and opt ExtraArgs handling.
Configuration Contract Test: A new test, TestFactoryInstanceConfig_ExtraArgsAndEnv, was implemented to establish a contract, ensuring all future providers correctly process and forward ExtraArgs and Env configurations.

Improved

Universal Spawner Compatibility: All agent spawners (Claude, Codex, Gemini) now correctly append opt.ExtraArgs after their inherent s.ExtraArgs, preserving compatibility with existing static test fixtures.
Consistent Configuration Forwarding: ExtraArgs are now consistently forwarded through agent.Options and both Spawn call-sites (Start and respawnWithMessage).
Extended Provider Test Coverage: Existing Codex and Gemini spawn tests have been expanded to include opt.ExtraArgs cases, ensuring uniform behavior across different providers.

v0.18.5 — PWA Notifications

Released on 2026-06-15

Improved

Broadcast in-app lifecycle push notifications to all open tabs, ensuring exactly one OS notification is surfaced per push. Repeated pushes are collapsed into a single OS surface using a unique tag to prevent spam.
De-duplicate in-app cards by push tag, replacing existing cards instead of stacking.
Synchronize dismissals across tabs: Dismissing an in-app card in one tab now clears the same card in all other open tabs and closes the shared OS notification. Auto-dismiss and remote dismiss actions only clear the local card.

v0.18.4 — PWA Improvements

Released on 2026-06-15

Fixed

PWA Push Notifications: The PWA push notification handler no longer suppresses OS notifications when any same-origin window is open. Notifications are now surfaced unless a visible PWA window is already on the push's target path, ensuring users receive notifications even with background or different-page tabs open.
PWA Fetch Handler: Resolved an issue where the PWA fetch handler could throw 'Failed to convert value to Response' by intercepting cross-origin requests and resolving respondWith() with undefined. The handler now explicitly skips cross-origin requests and always returns a valid Response.

Improved

PWA Notification Badge: Added a dedicated monochrome white-silhouette notification badge (icon-badge.png) for Android devices. This prevents the full-color icon from being collapsed into a white blob when masked by Android's badge rendering.

v0.18.3 — Workflows & Connectors

Released on 2026-06-14

Fixed

Workflow runs from a freshly-published workflow now execute immediately — previously, workflows created or published from the UI would accept their trigger (webhook returned 202, dispatch reported a match) but the run never executed and never appeared in run history until the server was restarted. The per-workflow worker was being spawned bound to the HTTP request context, so it died the instant the response was sent; the queue lingered with no live consumer and runs piled up undrained. Workers are now pinned to the server lifetime, so a publish, toggle, or hot-reload from any HTTP handler produces a worker that survives the request. Publishing a new workflow (or re-publishing one) never interrupts another workflow's in-flight run.
Connector nodes that require an authenticated identity now work from workflow runs — operations gated on the logged-in user (e.g. notifications.send_to_push_id) returned not authenticated when fired from a headless workflow run, even though they worked when tested manually through the UI. Connector nodes now run as the workflow's owner.

Changed

Workflow dispatch is no longer silent — the router now logs when a run is enqueued, when a matched trigger has no queue or no live worker (the run would otherwise vanish without a trace), and when a worker is spawned or stops. This makes a run that fails to execute debuggable from the logs instead of leaving no evidence.

Improved

CI performance and reliability:
- Shared caches: A new ci-cache-warm.yml workflow warms shared caches (Go build, module, and templ binary) on push:master, making them available for all PRs.
- Faster PR tests: PR tests now efficiently restore Go build caches and utilize a two-tier strategy: a fast full suite without -race, followed by -race only on packages changed in the PR to minimize runtime.
- Conditional job execution: Go and frontend jobs are now gated by dorny/paths-filter, running only when their respective files change.
- New frontend build job: A dedicated job with caching for Node.js and Vite builds (gated on fe/** changes) has been added.
- Nightly race detection: A new nightly-race.yml workflow runs the full -race suite daily, ensuring race conditions are caught in packages not frequently touched by PRs.

v0.18.2 — GitHub Connector

Released on 2026-06-14

Added

Enhanced GitHub connector with support for reviews.
Added branch-related functionalities to the GitHub connector.
Introduced label management features for the GitHub connector.
Enabled search capabilities within the GitHub connector.
Integrated GitHub Actions support.
Added webhook functionalities.
Implemented comment-edit operations for the GitHub connector.

v0.18.1 — GitHub Connector

Released on 2026-06-14

Added

GitHub Connector Enhancements:
- Pull Request Operations: Introduced new operations including get_pr_diff (fetching a PR's unified diff), merge_pr, create_pr, and create_or_update_file (committing a single file, supporting both creation and updates with automatic blob SHA lookup).
- Expanded GitHub API Coverage: Added comprehensive operations for:
  - Repositories: get_repo, list_branches, list_commits, list_forks, create_fork, list_stargazers, star_repo, unstar_repo.
  - Issues: get_issue, update_issue, list_issue_comments.
  - Pull Requests: get_pr, list_pr_files, update_pr.
  - Releases: list_releases, get_latest_release, get_release, create_release, update_release, delete_release.
  - Tags: list_tags.
  - User: get_me.
- Health Check: Integrated a token-based HealthCheck for the connector (GET /user), providing an "auth" OpHealth entry.
- Documentation: Added comprehensive documentation for the full operation set, health check, and required OAuth scopes.

Changed

Renamed the install-rtk-termux.sh script.

v0.18.0 — Core & Admin

Released on 2026-06-14

Added

Conversation UI rebuilt as a Svelte 5 SPA — the session list and conversation thread (/tools/agents/sessions and /tools/agents/sessions/{id}) are now served by a self-contained Svelte 5 single-page application. Visible changes: an Approvals tab joins Conversation / Commands / Raw in the session header; agent turns with tool events show a Show trace toggle for lazy-loading the thinking + event stream without cluttering the thread; the conversation header shows an idle-countdown badge ("kill in Ns") during the idle-timeout window; the Projects landing page scoped to managed and custom projects is now integrated into the SPA; the composer reuses the full action row (provider/project selectors, bell, attachment). The server now exposes three JSON endpoints that back the SPA: GET /api/sessions, GET /api/sessions/{id}/conversation, GET /api/sessions/{id}/meta, and GET /providers/options.
Workflow editor — replay-to-editor imports full run state — the Copy to editor button now pins the run's trigger event payload alongside per-node status overlays and output pre-population. Every node inspector's INPUT dropdown gains an entry for the pinned event so {{.Event.Payload.*}} expressions resolve to the real run's data during an Execute step (n8n-style "retry with pinned input"). A Unpin action on the trigger OUTPUT pane clears the pinned payload. See Canvas editor — Run timeline.
Workflow editor — per-expression preview table — template fields that contain multiple {{...}} segments now show a breakdown table in the inspector preview: one row per expression with its rendered value or error, isolating a failing ref without blanking the combined output. Autocomplete now suggests .Event.Payload.*, .Node.<label>.*, .Env.*, and .Trigger.* paths from the live context, and a manual refresh button re-renders when upstream outputs change.
Workflow editor — node rename cascades {{.Node.<label>.…}} refs — renaming a node label in the inspector rewrites every reference to that label across all other nodes in the workflow automatically. A toast confirms how many references were updated.
Batch template-test expressions endpoint — POST /api/workflows/template-test now accepts an expressions array for a per-expression breakdown in one round-trip, replacing N parallel calls that previously triggered rate-limit 429 responses.
Custom connector health check — a definition can nominate one operation as a health probe (health_op + optional health_expect in SourceMeta). When set, every instance page shows a Check Permissions button and a status banner — same as built-in connectors. Healthy when the probe operation runs without error (HTTP 2xx / MCP non-error result) and, when health_expect is set, the response contains the expected substring. A failing probe system-disables every operation on that instance (single credential = whole connector verdict) until a passing check clears it. Set from the Health check block on the review / edit form. See Custom connectors — Health check.
Session Workspace tab UX — the Workspace rail tab on the session slide-over gains: count badge showing active session connectors; inline rename (pencil icon on each card); auto-generated default label when an instance is added; dirty-tracking per field so Save/Test send only edited values; Reset button that appears while edits are pending; single Test button that exercises the config currently on screen (live field values overlaid on stored config for the probe, never persisted). See MCP — Workspace tab (UI).
Admin — Enhanced Tag Management:
- owner: tags now display human-readable names (display_name) in pickers and chips, with resolutions for custom connectors and workflows.
- owner: tags are immutable and cannot be modified or deleted, enforced by ErrOwnerTagImmutable guard.
- Contextual filtering for owner: tags: hidden from the /admin/tags page, but visible in resource/connector pickers with display names.
- Orphaned owner: tags are automatically deleted.
Admin — Agents Navigation Control: The Agents navigation link now respects tool access control policies.

Changed

Template engine — missingkey=zero — the workflow template engine switched from missingkey=error to missingkey=zero. A payload field that is simply absent (e.g. a webhook body without an action key) no longer fails the node — it renders the zero value (<no value> for map fields) and the run continues. Wrap optional fields with {{ .Event.Payload.action | default "" }} for a clean empty string.
Session workspace discoverability — wick_list, wick_search, and wick_get now accept an optional session_id argument. Passing it causes wick_list to include this session's sw_… workspace instances alongside regular connectors and return a session_config_bases array (connectors that can be cloned but haven't been added yet). wick_search now also matches workspace instances so a connector spun up for the session is findable. For wick_get, session_id is a separate argument — never append it to the connector id.
Session instance status — a workspace instance in wick_list / wick_search results reports kind: "session". When its config is incomplete the status is needs_setup_workspace (distinct from a saved connector's needs_setup), directing the user to the session Workspace tab rather than the admin dashboard.
AllowSessionConfig auto-on — the per-instance Allow per-session config override toggle now defaults to enabled for any instance whose connector module declares the capability (e.g. httprest). No manual admin toggle required to make an eligible connector available for session cloning; admins can still turn individual rows off.

Fixed

Agent node session: "new" without session_init — agent nodes with session: "new" (or any ad-hoc wf_adhoc_<uuid> session) no longer fail with "cannot find the path" when there is no session_init node upstream. The session directory is created automatically before the first turn.
Execute step — clearer missing-upstream error — when an Execute step on a node references {{.Node.<label>.…}} for a node that has no output yet, the error message now names the blocking node explicitly instead of surfacing a raw Go-template nil-pointer panic.

Improved

Binary Size Reduction: Reduced the release binary size from 84MB to 55MB by stripping symbols and DWARF via -s -w in LDFLAGS and disabling Vite sourcemap output for SPA bundles.

v0.17.0 — Connectors & Access Control

Released on 2026-06-13

Added

Custom Connectors — build LLM-callable connectors from the admin UI, no Go code or redeploy. Three creation paths from Connectors → + New connector:
- Paste a cURL — deterministic parser splits the command into per-instance configs (base URL, secrets) and per-call inputs; an AI tab (shown when a structured-output provider is configured) extracts the same shape from fetch() snippets, Postman fragments, or prose. The AI tab gains a provider dropdown; the catalog of structured-output-capable provider instances resolves live. Creating a connector now follows a plan-then-confirm contract, with def_schema returning full draft reference (supported widgets, template syntax, validation, icon rules, categories, examples, and decision points) and def_validate dry-running a draft.
- Connect an MCP server (streamable HTTP) — one server = one connector. Every tool the server lists becomes an operation automatically; tools added upstream appear after a re-sync. Control the surface with an exclude list instead of an import picker. Auth schemes: none, bearer, custom_header, oauth (standard MCP authorization: discovery, dynamic client registration, PKCE browser login, RFC 8707 resource indicator, per-instance accounts with transparent token refresh, and generic OAuth2 code exchange with TokenURL and ExtraParams support), and sso (forwards the calling wick user as a signed JWT validated against /.well-known/wick-pubkey.pem).
- Manual builder — Meta → Configs → Operations stepper with Go text/template request recipes.
Multi-instance custom connectors — instances behave exactly like built-ins (+ New row, Duplicate, per-row credentials); no row is auto-created until you add one. Opt into "single instance only" per definition. See Custom Connectors.
Ownership contract — any approved user can create a custom connector; editing or deleting a definition is admin-or-creator only, and instance creators are marked with an owner: tag. The new custom-connector management connector exposes the same lifecycle as MCP operations (scoped per caller) so an agent can build connectors without the dashboard.
Connection status & live catalog — MCP definitions show a Connected/Disconnected chip, re-sync per instance (probes run under that instance's account), refresh their tool catalog lazily on wick_get, and connect in the background at startup behind the boot gate.
Connector icons — pick an emoji (emoji-mart picker, fully vendored) or paste an inline SVG / base64 image (32KB cap, rendered safely via <img>).
Google Workspace connector — one Google OAuth account now drives Drive, Sheets, Docs, and Slides through a single connector (google_workspace, 20 operations). The 8 Drive ops carry over from the old code-only google_drive connector, joined by 12 new ops: file creation (create_doc, create_sheet from CSV, create_slides), Sheets API v4 (sheets_read_range/append_rows/update_range/clear_range), Docs API v1 (docs_append_text/replace_text), and Slides API v1 (slides_get_content/add_slide/duplicate_slide). OAuth scopes expand to drive, spreadsheets, documents, presentations, userinfo.email; the health check probes the granted scopes and reports per-op availability. See Google Workspace.
Session workspace (wick_session_workspace MCP tool + session Config tab) — spin up ephemeral connector instances scoped to one session: a private clone of a base connector (point it at staging, use a different key) that appears in wick_list/wick_get/wick_execute for that session only and is purged when it ends. The saved connector rows are never touched. Actions: list / add / duplicate / configure / test / remove. The agent creates blank instances and can open the fill modal, but the user types the config; secrets are stored under a system-only master key, decrypted only at execution time, and never returned to the agent. A connector is eligible only when its module declares AllowSessionConfig and an admin enables the per-instance toggle (the custom-connector definition carries the same allow_session_config flag). The Session Config tab in the agent slide-over now lists instances, allows adding from a base picker, editing/testing/duplicating/removing, with collapsible cards. See Session workspace.
ask_user multi-question wizard — pass questions[] instead of a single question to collect multiple answers in one step-by-step modal. Each question has a key, type (choice / multi / rank / dropdown / text / secret), optional options with per-option description, required, placeholder, and help. Single-select options auto-advance; Enter also advances. Response is {"values": {"key": "answer", ...}}.
ask_user from stdio — an askuser.sock Unix socket bridges ask_user calls from stdio MCP processes (e.g. a spawned Codex agent) to the running server's web-UI modal without HTTP auth. The gate allowlist now includes ask_user and wick_session_workspace so they are never blocked at the hook level.
Per-channel ask_user_enabled — Slack, Telegram, and REST channels each gain an ask_user_enabled config field (default false). Web UI and interactive MCP clients use the global AskUserMode setting. See AskUser policy.
Attention notifications — when an ask_user or approval_request SSE event fires while the session tab is in the background, wick plays a short two-tone chime and (with permission) fires a browser Notification. Audio and notification permission are unlocked on the first user gesture.
Access control — App Owner tier & per-user isolation — a new is_owner tier sits above admin: the first registered user is auto-promoted, IsAdmin() is true for both owners and admins, but only the App Owner can see every user's sessions. Non-admin users now see only their own sessions, projects, workflows, and skills in the agents UI; session, send, kill, and trace routes are gated by ownership and return 404 (not 403) when a session belongs to someone else. The same ownership check guards the wick_session_info and wick_set_title MCP tools. The Providers section of the UI is now restricted to admin-only access.
Tag-based ownership for projects, workflows & skills — each resource gets an owner:{resourceID} tag at create time, with created_by kept as an audit trail; sharing is done by assigning group tags. New admin pages — /admin/projects, /admin/workflows, and /admin/skills — expose a tag picker to manage ownership and sharing. Skills now persist in their own DB table with created_by stamped on upload. Personal projects are auto-created for each user on their first access and project lists are scoped to the user's owned projects.
Per-user Slack channels — each wick user can configure their own Slack bot credentials independently. Every non-owner user gets a separate agent_channels row (user_id = <id>); the App Owner row uses user_id = NULL. Saving a bot token hot-adds a new keyed registry instance immediately — no server restart required. Removing the token removes the instance. The Channels menu is now accessible to all logged-in users (admin gate removed).
Realtime session-title sync: agentctl refresh_session op + PublishSessionMeta SSE; stdio set_title relays to the daemon, which reloads the registry and pushes the new title to open tabs live.

Changed

Connectors no longer auto-create their first instance at boot (single-instance/Fixed modules excepted) — rows are created explicitly via + New row and deleted rows stay deleted across restarts.
Outbound MCP requests now emit a debug log trail (URL, RPC method, payload, response, latency) carrying the originating request_id.
Gate / ask_user decoupled — GateEnabled now controls only the PreToolUse command-gate hook. Turning the gate off no longer disables ask_user.
google_drive → google_workspace — the code-only Google Drive connector was replaced by the broader Google Workspace connector under a new key. Existing google_drive instance rows are orphaned on restart and must be re-created under the new key.
The custom connector builder and manager UI have been overhauled: A sticky action toolbar (Save/Disable/Delete top-right) is now present on the cURL and MCP edit pages, with auto-reload on save and inline "Saved ✓" feedback. Field rows are now labeled cards (Key/Type/Default/Description, Required/Secret switches, trash delete) that stack on mobile. A hideable Navigator (Jump list + JSON tabs) is now docked sticky on desktop and an off-canvas slide-over on mobile. Responsive fixes have been applied across the manager UI.

Fixed

Codex model_instructions_file — the per-session soul.md preset was previously passed via the unknown key instructions_files (silently ignored by Codex), so the model never received the session identity block or wick rules. Fixed to use model_instructions_file. The file now lives in the per-session .codex/ dir so concurrent sessions no longer clobber each other's preset.
Connector access-control hardening — toggling a connector operation, flipping its admin-only flag, and deleting a connector are now gated server-side (admin-or-owner, returning 403); writing a config field tagged secret likewise requires admin or the connector's owner. The OAuth ConnectorAccount schema separates ExternalUserID (provider-side) from WickUserID (wick platform), fixing session-ownership stamping for connections such as Slack. The wick_skill_sync MCP tool is restricted to admins.
The allow_session_config flag for custom connector definitions now correctly persists on edit.
Stale broadcaster keys are deleted when the last subscriber unsubscribes.
The buffer map is cleaned on slot release, and preempt goroutines are tracked in the wait group.
Background rescan goroutines are deduplicated using singleflight.
WICK_STRICT_MCP environment variable has been added to the server configuration.
Generic OAuth path: response_type=code is added to ExtraParams, and GetUserIdentity failures are handled correctly. Ignored errors in uploadMultipart for Google Workspace are fixed.
Session ownership checks (ownsSession helper) are now used consistently, and the sessionProcesses guard pattern is fixed.
OwnerUserID is now correctly set when creating a project via the UI.
The Agents link in the navigation is now hidden when the agents tool is not running.
SetSkillStore is now correctly wired at server startup.
created_by is now stamped in the database on skill upload, alongside the owner tag.
addSlide for Google Slides now uses actual API-assigned placeholder IDs for title/body text.
Interface maps in the registry are now copied using maps.Copy instead of manual loops.
Unused loadChannelRows removed; all callers now use loadChannelRowsForUser.
All Slack channel instances are now wired at boot; a break that skipped multi-instance wiring has been removed.
The seedOwner migration logic now promotes the oldest admin-role user to App Owner when is_owner is unset, handling pre-migration installs correctly.
Channel status, health, and lookup handlers now correctly resolve a user's own channel instance.
Admin's integration status is no longer leaked to unconfigured users; HasAnyKeyed guards per-user channel fallback.
The Channels menu is now visible to all users, not just admins, aligning with per-user channel configuration.
The seedOwner migration logic now promotes only the oldest user with the admin role to App Owner.

v0.16.16 — TTY

Released on 2026-06-12

Fixed

Resolved an issue where WebSocket upgrades for the terminal (tty) could fail when reverse proxies stripped the upgrade token from the Connection header. The system now correctly re-injects the upgrade token if Upgrade: websocket is present, ensuring successful terminal connections.

v0.16.15 — Systemd & Phoenix

Released on 2026-06-12

Added

Daemon auto-enablement of systemd linger on headless installs: The service install command now automatically enables systemd linger for the current user, ensuring the daemon and its child processes persist after SSH session logout on headless Linux servers. systemdStatus now reports the live linger state and provides the exact command if manual enablement is needed.
Active Processes panel scoped to current session: The "Active Processes" slide-over panel now filters processes to the current session only. It also displays "queued" requests (pre-PID) with a dequeue action, providing better visibility for accepted-but-not-yet-running requests.

Improved

Phoenix get_span surfaces tool catalog and span metadata: The get_span function now returns four previously unexposed signals that were already on the wire:
- tools: The catalog of tools the model considered, including each tool's name, description (carrying selection preconditions), and raw parameter schema. This allows comparison with a message's tool_calls to understand why a model picked or ignored a tool.
- invocation_parameters: Model parameters such as temperature, reasoning_effort, and tool_choice (the redundant tools array is stripped).
- metadata: Passthrough of the producing application's span metadata, including request_id, room_id, user_id, langgraph_node, and question_history_id.
- token_count *_details: A breakdown of cache_read and reasoning tokens.

v0.16.14 — Memory, Gate, Wick

Released on 2026-06-12

Fixed

Fixed memory leak in stream broadcaster by deleting stale keys when the last subscriber unsubscribes.
Cleaned buffer map on slot release and tracked preempt goroutines to prevent resource leaks.
Deduplicated background rescan goroutines in provider using singleflight to prevent excessive resource usage.
Eliminated data race with PartialText by guarding turnBuf writes with a mutex.
Propagated request context to PublishAndReload and ToggleAndReload in workflows to ensure proper cancellation and timeout.
Prevented timer leak in terminateProc by replacing time.After with NewTimer and Stop.
Resolved agent deadlock by releasing agent mutex before stdin write in send() to prevent conflict with drainPending.

Improved

Gate auto-approves wick read-only / info MCP tools: The PreToolUse gate binary now has a built-in always-allow list for wick's non-mutating tools — wick_list, wick_search, wick_get, wick_info, wick_list_providers, wick_skill_list, wick_session_info, and wick_set_title. These no longer trigger the per-tool approval prompt. wick_execute and wick_skill_sync remain gated.
Title state in agent system prompt: The "This session" identity block injected into every agent's system prompt now includes the session's current title and title_custom flag. The agent reads these from the prompt at spawn time instead of making a wick_session_info round-trip on every first turn.

v0.16.13 — Daemon & Session Titles

Released on 2026-06-12

Added

Daemon Systemd Integration: Daemon lifecycle commands (start, stop, status, restart) now delegate to systemctl --user when a systemd-user unit is installed and enabled (Linux/Termux only). This resolves conflicts between PID-file and systemd management, preventing double spawns and ensuring accurate status reporting. The daemon now self-registers its PID and spawn source (systemd INVOCATION_ID) on boot for an accurate PID file, reporting the origin (systemd / CLI). PID-file based management remains unchanged for Windows and macOS.
wick_session_info MCP tool: A read-only tool that returns an active session's session_id, title, title_custom, origin, status, and project_id. This allows agents to determine if a session already has an explicit title before attempting to set one.
wick_set_title MCP tool: Sets the session's sidebar label and marks title_custom = true. This prevents the auto-derived first-message label from overwriting a chosen title.
session.Meta.TitleCustom flag: A new boolean on session metadata. When true, the setLabelIfEmpty process skips the auto-label step, preserving any title set by a human or by an agent via wick_set_title.
Auto-title via system prompt: The immutable agent system prompt now instructs the agent to call wick_session_info at conversation start and set a short descriptive title using wick_set_title when title_custom is false. Titles set by a previous turn or by the user are left untouched.
Session ID and Channel in System Prompt: The system prompt now includes a "This session" identity block (session_id + channel) on every agent spawn. This ensures agents always have the necessary session context to utilize tools like wick_session_info and wick_set_title.
Documentation: Updated documentation for the new wick_session_info and wick_set_title MCP tools and the auto-title behavior.

v0.16.12 — Boot Gate

Released on 2026-06-12

Added

Boot gate — "Booting…" holding page during restore: To prevent an empty sidebar or broken session list and 404 errors during the asynchronous provider-storage boot restore, all HTTP requests (except /health and /boot-status) now receive an HTTP 503 page. This holding page displays a spinner and live phase label, auto-polls GET /boot-status every 1.5 seconds, and reloads automatically once the server reports readiness. The /health endpoint remains exempt, ensuring load balancer and Kubernetes readiness probes continue to succeed throughout the restore window. This robust gating mechanism ensures a consistent user experience during the boot process.
GET /boot-status: A new JSON endpoint ({"ready":bool,"message":string}) has been added to report whether the asynchronous boot restore has finished. This endpoint is used by the boot gate page and can also be consumed by external health checks that require a deeper "application ready" signal beyond the basic liveness /health check.
Agents registry auto-reload after restore: Upon completion of the boot restore process, the agents registry is now immediately rescanned from disk. This ensures that sessions and projects appear in the sidebar without delay, addressing a previous issue where the sidebar remained empty until the next restart due to the registry being scanned before restore had written data. Manual restores initiated from the Provider Storage UI (Restore Now, Restore Selected) also now trigger an immediate registry reload, preventing stale in-memory registry data.

v0.16.11

Released on 2026-06-11

Fixed

Provider storage boot restore drops most rows: The iterAll function used GORM's FindInBatches with a custom ORDER BY (provider_type, instance_name, rel_path). FindInBatches paginates using a primary-key cursor (WHERE id > last_max_id), which is only correct when the results are ordered by id. This custom ordering misaligned the cursor, causing iteration to stop silently after the first batch (a known issue, gorm #5027). This led to most rows being dropped during the restore process; for example, on one production instance, ~729 of 8440 rows were processed, and every wick session file was skipped, resulting in empty session directories after restart. The fix replaces FindInBatches with a plain Rows() cursor iterator, which streams every row in a single query pass. This ensures memory usage remains constant while safely allowing custom ordering by including id as a tie-breaker for stable results.

This summary was automatically generated by Gemini AI

v0.16.10 — Memory Management & Tree Repair

Released on 2026-06-11

Added

Introduced WICK_MEMORY_LIMIT environment variable for the server, enabling an opt-in soft memory limit that prompts Go's garbage collector to return memory to the OS on constrained hosts, preventing RSS from being pinned at high-water marks.

Improved

Optimized both boot-time and manual tree repair processes (RepairProviderStorageTree and store.repairOrphans) to no longer load Content blobs into memory. This drastically reduces transient memory allocations and overall RAM consumption during tree repair operations.
Refactored the boot-time provider storage tree repair, moving it out of Migrate() and into the providersync gate. It now runs in a background goroutine only when the sync job is enabled and provider-storage is in use, optimizing startup and resource utilization.
Consolidated the tree repair code paths for boot-time and manual UI operations, ensuring both use the same optimized, blob-free RepairProviderStorageTree implementation.

Removed

Dropped several one-shot legacy migrations from the Migrate() function, simplifying the database migration process as these migrations are no longer necessary on current database schemas.

Documentation

Added WICK_MEMORY_LIMIT to the docs/reference/env-vars.md.
Included changelog entries for the new soft memory limit and the repairOrphans memory optimization.

This summary was automatically generated by Gemini AI

v0.16.9 — Memory Optimization

Released on 2026-06-11

Improved

Memory hardening — provider storage: listing, explorer, retention, and purge queries no longer load file content blobs into memory. A new size column is persisted on write and backfilled on migrate, so the file-list endpoint reports sizes without fetching content. Folder-zip downloads fetch blobs individually by ID. Fixes an ~800 MiB memory peak on deployments with large backup corpora.
Bounded HTTP reads: the http workflow node and the generic internal HTTP client now cap response buffering at 64 MiB and return an error for larger responses. Previously these were unbounded io.ReadAll calls.
Webhook body cap: inbound webhook trigger requests are now rejected with 413 if the body exceeds 10 MiB.
Access-log middleware: large or streaming request bodies (multipart/form-data, application/octet-stream, text/event-stream, or Content-Length > 64 KiB) are no longer buffered by the logger — the downstream handler reads them directly.
Opt-in pprof (WICK_PPROF=1): set this env var to expose Go pprof endpoints on 127.0.0.1:6060 for heap/CPU profiling. Loopback-only; never exposed on the public listener.
Opt-in soft memory limit (WICK_MEMORY_LIMIT): set to a size string (e.g. 1200MiB, 2GiB) to tell the Go GC to return memory to the OS aggressively on constrained hosts. Helps boot-time provider-storage restore not pin RSS at its high-water mark on small VMs. Off by default; independent of GOMEMLIMIT. See Environment Variables ▶ WICK_MEMORY_LIMIT.
repairOrphans no longer loads file content: the two FindInBatches passes in the provider-storage tree-repair path now omit the Content column, cutting peak memory during orphan repair for large corpora.

This summary was automatically generated by Gemini AI

v0.16.7 — Boot Restore & Observability

Released on 2026-06-11

Improved

Asynchronous Boot Restore: Boot restore now runs in a goroutine, preventing server startup blockage for large source sets. The HTTP layer comes up immediately, and restore progress streams to logs.
Enhanced Restore Observability:
- Every restore-skip path logs its specific reason (e.g., environment kill switch, missing job row, disabled job) for easier diagnosis from logs alone.
- RestoreAll completion reports detailed metrics including total_files, processed, restored, skipped_match, skipped_diverged, and skipped_uncovered to explain the gap between total and restored files.
Faster Force Boot Restore: Force boot restore now skips identical files (based on hash match) instead of rewriting every file, making wide restores significantly faster.

Fixed

Manual Restore Overwrite: Manual Restore operations now correctly use RestoreAllForce to overwrite diverged files, ensuring desired changes are applied instead of retaining disk copies.
Error Handling: iterAll batch errors are now properly returned instead of being swallowed.
Postgres Compatibility: purgeExpired now uses a Postgres-native interval query, resolving an error caused by the SQLite-only datetime() function on Postgres.

This summary was automatically generated by Gemini AI

v0.16.6

Released on 2026-06-11

Fixed

Agent node max_turns not cleared on reuse: When a workflow reused an existing session and the agent node had max_turns: 0 (unlimited), the previously-persisted cap from an earlier run was silently kept. The node now always writes the value — including 0 — so switching back to unlimited works correctly.

Added

Bitbucket connector — PR review actions: Three new destructive operations for acting on pull requests. These operations are OpDestructive (default off, admin opt-in):
- approve_pull_request: Approve a PR as the authenticated user (idempotent).
- request_changes_pull_request: Flag a PR as needing changes (mutually exclusive with approve).
- merge_pull_request: Merge a PR into its destination branch, with optional merge_strategy (merge_commit, squash, fast_forward), message, and close_source_branch. This operation is irreversible.

This summary was automatically generated by Gemini AI

v0.16.5 — Provider Storage Sync

Released on 2026-06-10

Changed

Provider Storage Sync is now opt-in: The job ships disabled by default on fresh installs. Enable it from Tools → Jobs → Provider Storage Sync → Settings → Enabled.

Added

WICK_PROVIDERSYNC_DISABLE env var: Set to true to disable sync, boot restore, and the realtime watcher for a specific instance without touching the DB. Useful when multiple servers share one database. See Provider Storage → Per-instance kill switch and Environment Variables.

Fixed

Bounded boot restore memory: restoreAll now iterates files in batches of 50 instead of loading the full set into memory, preventing OOM on large credential trees. Progress is logged at each percentage point.

This summary was automatically generated by Gemini AI

v0.16.4

Released on 2026-06-10

Improved

Provider Sync Memory & Progress: Optimized providersync restore operations for reduced memory usage and enhanced user feedback.
- Switched from listAll to iterAll with FindInBatches(50) to process content blobs in batches, significantly reducing peak memory consumption.
- Implemented countAll to accurately track the total number of files for restoration.
- Added detailed progress logging, displaying restore percentage updates (up to 100 lines) and clearly marking the start and completion of the process.

This summary was automatically generated by Gemini AI

v0.16.3 — AI Agents

Released on 2026-06-10

Features

Workflow Environment Management via MCP: Introduced workflow_env_get, workflow_env_set, and workflow_env_delete operations for the workflow connector.
- Enables AI agents to read, update, and remove workflow environment variables without touching the UI.
- Secret values retrieved by workflow_env_get are masked as ••••••••.
- When setting secret fields via workflow_env_set, callers must provide wick_enc_ tokens.

Fixed

Provider Storage Sync: The provider-storage-sync job is now disabled by default (AutoEnable: false) on new installations.
- This prevents the service from automatically activating unless explicitly enabled by the user.
- Boot restore and watcher startup for provider-storage-sync now correctly check if the job is enabled before initiating, ensuring resources are only utilized when intended.

This summary was automatically generated by Gemini AI

v0.16.2 — Sub-Agent Delegation & Installation

Released on 2026-06-10

Improved

Refactored sub-agent delegation logic for simplicity and clarity.
Improved sub-agent configuration loading and validation.

Fixed

Adjusted Dockerfile and entrypoint script to correctly set the working directory.
Corrected agent dependency installation within the sub-agent setup script.
Updated requirements.txt to include missing dependencies for core agents.

Changed

Updated documentation links.

Removed

Unused script files.

This summary was automatically generated by Gemini AI

v0.16.1 — Install Wrappers

Released on 2026-06-10

Added

Introduced thin install.sh and install.ps1 wrappers for scaffolded projects, which delegate to Wick's canonical install scripts. This centralizes installation logic and ensures projects automatically benefit from script improvements without re-scaffolding.
Enhanced Wick's canonical install scripts to honor APP and REPO environment variables, allowing them to function correctly both standalone and when invoked via the new wrappers.

Fixed

Updated the canonical install scripts to use the correct GitHub Pages URL.

This summary was automatically generated by Gemini AI

v0.16.0

Released on 2026-06-10

Added

VSCode-style diff editor: The Source Control panel (full mode) now features an inline Monaco diff editor as the primary surface, with a file list on the left and the diff filling the remainder.
Auto-select first file: Opening the SCM panel automatically loads the first changed file into the diff editor.
Unified diff by default: Diffs now render in unified (inline) mode by default, with a toggle for side-by-side view in the diff header.
Hidden unchanged regions: Unchanged lines are collapsed with an "N hidden lines" expand bar, matching VSCode behavior (3-line context).
Inline Stage / Unstage / Discard buttons: Diff headers now include per-file Stage, Unstage, and Discard actions directly, removing the need to hover file rows.
Auto-show Save button: When editing directly in the diff editor (without needing an "Edit" button), a Save button automatically appears when content changes, applied to both full-mode inline diff and the sidebar DiffModal.
Per-session active repository persistence: The selected repository is saved to localStorage keyed by session ID and restored on subsequent opens.
Visible whitespace diff: Trailing newline and whitespace differences are now shown in the diff (ignoreTrimWhitespace: false).
Wick MCP server pre-approval: The entire Wick MCP server is now pre-approved for spawned agents using --allowedTools mcp__wick, eliminating the need for a static per-tool allowlist.
Workflow environment variables and secrets: A new system for managing workflow environment variables and secrets via a dedicated Settings modal. Secrets are encrypted, decrypted at runtime, accessible via {{.Env.KEY}}, and masked in previews and outputs.
Workflow webhook trigger: Implemented a webhook trigger with dual endpoints (/webhook/ for published, /webhook-test/ for draft), path-based routing, and a dedicated inspector in the UI.
webhook_respond node and RespondMode: Added a webhook_respond node for custom HTTP responses (status, body, headers) from workflows and introduced Trigger.RespondMode (immediately/last_node/respond_node) to control webhook response behavior.
Phoenix connector: A new read-only Phoenix connector for LLM span debugging, supporting listing spans by room/app and retrieving full span details.
Per-instance OAuth accounts for connectors: OAuth app credentials are now configured per-instance, enabling multiple sub-accounts for a single connector. New access policy flags (MultiAccount, EnableSSO, AllowOthersConfigure, AllowOthersConnectSSO) and an owner tag system are introduced.
Admin user creation: Admins can now create new user accounts directly from the Admin panel by entering an email, with a system-generated 5-word passphrase shown once for copy.

Fixed

Repository without commits: git show HEAD:<path> on a repository without any commits no longer returns a 400 error; an "invalid object name 'HEAD'" is now treated as an empty original side.
4xx request logging level: HTTP middleware now logs 4xx responses at the warn level instead of error, reducing noise for expected client errors.
GORM record not found log noise: GORM logger is set to Silent, preventing record not found queries from printing to stdout.
Diff not updating after save: After saving a file, the diff editor now correctly shows the updated content.
Diff race condition on file select: The Monaco diff editor is now mounted only after diff data is loaded, preventing empty-content rendering on first file selection.
Mobile autofocus: Skipped autofocus on inputs for touch devices (mobile, tablet) to prevent the on-screen keyboard from popping up unexpectedly on page load. On desktop, the "Ask anything…" composer is now preferred over the search box when both are present.
Workflow publishing with deleted nodes: Workflows with deleted scaffolded start/end nodes can now publish successfully, requiring only at least one trigger. Dangling graph entry references are now treated as warnings instead of publish-blocking errors.
UI theme issues: Various UI theme fixes for dark mode hover states, status/kind chip selection, and toolbar buttons were implemented.
Multi-trigger dispatch: Fixed a bug where only the first webhook trigger per workflow was dispatched correctly.
Slack connector token visibility: The bot_token and user_token fields in Slack connector configuration are now always visible.

Improved

Internal documentation structure: Reorganized internal design documentation into status-based folders (archive, todo, in-progress) and updated all references.
Workflow documentation clarity: Cleaned up internal comments and documentation, replacing yaml and file-based references with format-neutral descriptions to reflect DB-primary JSON storage for workflows.
Workflow data storage optimization: Removed unused yaml:"..." struct tags and MarshalYAML methods from workflow types, as workflow storage is now DB-primary JSON.
Canvas experience: Enhanced the workflow canvas with trigger validation badges, edge hover highlighting, and an "Open inspector" context menu option for nodes and triggers.
Connector operations management: The operations section in connector detail pages now includes pagination, search, multi-select, and bulk Enable/Disable actions.
MCP connector/account listing: The MCP wick_list command now supports filtering by kind=connector|account with composite IDs for account entries.

This summary was automatically generated by Gemini AI

Per-instance OAuth accounts & MCP multi-identity

Added

Per-instance OAuth app credentials: ClientID and ClientSecret moved from a shared server-wide setting to each connector instance's Configs. Every instance now carries its own OAuth app registration, so different instances can use different OAuth apps.
ConnectorAccount table: connected OAuth accounts are stored as sub-records of a connector instance, not as duplicate rows. Each account stores DisplayName, AccessToken, and a DisabledOps JSON list of per-account op overrides.
Access policy flags on connector instances: four new boolean fields control per-instance sharing:
- EnableSSO — activates the "Connect Account" OAuth flow on this instance.
- MultiAccount — when true, each user connect adds a new account entry; when false, reconnect replaces the existing token.
- AllowOthersConfigure — non-admin users with tag access may edit credentials and settings.
- AllowOthersConnectSSO — non-admin users with tag access may initiate the OAuth flow.
Owner tag: every connector instance records an owner:{rowID} tag so the creating user retains access even when filter tags change.
Access Policy section in the connector detail UI — surface for the four flags above.
Operations section redesign — paginated op list with search, checkbox multi-select, and bulk enable/disable. Shared OpsSection component is reused across the detail page and per-account op views.
Per-account operation disable list — each ConnectorAccount can carry a JSON list of op keys to disable. wick_execute with an account-scoped tool_id rejects those ops before reaching ExecuteFunc.
MCP wick_list — kind and parent_id fields: every entry now includes kind ("connector" for a standard instance, "account" for a connected OAuth account) and parent_id (the connector row ID when kind="account").
MCP wick_get — composite id: accepts a connectorID/accountID composite id returned by wick_list account entries; tool IDs are scoped with an @accountID suffix when a specific account is targeted.
MCP wick_execute — account token injection: AccountID is extracted from the composite tool_id; the selected account's AccessToken is injected as user_token / auth_mode=user_token before ExecuteFunc runs. Per-account disabled ops are enforced before execution.
Destructive op warning in MCP responses: ops marked OpDestructive now append ⚠ DESTRUCTIVE: Always confirm with the user before executing this operation. to their description in wick_list, wick_search, and wick_get results.
Slack connector: BotToken and UserToken are now always visible in the admin form (removed visible_when conditional display). ClientID and ClientSecret are new per-instance fields for OAuth app setup used by the Connect Account button.

Changed

Destructive ops default ON: connector.OpDestructive ops now default to Enabled=true on every new row (previously defaulted false). The LLM is responsible for confirming destructive intent with the user; the system-level default-off gate is removed.
SystemDisabled is advisory-only: a health-check lock (system_disabled=true) no longer hard-blocks execution. If the admin has explicitly set Enabled=true, the call proceeds; the advisory is recorded in run history. Previously SystemDisabled was an irresistible gate.

Phoenix connector, Webhook trigger & Canvas improvements

Added

Phoenix connector (phoenix): built-in read-only connector for Arize Phoenix LLM observability. Three operations — list_spans_by_room (list LLM spans for a conversation session), list_spans_by_app (list root spans by metadata['app_id']), and get_span (full detail: messages, tool calls, token usage, cost). Registered under the Observability tag. See Phoenix connector.
Spawned-agent tool pre-approval widened to the whole wick MCP server: agents now spawn with --allowedTools mcp__wick (server-level) instead of a static five-tool list, so wick_manager_* (and wick_info, ask_user, wick_skill_*, wick_encrypt/wick_decrypt) no longer hit the command gate's "always ask" prompt on the gated path. Not a security change — wick still enforces per-op access server-side; see Wick Manager → Command gate & management ops.
Workflow env & secrets: per-workflow key-value environment variables, configurable via ⋮ → Settings in the canvas editor. Values are accessible in every node template as {{.Env.KEY}}. Marking a var as Secret encrypts it at rest (wick_cenc_ token in workflows.env_values DB column); the engine decrypts with a per-run cache so plaintext only lives in memory during execution.
Secret masking: secret values are automatically masked as •••••••• in template preview (workflow_template_test), execute-step output, SSE events, and stored run state. The mask is applied with the existing single-pass algorithm, with overlapping-secret protection.
Themed UI components: <Select> dropdown and toolbar ⋮ more menu are now fully theme-aware with click-outside close. The ⋮ menu exposes the new Settings action alongside existing workflow actions.
Webhook trigger — dual endpoints: every webhook trigger now gets two distinct HTTP endpoints. POST /webhook/{wf_id}/{slug} targets the published workflow (production traffic). POST /webhook-test/{wf_id}/{slug} targets the draft workflow for testing without publishing. Both URLs are shown side-by-side in the trigger inspector with copy buttons and a tabbed Test / Live preview.
Webhook trigger — slug-based path storage: the trigger's path field now stores only the URL-safe slug (no leading slash, no wf_id prefix). The engine constructs the full request path at runtime, keeping trigger JSON portable across workflow IDs.
Webhook trigger — respond_mode: new field controlling when and what the HTTP endpoint returns to the caller. immediately (default) returns 202 Accepted at enqueue and runs async. last_node blocks until the workflow finishes (≤ 30 s) and returns the last node's JSON output with 200. respond_node blocks until a webhook_respond node fires, then returns that node's custom status, body, and headers. Both blocking modes time out with 504 after 30 seconds.
webhook_respond node: new node type (type: webhook_respond) that sends a custom HTTP response back to the webhook caller. Fields: respond_status (int, default 200), respond_body (Go template string), respond_headers (map, values are template-rendered). Active only when the firing trigger has respond_mode: respond_node; acts as a no-op pass-through in all other modes so the workflow still validates cleanly. The first node to complete in a run wins; subsequent ones are ignored.
Publish-time respond_node validation: publishing a workflow with respond_mode: respond_node on a webhook trigger but no reachable webhook_respond node from the trigger's entry_node now raises a Warning in the Validation panel. The publish still proceeds; at runtime the caller receives 502 Bad Gateway if no respond node runs.
Canvas validation badges on trigger cards: trigger cards now show inline warning badges when a trigger has a configuration issue detectable at validation time (e.g. respond_mode: respond_node with no reachable respond node). Validation also runs on canvas load.
Canvas edge hover highlight: hovering an edge in the canvas highlights it for easier graph tracing.
Canvas context menu — "Open inspector": right-clicking a node now includes an "Open inspector" option alongside delete, opening the inspector panel directly.

Fixed

Webhook multi-trigger dispatch: workflows with more than one webhook trigger (different slugs) now correctly dispatch each inbound call to its matching trigger and entry node. Previously, the dispatch loop keyed candidates on workflow ID alone, causing all but one trigger to be silently dropped.
Webhook entry-node routing: each webhook trigger routes to its own entry node; prior to this fix every inbound webhook always started at the first entry node regardless of which trigger matched.
Publish enabled-flag preservation: publishing a workflow no longer resets the enabled/disabled flag set before the publish action.
Theme / dark-mode fixes: executions panel, toolbar, and history tab now render correctly in all themes including dark mode.

v0.15.8

Released on 2026-06-07

Added

Workflow fixed-mode template guard: Publishing a workflow now fails with an error (previously a warning) if any field with arg_modes set to fixed contains a Go template ({{...}}), preventing the silent shipment of broken URLs, bodies, or prompts. Draft saving is unaffected.
Workflow auto-switch to Expression: The workflow canvas editor automatically switches a fixed field to expression mode when the user types {{ into it.
Workflow wick:"mode=fixed|expression" config tag: Connector and channel op authors can use this new tag to lock the Fixed ⇄ Expression toggle for a schema field, greying out the toggle in the editor. The toggle now renders on every field kind in the inspector.
Wick Manager top-level MCP tools: The wickmanager connector's operations are now surfaced directly in tools/list as wick_manager_<op> tools (e.g., wick_manager_app_list). This allows LLM clients to discover and call manager operations without the wick_list → wick_get → wick_execute discovery cycle. These tools work over both stdio and the Streamable HTTP/SSE transport. To avoid double-exposure, wickmanager is excluded from wick_list and wick_search.

Fixed

MCP SSE transport dispatch: Tools such as wick_info, ask_user, wick_list_providers, wick_skill_list, and wick_skill_sync now work correctly over the Streamable HTTP/SSE transport. Previously, they were advertised in tools/list but returned "unknown tool" on tools/call. The SSE dispatcher now delegates all non-streaming tools to the canonical handler, ensuring identical behavior across all transports.

This summary was automatically generated by Gemini AI

v0.15.7

Released on 2026-06-07

Fixed

Chat Layout:
- Implemented a FullBleed layout for the session/chat page, resolving issues with incorrect padding, misaligned headers, and the composer sliding under the keyboard.
- Adjusted the agents shell to use h-[100svh] for improved composer positioning, preventing it from being cut off on first paint before the dynamic viewport stabilizes.
Netboot Setup: Ensured netboot.Setup() is properly executed for the released wick-agent binary by integrating its call into postgres.NewGORM. This prevents dead-code elimination and guarantees that DNS/CA fallback is correctly initialized, addressing issues particularly observed on Termux.

This summary was automatically generated by Gemini AI

v0.15.6

Released on 2026-06-07

Added

Source Control panel now renders as a full-screen overlay on mobile and retains pin/resize behavior on desktop.
Native DNS and CA fallback implemented for Android/Termux, resolving network and SSL certificate issues for the pure-Go binary.

Fixed

Termux/Android DNS and CA fallback now actually runs in the released wick-agent binary. The previous fix (#589) wired netboot.Setup() only into the in-repo entry points; Go's internal-package rule prevented the separate wick-agent wrapper module from importing it, so the fallback was dead-code-eliminated from the shipped binary. Setup is now called inside postgres.NewGORM() — a chokepoint every entry point reaches before the first DNS lookup — and is guarded by sync.Once so it runs exactly once.
Empty Slack pings (bare @bot mentions) are now normalized, ensuring the agent greets the user instead of stalling.
System-turn pills (e.g., [Slack thread context]) are now responsive on mobile, wrapping text and fitting within container width to prevent overflow.

This summary was automatically generated by Gemini AI

v0.15.5 — AI Agents

Released on 2026-06-07

Added

Wire agent-node max_turns to claude --max-turns for limiting agent conversation turns.
Per-app PWA name and session cookie support to prevent collisions when co-hosting instances on different ports.
One-click re-run functionality for past workflow runs, using the original trigger event.
Source Control (git) panel for agent sessions, offering status, diff, stage/unstage, commit, discard, branch management, and history viewing.

Fixed

Pre-approve Wick MCP meta tools for headless agent spawns and surface agent error subtypes in result(is_error) events.
Agents can now read their own skill bundle files located under ~/.claude/skills.
Improved agent-node failure diagnosis by logging subprocess exit code and stderr tail on abnormal exit.
Self-heal stale agent --resume sessions by clearing the cli_session_id if the conversation is not found.
Ensured agent session's current working directory (CWD) remains stable after a conversation exists to prevent resume failures.
Resolved toolbar dropdowns clipping on mobile and desktop in workflows.
Admin navigation tabs now wrap on mobile viewports instead of overflowing.
Admin data tables now stack into responsive cards on mobile viewports, including avatar dropdown visibility.
Enabled Tailwind's hoverOnlyWhenSupported to apply hover styles only on hover-capable devices, preventing stuck hover states on touch screens.
Prevented mobile sidebar burger from overlapping page content in agents and tidied workflows list display on mobile.
Made the workflow Run tab usable on mobile by switching to a single-pane view (runs list OR run detail).
Corrected transparent surfaces in light theme and ensured bottom tabs panel is visible in the workflow editor.
Stopped auto-adding ALLOWED_ORIGINS to ~/.bashrc during installation to prevent unintentional host allowlist widening.

This summary was automatically generated by Gemini AI

Native DNS + CA fallback for Android/Termux

Added

The wick binary now configures DNS and TLS automatically on Termux/Android — no proot or manual SSL_CERT_FILE required. When /etc/resolv.conf has no usable nameserver, a pure-Go fallback resolver is installed using $PREFIX/etc/resolv.conf, Android system properties (net.dns1/net.dns2), or public defaults (1.1.1.1, 8.8.8.8) — in that order. A new WICK_DNS_SERVERS env var (comma/space-separated) overrides all of these. TLS: when $PREFIX is set and no system cert store exists, SSL_CERT_FILE is pointed at $PREFIX/etc/tls/cert.pem. Both are no-ops on normal Linux/macOS hosts.

Slack empty-ping fix & session-context pill responsiveness

Fixed

Slack connector: a bare @bot mention with no message text no longer leaves the agent stalled. The empty turn is normalized to a short greeting instruction so the agent responds naturally.
Session-context pill (the injected system-turn badge in the session view) now wraps long text and is width-capped, preventing overflow on mobile viewports.

Source Control panel for agent sessions

Added

Source Control panel on the session detail page (/tools/agents/sessions/<id>): a docked, pinnable VSCode-style SCM sidebar. Features: multi-repo discovery of all git repos inside the session cwd; tree or list view for staged / unstaged changes (toggle persisted in localStorage); per-file stage (+), unstage (−), and discard (↺) actions (discard is destructive — confirms before running git restore / git clean); one-line commit input; branch dropdown with checkout and create+checkout; Pull / Push buttons with ahead/behind count; Monaco diff editor modal (git-correct diffs for staged, unstaged, and untracked files); commit History tab with per-commit file list and diffs; edit + save from the diff modal. Pin state and panel width (240–640 px, default 260 px) persist in localStorage. Live updates via a server-side fs watcher that pushes git_status SSE events — the Changes section and th e Source rail tab badge refresh with zero polling. Backend: new Go package internal/agents/scm/; endpoints under /tools/agents/api/sessions/{id}/git/*. Requires git on PATH.

Workflow run re-run

Added

One-click re-run button in the workflow run detail panel. Re-fires the current draft with the original run's trigger payload (same input, fresh timestamp). Endpoint: POST /api/workflows/runs/{id}/{runID}/rerun. The UI jumps to the newly created run immediately after firing.

Admin & Workflow Mobile Responsiveness

Fixed

Admin nav tabs wrap to a second row on narrow screens instead of overflowing.
Admin data tables (connector instances, users, tools, jobs) and the connector-detail operations table render as stacked cards below 768 px via new .resp-table / .resp-table-wrap CSS utilities.
Hover styles are now only emitted for devices that support hover (hoverOnlyWhenSupported), preventing buttons from staying stuck in :hover state after a tap on touch screens.
Agents content area and the workflows SPA header receive top padding on mobile so the fixed sidebar burger no longer overlaps page titles.
Workflows list search input is now fluid and the count label no longer wraps; card metadata is hidden on very small screens to avoid overflow.
Workflow Run tab renders a single-pane list-or-detail view on mobile with a Back button; the run-detail Nodes/Events grid collapses to a single column below md.

v0.15.4 — Mobile & Workflow

Released on 2026-06-06

Added

Enhanced Canvas interaction for touch devices: enabled one-finger touch pan, two-finger pinch-zoom, and node dragging via touch-action:none. Tap-to-add functionality from the Palette with nodes dropping at viewport center. Connection ports are now visible on coarse/no-hover pointers.
Optimized Node/Trigger detail modals for mobile, collapsing to a single pane with an Input/Editor/Output switcher and near-fullscreen display.
Restored drawer behavior for the Agents sidebar on short/landscape-phone viewports.
Implemented progressive disclosure for the Toolbar on mobile, folding Save/Discard/Unpublish into a "More" menu and hiding secondary chips/History.
Synchronized PWA theme-color with the active theme (all 12 themes) via runtime CSS variable sync.

Fixed

Resolved 403 errors for internal agent MCP connections by exempting /mcp requests from loopback hosts (127.0.0.1, ::1, localhost) in the hostAllowlistHandler.
Corrected workflow version history display and functionality:
- Added JSON tags to entity.WorkflowVersion for correct field serialization (id, workflow_id, kind, body, message, created_by, created_at).
- Enabled per-row deletion and "Clear all" functionality in the History tab, with auto-refresh after autosaves.
- Integrated a reusable JSON diff viewer for comparing workflow versions, featuring changed-line highlighting, an All/Diff-only toggle, and scroll synchronization.
- Prevented redundant workflow versions by having SaveDraft skip new snapshots when the body is identical to the last draft.
- Introduced new API endpoints: DELETE /api/workflows/versions/{id}/{versionID} and DELETE /api/workflows/versions/{id}.
- Adjusted autosave debounce from 800ms to 2000ms.

Improved

Replaced the free-text "Workspace override" input on the session_init node inspector with a dropdown populated from existing projects, preventing runtime errors from invalid project IDs.

This summary was automatically generated by Gemini AI

Agent fixes & workflow version history

Added

Delete a single history snapshot via the trash button in the History list.
Clear all button removes every snapshot for the current workflow (with confirmation).
History list auto-refreshes after each autosave.
New REST endpoints: DELETE /api/workflows/versions/{id}/{versionID} (single snapshot) and DELETE /api/workflows/versions/{id} (all snapshots).
Version compare now renders a real colored diff with an "All / Diff only" toggle; the same JsonDiff component is reused by the JSON preview tab.

Fixed

Agent-node max_turns is now wired to Claude's --max-turns flag. Previously the field was stored but never forwarded to the subprocess, making it a silent no-op. 0 continues to mean unlimited (provider default).
Spawned Claude agents no longer stall on an interactive permission prompt for wick's own MCP tools. All five meta-tools (wick_list, wick_search, wick_get, wick_execute, wick_list_providers) are pre-approved via --allowedTools at spawn time.
Spawned Claude agents can now read skill files in ~/.claude/skills/ (and the matching ~/.codex/skills/, ~/.gemini/skills/, ~/.agents/skills/ paths). Claude spawns with --add-dir ~/.claude/skills when the directory exists; the system-prompt path table carves out skills/** as read-allowed while the rest of ~/.claude/** stays denied.
Persistent (workflow_global) sessions now self-heal a stale --resume ID. When Claude exits with "No conversation found" the pool clears the stored CLI session ID so the next spawn starts fresh instead of retrying a dead ID.
Project backfill is skipped once a session already has a CLI conversation, preventing a cwd change from breaking --resume.
Agent subprocess failures are now diagnosable: exit code and a stderr tail are logged on abnormal exit, and an error_during_execution result subtype is no longer surfaced as a blank "agent error: " message.
Workflow version history (History tab) now correctly receives id, kind, message, created_at, and body fields; a missing JSON serialization on the entity caused the tab to display empty rows.

Changed

Autosave debounce raised from 800 ms to 2 s.
Identical-body autosaves no longer create a new draft snapshot (dedup).

Improved

Workflow editor: session_init node "Workspace override" field is now a dropdown populated from existing projects instead of a free-text input, preventing the ensure session: project not found runtime error caused by typing a non-existent project ID.

v0.15.3

Released on 2026-06-06

Added

Automated crediting of contributors with @mentions in GitHub release bodies.
Enhanced release preparation to paginate commit lists and extract GitHub @login handles for contributors.
Updated release creation to include a "Contributors" section in the release body.

Fixed

Resolved HTTP 500 errors for the GET /mcp SSE handler by correctly probing and using http.Flusher support via the middleware Unwrap chain with http.NewResponseController.
Corrected the tools/call SSE path, which was silently falling back to JSON due to the same http.Flusher detection issue.
Added a regression test to ensure GET /mcp properly opens SSE streams through Unwrap-only writers.

Improved

Documentation for workflow/agent loopback MCP access and connection troubleshooting.

This summary was automatically generated by Gemini AI

v0.15.2 — AI Agents

Released on 2026-06-06

Added

Implemented a doc-sync subagent with a PreToolUse(Bash) hook to keep docs/ synced with code changes before pull requests.
Introduced a per-provider SendMode configuration (default, append, queue, spawn) for agent instances.
Added a cross-session Active Processes panel (accessible from session view and providers page) for real-time visibility into provider, PID, queued count, and agent lifecycle.
Integrated internal/processctl for canonical PID liveness checks across Unix and Windows.

Fixed

Resolved an issue where spawned Claude agents could not fully connect due to incomplete MCP Streamable HTTP transport, by implementing GET and DELETE methods for /mcp and setting an Mcp-Session-Id header during initialization.
Addressed a double-spawn bug in Codex agents by ensuring the agent slot follows the agent, not the process, and is not released prematurely on turn-end or internal respawn kills.
Corrected Stop() behavior for respawn-mode agents between turns to ensure proper slot release.
Updated ReconcileDead to correctly skip respawn-mode agents when they are idle between turns.
Wired Codex stdin to the null device to prevent hangs on Windows.
Resolved a data race in capacity_test by injecting provider capacity directly instead of relying on asynchronous provider.Save operations.

Improved

Relaxed Claude spawn behavior to drop --strict-mcp-config by default, merging the Wick server with existing MCP servers, while offering WICK_STRICT_MCP for isolation.
Updated the contributing guide to include details about the doc-sync workflow.
Synchronized public documentation with v0.15.1 features, including transform (jq engine), slack (channel-node workflow actions), workflow (import/publish), workflow/state (run detail/delete), branch/classify, and the bitbucket connector.
Documented WICK_STRICT_MCP and WICK_DISABLE_SHARED_MCP environment variables.
Enhanced agent message handling by replacing the single-slot pendingMsg with a pendingQueue to process messages sent mid-turn in order.
Implemented per-provider and global concurrency caps for agent pools, with 0 indicating unlimited capacity.
Improved rendering of multi-line configuration descriptions in the management view by interpreting \n as real line breaks.

This summary was automatically generated by Gemini AI

v0.15.1 — Workflow Enhancements

Released on 2026-06-06

Added

Import workflows from exported JSON files directly within the UI.
Agent nodes now connect to the live MCP HTTP server over loopback, eliminating per-run cold-start latency and duplicate DB connections.
Enhanced workflow execution management in the UI, including the ability to delete runs, view richer event and node details, and preview full run JSON.
Bitbucket create_pull_request_comment operation now supports inline comments by specifying inline_path and inline_to/inline_from parameters.
Workflow events API now supports events_limit for tailing the last N events, returns total and truncated counts, and evicts the index cache upon workflow deletion.
Transform nodes now include a jq engine for advanced JSON processing using gojq.
Slack workflow action nodes are fully wired to the live Slack API, supporting all 12 action operations (e.g., send message, reply thread, open modal).
The workflow canvas now allows setting branch and classify node edge labels, enabling correct routing configuration from the UI.
The in-app lifecycle chime now correctly primes the AudioContext on the first user gesture, ensuring sound plays on macOS Chrome.

Fixed

Improved robustness for skill .zip imports, correctly handling various archiving layouts from different operating systems and tools, and filtering junk entries.
Publishing workflows or MCP/connectors now triggers an immediate hot-reload of the router, ensuring live runs use the freshly published definitions.
Agent node skill validation no longer incorrectly rejects skills that are actually available.
Agent nodes now incorporate timeout_sec and require_status contracts, preventing silent successes when agents stall or fail to produce a final status.
The workflow enable/disable toggle now takes effect immediately without creating an unintended draft.
Encryption masking now uses a single-pass algorithm, fixes an overlapping-secret leak, and improves performance.
The in-app lifecycle card chime no longer remains silent on macOS Chrome due to WebAudio autoplay policy by calling AudioContext.resume() from a user gesture.
The transform node's "jsonpath" engine now explicitly errors when a query is invalid or not applied, instead of silently returning the original input.

This summary was automatically generated by Gemini AI

v0.15.0 — PWA Notifications

Released on 2026-06-05

Added

Implemented PWA push notifications for agent lifecycle events.
Introduced agent auto-start functionality after installation.
Split conversation trace into per-turn index and lazy-loaded event files.
Added TraceEventInlineKB and TraceEventMaxKB agent configurations to control trace event storage.
Created new API endpoints (GET /sessions/:id/turns/:turn_id and /events/:event_id) for lazy fetching of conversation traces.
Integrated UI lazy-loading of conversation traces when "show trace" is clicked.
Added an Interrupted field to ConversationTurn to distinguish kill-truncated turns from text-cap truncated turns.
Included a Copy button for fenced code blocks in the markdown renderer.
Implemented per-session subscription for agent lifecycle notifications, allowing users to opt-in for specific sessions.
Added a bell affordance on queue rows to subscribe to session notifications.
Introduced a pre-subscribe bell on the new-session composer for immediate subscription upon session creation.

Fixed

Resolved token-too-long errors in ReadJSONL for large conversation files by replacing bufio.Scanner with json.Decoder.
Updated tests to reflect the trace split storage refactor.
Ensured proot is always installed on Termux, not only when codex is present, for broader compatibility.
Corrected a race condition where lifecycle push notifications fired before the assistant turn was appended to conversation.jsonl.
Eliminated duplicate notifications by immediately closing OS notifications when the Wick application is open and displaying an in-app card.

Improved

Clarified notification connector copy, account state messages, and subscription removal UI.
Synchronized the workflow registry via an observer hook to ensure all connectors are registered regardless of order.
Separated server_mcp.go to distinguish lifecycle management for stdio and HTTP server paths.
Changed notification operations to no longer be marked as destructive.
Enhanced push notification banner UX: now hidden when subscribed, uses a soft CTA card for initial prompts, shows a persistent warning for denied permissions, and uses floating toasts for transient feedback.
Refined notification bell icon and adjusted layout to prevent page content pushing.
Optimized placement and behavior of the notification bell, now anchored to the chat composer's top-right corner for better context.
Modified lifecycle pushes to fire only on "idle" state transitions, reducing notification noise.
Enriched push notification bodies with a preview of the agent's actual response.
Introduced in-app rich cards to display push notifications when Wick is open and focused.
Added an audible chime for in-app notification cards.
Updated the notification bell's 'setup' state to directly prompt for browser permission inline, simplifying the user flow.
Removed the MaxAssistantTurnBytes cap as text and events are now stored separately.

This summary was automatically generated by Gemini AI

v0.14.25

Released on 2026-06-04

Added

Slack connector support for the upload_file operation using the Slack v2 three-step upload flow.

Improved

Optimized providersync performance by eliminating N+1 queries in folder pruning using a single subquery.
Reduced peak memory usage in providersync by batch-fetching orphan repairs in chunks of 500.
Batched subtree deletions in providersync to fetch children per BFS level instead of querying per individual node.
Added a bounded glob regex cache with a maximum size of 512 and eviction to prevent unbounded memory growth.

Fixed

Resolved cross-platform matching issues in globMatch where Windows-style backslash patterns failed to match on Linux and macOS environments.
Fixed a pool process termination bug where Kill failed on stale agent names by falling back to session prefix scanning.
Fixed a 422 'no agent' error in channel sessions on sendMessage by implementing an OnAgentAdded callback to refresh the in-memory registry.

This summary was automatically generated by Gemini AI

v0.14.24

Released on 2026-06-04

Fixed

Resolved a 404 routing error on the /projects/new endpoint by consolidating it into the /projects/{id} handler.
Corrected SPA integration tests to pass proper context configuration.
Fixed the launch configuration settings.

Improved

Replaced the plain-text fallback 404 error in tool handlers with the app's styled 404 page.

This summary was automatically generated by Gemini AI

v0.14.23 — Slack Integrations

Released on 2026-06-04

Added

Slack Socket Mode connection lifecycle tracking (connecting, connected, error, disconnected) and self-healing reconnection capabilities.
Integration status panel for Slack channels displaying transport mode, subscription state, bot/workspace identity, and webhook URLs.
Connection health probe to verify Slack credentials (signing secret and public URL) and report subscription states.
New HTTP API endpoint (/tools/agents/channels/{slug}/status) to dynamically fetch channel integration status.

Improved

Refactored the Slack connector cache to securely share authenticated bot user IDs with the connector, ensuring consistent identity presentation in messages.

Fixed

Preserved scoped sidebar navigation when transitioning to the session detail page by utilizing the session's project ID.
Fixed clipping of the picker dropdown inside the Manager UI card container by removing restrictive overflow styles.

This summary was automatically generated by Gemini AI

v0.14.22

Released on 2026-06-03

Fixed

Guarded against OS PID reuse causing false ErrAlreadyRunning errors by validating that the running process executable matches the expected daemon binary.

Improved

Enhanced the wick status command to display HTTP status (ok/unreachable), surfacing instances where the daemon process is active but the HTTP server failed to bind the port.

This summary was automatically generated by Gemini AI

v0.14.21 — Agent Projects

Released on 2026-06-03

Added

Introduced Projects to replace the Workspace concept, featuring automatic boot-time migration, customizable folders, defaults, icons, names, and pinned sessions.
Added a Claude-style project landing page, a sidebar Projects navigation section with pinning and drag-to-move capabilities, and a dedicated project settings page.
Added support for per-user pinned projects that auto-scope the agents landing page.
Added robust queue management capabilities, including search filters, select-all checkboxes, and a bulk "Kill selected" action in the queue panel.
Added origin tracking (e.g., REST, Telegram) for sessions and spawns, displaying the session ID and channel source in the Recent Spawns table.

Improved

Bounded spawn logs to a maximum of 50 files, implementing automatic pruning on boot, on provider page loads, and on each new spawn.
Enhanced the queue dequeue mechanism to clear all pending input and remove every queued entry for a session across all agents.
Polished the Recent Spawns UI to remember its expanded/collapsed state via localStorage and format session IDs into a shorter, cleaner representation.
Moved hidden-field filtering from templates to callers, making hidden channel configuration fields visible on channel config pages.

Fixed

Fixed queue cancellation failures caused by mismatches between the UI's agent name and the queued entry.
Fixed hidden variable rendering issues on the admin variables page.

This summary was automatically generated by Gemini AI

v0.14.20 — Workflow Editor V2

Released on 2026-06-03

Added

Svelte 5-based Workflow Editor (V2) mounted as a SPA at /workflows-v2/edit/{id}, featuring an interactive canvas with SVG bezier edges, snap-to-align, marquee multi-select, and multi-drag capabilities.
Database-backed workflow storage and backend APIs for managing drafts, versions, testing, execution, and validation.
Schema-driven inspector forms for triggers, channels, and connectors, dynamically rendered from backend configuration schemas.
Comprehensive testing framework featuring an inline assertion builder, test history tracking, and a JSON event test stager.
Backend-owned palette structure via the /api/workflows/palette endpoint, enabling dynamic registration of executors, channels, and connectors without frontend modifications.
Keyboard shortcuts for canvas operations, including saving (Ctrl/Cmd+S), canceling actions (Esc), and deleting nodes or triggers (Delete/Backspace).
Dedicated LiveDiskFS development loop allowing local frontend changes to reflect instantly without binary recompilation when WICK_DEV_REPO_ROOT is enabled.

Improved

Refactored chat panels to remove assistant avatars, allowing message bubbles to occupy full width on mobile devices.
Enhanced chat bubble headers to display the specific AI provider alongside the agent name (e.g., {agent}.{providerName}).
Prevented the chat header from scrolling off-screen by locking viewport overflow on the Agents shell during session switches and reloads.
Implemented auto-incrementing default node labels (e.g., http_1, http_2) to prevent immediate canvas validation conflicts upon node creation.
Integrated a lazy-loaded Ace Code Editor for Go and Python script nodes, syncing with system light/dark themes and retaining scroll/cursor positions.
Optimized CI pipelines by keying the templ cache on its pinned version in go.mod instead of go.sum, preventing redundant reinstalls.
Generalized monorepo plumbing and release pipelines to support automated bundling of multiple frontend SPA packages.

Fixed

Resolved installer write failures (ETXTBSY - text file busy) on Linux and Termux by stopping any active agent binary prior to executing raw curl writes.
Fixed a Windows binary resolution bug in safeexec by properly traversing %PATHEXT% for bare executable names.
Fixed a canvas persistence bug where node drag positions were discarded during JSON/YAML serialization roundtrips.
Fixed canvas deletion logic to ensure triggers are properly cleaned up alongside nodes when multi-selecting and deleting elements.

This summary was automatically generated by Gemini AI

Workflows: DB-primary JSON

Added

Version history panel with side-by-side compare. Pick two versions, the editor shows both bodies for diff.
MCP ops: workflow_lock (canvas freeze), workflow_guard (standalone safety review), workflow_versions + workflow_version_detail + workflow_restore_version, workflow_diff_versions, workflow_exec_node (single-node execute).
Test fixture ops gained name-only addressing — workflow_save_test_case / workflow_list_test_cases / workflow_delete_test_case no longer take file paths.

Changed

Workflow body now lives in the database as JSON. Three tables: workflows (current state), workflow_versions (append-only history), workflow_test_cases (named test fixtures). YAML codec dropped; parse.Parse / parse.Marshal are JSON-only.
Run state, run events, and env values stay on disk (runs/<id>/state.json, events.jsonl, env.json) — same place, JSON content.
Workflow editor is the Svelte SPA at /tools/agents/workflows/edit/<id>. The legacy templ+Drawflow editor is removed.

Removed

MCP ops: workflow_read_file, workflow_write_file, workflow_list_files, workflow_delete_file. Workflow body is not file-addressable anymore — use workflow_get and the dedicated edit ops (workflow_add_node, workflow_set_triggers, etc).
prompt_file: nodes/<file>.md on agent and classify nodes. Use the inline prompt field; templates resolve against .Event, .Node, .Trigger as before.

v0.14.19 — Mobile UX & PWA

Released on 2026-06-01

Added

Service worker and PNG/maskable icons to enable browser PWA installation prompts.
Custom vector wrench icon to replace the standard emoji for consistent rendering across platforms.
A new bool/boolean configuration widget that renders as a toggle switch.
Split log files per component (app, server, worker, mcp) for the headless daemon.

Improved

Mobile chat experience by preventing auto-refocus after sending and allowing Enter to insert a newline on touch devices.
Mobile layout behavior using 100dvh and interactive-widget resizing to prevent the keyboard from pushing the header or composer off-screen.
Chat bubble width for assistant messages on mobile screens to reduce cramping.
App orientation flexibility by removing the forced "any" orientation lock in the manifest.
Settings UI by migrating config options to the new toggle widget, applying conditional visibility to startup_script, and hiding internal configuration rows.

Fixed

Prevented the internal admin_password_changed flag from being accidentally toggled in the admin panel, which previously caused the default password to re-seed on boot.

This summary was automatically generated by Gemini AI

v0.14.18 — Termux & Attachments

Released on 2026-05-31

Added

File attachment support in the agent chat composer with features for drag-and-drop, clipboard pasting, upload limits (25 MiB/file), and an iframe-sandboxed preview modal.
New --host and --localhost CLI flags (and WICK_HOST environment variable) to restrict the server's bind address.
Support for sequential boot-time shell scripts via new startup_script and startup_script_enabled admin variables to facilitate vendor tunnel (e.g., ngrok) configuration.

Fixed

App-level ALLOWED_ORIGINS environment overrides failing to render in the kvlist configuration UI due to a JSON unmarshaling mismatch.
Codex CLI handshake failures on Termux/Android by auto-installing proot and wrapping spawned processes with necessary host-file bind mounts.

Improved

Revamped documentation structure, landing page, and navigation to prioritize Wick Agent use cases and partition installation guides into platform-specific pages.

This summary was automatically generated by Gemini AI

v0.14.17

Released on 2026-05-30

Fixed

Resolved a crash on Termux (Android kernels < 5.8) where the gotty subprocess would fail with a SIGSYS error during LookPath execution by passing the absolute shell path instead of a bare name.

This summary was automatically generated by Gemini AI

v0.14.16 — Termux Compatibility

Released on 2026-05-30

Added

Introduced safeexec.Command and safeexec.CommandContext wrappers to safely resolve binary paths without triggering faccessat2.
Added an AST-walking unit test (TestNoDirectOSExec) to prevent future direct usage of os/exec functions across the codebase.

Fixed

Resolved a critical process crash (SIGSYS) on Termux/Android systems running kernels < 5.8 by routing all command executions through safeexec.
Fixed a release asset naming mismatch for the gate sidecar (wick-agent-gate), resolving 404 download errors during installation.
Corrected path resolution in safeexec.LookPath on Windows by properly recognizing backslash path separators.

This summary was automatically generated by Gemini AI

v0.14.15 — Agent Routing

Released on 2026-05-30

Improved

Tightened routing rules between Wick and other Model Context Protocol (MCP) connectors by moving them to the immutable configuration section.
Implemented a read/write split fallback mechanism for Wick connector failures, requiring user confirmation for write operations to prevent unintended privilege escalation.
Added specific error-handling paths for Wick routing, including retrying on server errors (5xx/timeouts) and halting on authentication failures (401/403) or gate denials.
Simplified the Wick connector catalog header to act purely as a cold-start discovery hint.

This summary was automatically generated by Gemini AI

v0.14.14 — Agent Connectors

Released on 2026-05-30

Added

Injection of a ready-only connector catalog into the agent system prompt, providing models with available connector keys and descriptions to optimize tool selection.
Initial credential banner display and log tracing hints when running the daemon start or restart commands in the background.

Improved

CLI installer experience by showing a curl progress bar during binary downloads and enforcing a 15-second timeout on GitHub API resolution.

This summary was automatically generated by Gemini AI

v0.14.13 — Idempotent Installer

Released on 2026-05-30

Added

Added a version subcommand and -v / --version flags to wick-agent and wick-agent-gate to facilitate version tracking and automated upgrades.
Added documentation covering CLI version commands for both the main agent and gate sidecar binaries.

Improved

Enhanced the installer (install.sh and install.ps1) to skip downloads and execution when the already-installed binary matches the latest resolved version tag.
Replaced silent curl downloads with a visible progress bar and added a 15-second timeout on GitHub API calls to prevent indefinite hangs on slow connections.
Improved the Termux LAN installer to detect existing managed ALLOWED_ORIGINS in ~/.bashrc, prompting users to keep, edit, or clear rather than force-reprompting on every run.

Fixed

Fixed version probing in the installer to run with redirected stdin, preventing syntax errors caused by child processes consuming script lines from curl | sh.
Fixed version probe sequencing to prevent gotty from attempting to bind to port 8080 during version checks.
Resolved an issue where gate binary verification failed and polluted the installer status table with hook-error JSON.

This summary was automatically generated by Gemini AI

v0.14.12 — Mobile & Headless Support

Released on 2026-05-30

Added

Daemon mode and background service management (start, stop, status, restart, and service install/uninstall) for headless hosts, supporting systemd (Linux), Termux (Android), and Windows.
Progressive Web App (PWA) support with custom icons, theme-color configuration, Apple mobile web app tags, and standalone display mode.
Dynamic PWA manifest handler that reflects custom configured application names and descriptions in browser-installed instances.
Environment detection for headless hosts to prevent CLI execution from stalling when a graphical system tray is unavailable.

Fixed

Resolved SIGSYS system call crashes in Termux on older Linux/Android kernels (< 5.8) by routing executable lookups through a custom safe-execution layer instead of standard exec.LookPath.
Fixed a 30-second stall during installation on virtual machines with unresolved hostnames by removing hardcoded sudo prefixes from the installer script.
Fixed chat composer clipping on mobile browsers by locking the viewport styling to small viewport height (100svh).

Improved

Enhanced the installation script to probe existing component versions and skip redundant downloads when matching release versions are already installed.
Redesigned the agent interface for mobile devices, introducing a collapsible navigation drawer, a two-tier collapsible "More" navigation group, and notch-safe top padding.
Unified branding across the desktop system tray, Windows executable icon, and PWA assets using a consistent wrench logo.

This summary was automatically generated by Gemini AI

v0.14.11 — Network & Configs

Released on 2026-05-29

Added

Support for an ALLOWED_ORIGINS host allowlist configuration and environment variable to allow secure remote and LAN access alongside the canonical APP_URL.
"Detect LAN URLs" utility in the Admin UI to automatically discover reachable RFC1918 IPv4 addresses and add them with one click.
Dedicated CLI commands (config list/get/set and config allowed-origins ...) for managing application configuration and allowed origins from the terminal.
Interactive LAN IP whitelisting and automated gotty web terminal installation in the setup script (install.sh).
Automated bot attribution footer ("Sent using <@BotID>") appended to Slack connector send_message payloads using Block Kit.

Improved

Environment variables (APP_URL and WICK_ENC_KEY) now override database-stored configurations at read time, featuring read-only indicators and write protections in the Admin UI.

Fixed

Inline markdown rendering in agents and skills to require word boundaries for underscores, preventing snake_case identifiers from being incorrectly stripped or formatted as italics.

This summary was automatically generated by Gemini AI

v0.14.9 — Wick-Agent Rename

Released on 2026-05-29

Added

Standalone gate sidecar release asset, with automatic installation support for raw Linux and Termux environments to ensure end-to-end command gate functionality.

Improved

Renamed the runtime binary from wick to wick-agent to prevent naming conflicts with the wick CLI development tool.
Updated installation scripts, CI configurations, and documentation to use the new wick-agent binary name and streamlined the first-run credential generation.

Fixed

Resolved a CI artifact upload issue where nested directories caused release uploads to fail, restoring missing assets like the raw linux-arm64 binary.

This summary was automatically generated by Gemini AI

v0.14.8 — Connectors & Installation

Released on 2026-05-28

Added

Built-in Bitbucket and Loki connectors.
Dedicated Connectors launcher and index page featuring search, category filtering, and connector instance status tracking.
Floating "Jump to latest" button and Ctrl+Down shortcut in the agent chat interface.
Universal install.sh and install.ps1 scripts, automatically scaffolded into new projects via wick init.

Improved

Documentation for the connector HealthCheck hook, OpHealth contract, and system disabling model.
CI workflows to upload raw Linux binaries alongside Debian packages to support dpkg-less environments.

Fixed

Chat panel auto-scroll behavior to avoid yanking the viewport down while users are actively reading history above.

This summary was automatically generated by Gemini AI

v0.14.7 — OpenAI REST API

Released on 2026-05-25

Added

Full OpenAI-compatible REST API surface, including the new /integrations/rest/api/v1/openai/responses and /integrations/rest/api/v1/openai/models endpoints.
Live model validation against active providers, returning standard OpenAI-formatted 404 error responses for unknown model IDs.
Per-session in-flight locks returning a 409 Conflict status on concurrent requests within the same conversation.
Rewritten documentation panel featuring three dedicated tabs for Chat, Responses, and Models.

Improved

Standardized the chat completions endpoint path to /integrations/rest/api/v1/openai/chat/completions.
Switched from session_id to the standard conversation key for tracking sessions across REST endpoints.
Gated the agents settings page (/tools/agents/settings) and sidebar navigation link to admin users only to secure sensitive configuration data.
Updated the REST developer guide and channels documentation table.

This summary was automatically generated by Gemini AI

v0.14.6

Released on 2026-05-25

Added

Slack Canvas connector operations.

Improved

Support for clickable file paths in agent chat markdown. File paths within the current workspace session open directly in the preview/edit modal, while paths outside the workspace display a raw path popup with a copy option.

Fixed

Database compatibility issue where stuck job runs failed to recover on SQLite due to Postgres-specific interval SQL syntax.
Issue where panic events or timed-out contexts prevented job status updates, ensuring cleanup tasks execute properly to prevent runs from remaining permanently stuck in a "running" state.

This summary was automatically generated by Gemini AI

v0.14.4 — Realtime Storage Sync

Released on 2026-05-25

Added

Real-time filesystem watcher based on fsnotify that monitors storage sources dynamically and updates kernel watch sets immediately upon configuration changes.
Configurable watcher settings including watcher_status (enabled by default) and watcher_debounce_ms (defaults to 1000ms).

Improved

Redesigned the storage backup mechanism to stream files via WalkDir and io.Copy into constant-memory SHA-256 hashes, loading full contents only when database writes are required.
Integrated debounce logic to collapse rapid editor save events into a single sync operation.
Streamlined deletion handling by directly removing database rows on file removal or rename events.

Fixed

Resolved out-of-memory (OOM) container crashes on large directory trees by replacing the memory-intensive polling map serialization with streaming sync.

This summary was automatically generated by Gemini AI

v0.14.3 — AI Agents

Released on 2026-05-25

Added

Live text streaming and thinking deltas for Claude and Codex in the web UI.
Backend-driven agent lifecycle state machine exposed via Server-Sent Events (SSE).
Crash-recovery mechanism for active sessions using provider-agnostic inflight.jsonl logging.
Collapsible Context file panel to view, edit, download, and preview (Markdown/HTML) files in the agent's working directory.
Automatic chat composer focus triggered by typing anywhere on the session detail page.

Fixed

Incorrect dark-mode background rendering on trace cards.
Double-broadcasting of agent exit events in the connection pool.

Improved

Agent documentation covering provider features, SSE channel schemas, and file sandbox security.

This summary was automatically generated by Gemini AI

v0.14.2 — MCP Improvements

Released on 2026-05-23

Added

db_type and db_status fields to the wick_info MCP tool to allow clients to securely monitor database connection status without exposing sensitive credentials.
An environment variable allowlist (WickEnvVars) for MCP installation in Codex CLI to ensure runtime environment variables are preserved.

Fixed

Bug where the agent provider cache was not refreshed after switching providers.

Improved

Centralized database status derivation and consolidated WickInfo tests directly within the handlers package.

This summary was automatically generated by Gemini AI

v0.14.1 — Job & Skill Management

Released on 2026-05-22

Added

Job timeout configuration (MaxTimeoutMin field, defaulting to 30 minutes) with automatic context-based cancellation.
Startup bootstrap routine to reset stuck job runs that have exceeded their timeout threshold.
User interface option to configure max_timeout_min in job settings.
Detailed tracking for provider storage sync jobs, displaying changed and skipped file counts per source.
MCP handler modularization under a new handlers/ subpackage, introducing wick_skill_list and wick_skill_sync tools.
Skills Manager documentation in the agents guide.

Fixed

Test suite compilation by updating SyncOne caller signatures to match the new return structure.

Improved

Updated system prompts.

This summary was automatically generated by Gemini AI

v0.14.0 — Skills Explorer

Released on 2026-05-22

Added

Integrated a new skillsync package to mirror skill files across provider directories (~/.claude/skills, ~/.codex/skills, ~/.gemini/skills, and ~/.agents/skills) using modification times instead of symlinks.
Added a Skills explorer page in the agents sidebar with clickable rows, subfolder navigation, and a kebab menu for syncing, downloading, and deleting skills.
Introduced provider-scoped views with a tab switcher to compare the same skill file across different providers.
Added Markdown preview rendering on the skill file detail page.
Added a CancelJob capability to the job manager via POST /manager/jobs/{key}/cancel.

Improved

Refactored the provider storage sync job to remove RestoreAll from the cron tick and added a 60-second hard timeout with error reporting.

This summary was automatically generated by Gemini AI

v0.13.5

Released on 2026-05-22

Fixed

Fixed a workspace bootstrap fatal error that occurred when a workspace directory existed without a meta.json file, by aligning the duplicate check in Create to check for WorkspaceMeta.

This summary was automatically generated by Gemini AI

v0.13.4 — Agents & MCP Updates

Released on 2026-05-22

Added

Provider switching capabilities across channels using the #provider prefix command.
An agentctl Unix socket for interacting with the running daemon pool from MCP stdio.
Granular, per-instance sandbox modes (read-only, workspace-write, and danger-full-access) for Codex configurations.
Verbose per-file logging toggle and run ID correlation for provider-storage sync and restore runs.
A new system_turn SSE event and UI handler to append system turns during agent interactions.

Fixed

Missing builtin connectors (Slack, GitHub, and HTTP/REST) on downstream MCP stdio deployments by registering them prior to bootstrap.
Hidden connectors requiring setup from showing up in wick_list and wick_search.
Codex MCP auto-install config format errors, uninstall persistence issues, and re-installation behavior.
Tool result tracking to correctly extract MCP result text from content arrays and forward it via SSE.
Codex parser error handling, ensuring non-JSON lines are output as Thinking events instead of failing.

Improved

Split the immutable system prompt into distinct global, Claude-specific, and Codex-specific variants.
Optimized provider-storage file syncs by performing pre-upsert hash checks to skip unchanged files.

This summary was automatically generated by Gemini AI

v0.13.3 — Interactive Workflow Builder

Released on 2026-05-21

Added

Added interactive inspector panels for branch, end, shell, transform, classify, and database query workflow nodes.
Added click-to-add functionality for canvas nodes from the palette as a reliable alternative to drag-and-drop.
Added interactive filter condition, row, and order-by builders, alongside table and column selectors, for datatable nodes.
Added a /stream/snapshot JSON endpoint to replay agent lifecycle and trace events on page refresh.

Fixed

Fixed agent idle-kill timeout by pausing the idle timer during long-running tool executions.
Fixed rendering of datatable nodes (which previously fell back to shell nodes) and resolved label and expression mode persistence issues.
Fixed database persistence for datatable_create and datatable_insert by wiring the PgService to the MCP stdio service.
Fixed provider storage boot restore and upload retag issues.
Fixed canvas stacking context issues by adjusting the palette drawer position.

Improved

Overhauled the datatable node UI with grouped palette entries, a column combobox, and Fixed/Expression toggle previews.
Improved agent trace replay on page refresh by utilizing SharedWorker to fetch current state snapshots.
Streamlined the node palette by removing duplicate hardcoded entries in favor of registry-backed module registration.

This summary was automatically generated by Gemini AI

v0.13.2 — Provider Storage

Released on 2026-05-20

Added

UI actions to download individual files and download folders as .zip files.
Support for dismissing modals via backdrop click or the Escape key.

Fixed

Storage boot sequence to overwrite disk from the database using RestoreAllForce and remove redundant SyncAll operations.
Cron sync execution flow to run a guarded RestoreAll before SyncOne so missing files are refilled prior to capture.
Upload routing to auto-retag files to the deepest covering enabled source, ensuring manual uploads are assigned to the correct provider and instance to maintain restorability.

Improved

Explorer upload modal to be contextual, displaying a target path banner and requiring only the filename.

This summary was automatically generated by Gemini AI

v0.13.1 — Data Tables

Released on 2026-05-20

Added

High-performance Data Tables system featuring a Postgres-backed JSONB schema, auto-incrementing row IDs, system columns, and 9 matching Model Context Protocol (MCP) operations.
n8n-style spreadsheet grid UI for managing Data Tables, featuring column-sorting, a 10-operator filter popover, CSV import/export, and inline column management.
Seven dedicated database nodes in the workflow canvas palette (datatable_*) for querying, counting, inserting, upserting, and deleting records.
Split-bottom editor panel containing a dedicated "Validation" tab to display real-time Go template syntax check results.
Server-Sent Events (SSE) reconnect status pill in the session header to visually surface EventSource connection states.

Fixed

Fixed binary builds to correctly compile the app name and version via LDFLAGS variables instead of falling back to "dev".
Fixed an issue in manual triggers where saving a human-readable button caption overrode the unique validation slug label.
Fixed drawflow canvas deletion clicks by exempting the .drawflow-delete X chip from the marquee background selection handler.
Fixed editor node metadata mapping to properly handle underscore-separated trigger names (e.g., trigger_manual).

Improved

Transitioned workflow node and trigger IDs to internal UUIDs while maintaining clean, cascading, user-facing label slugs.
Replaced full-page reloads on workflow manual saves with smooth background POST requests that preserve canvas state, scroll positions, and SSE connections.
Split the workflow validation pipeline into lenient draft saves and strict publish-blocking checks that highlight syntax errors in the Validation panel.
Enhanced agent chat UI to automatically linkify URLs, apply overflow wrapping on long links, and systematically instruct AI models to wrap URLs in Markdown link syntax.

This summary was automatically generated by Gemini AI

v0.13.0 — Agent Workflows

Released on 2026-05-19

Added

Comprehensive workflow engine and canvas-based editor for agent orchestration.
Support for multiple trigger types including Cron schedules, Webhooks, Slack events, and Manual execution.
n8n-style debug modal featuring real-time SSE run progress, execution step isolation, and input/output inspection.
Draft/Publish lifecycle allowing users to test unsaved changes before deploying to production.
Run replay functionality to visualize historical executions and debug payload data directly in the editor.
Interactive "Fixed/Expression" toggle for node arguments with drag-and-drop support from the input pane.
Advanced canvas UX features: alignment snapping, marquee selection, multi-node dragging, and fit-to-view.
Sharded run index for high-performance history lookup and storage.
Multi-level palette drawer built dynamically from the live connector and channel registry.
Inline-chip multi-select picker for trigger filtering with support for ID lookup and bulk pasting.

Fixed

Resolved an issue where trigger fan-out edges were lost during workflow save and reload cycles.
Fixed a bug preventing the toggling of workflows that contained validation errors in their draft state.
Closed three security bypass vectors in the gate loader: enforced socket guards, relative path scope resolution, and quote-aware command tokenization.
Fixed UI overlap where empty state placeholders appeared on top of populated data panes.
Corrected trigger hint labels on canvas cards to accurately reflect channel and event types.

Improved

Migrated the node argument inspector to use shared fieldtype widgets for consistent UI across the platform.
Refactored the Slack integration into a modular, file-based architecture for better extensibility.
Enhanced the workflow router with a trigger index for O(1) event dispatching.
Optimized canvas rendering by moving the palette drawer to a transform-based overlay, preventing layout reflows.
Structured documentation into a multi-part roadmap and design specification.

This summary was automatically generated by Gemini AI

v0.13.0 — Workflows

Released on 2026-05-19

Added

Workflows — multi-step YAML DAG automations under <BaseDir>/workflows/<id>/, with typed nodes (classify, agent, connector, channel, http, shell, db_query, transform, go_script, branch, switch, parallel, merge, datatable_*, session_init, end) and triggers (cron, channel, webhook, manual, schedule_at, error). See Workflows guide.
Canvas editor at /tools/agents/workflows/<id> — Drawflow-based visual editor with palette, per-field inspector reflected from each executor's Describe(), top-down auto-layout, marquee select, fit-to-view, node search (Ctrl+K), and a run timeline that replays each run node-by-node.
MCP workflow surface — self-documenting catalog (workflow_list, workflow_describe, workflow_node_types, workflow_node_detail, workflow_diagnose, workflow_watch, workflow_scaffold, workflow_connect, workflow_patch, workflow_delete) so LLMs can author and inspect workflows over MCP.
Slack channel actions as workflow nodes — send_message, add_reaction, open_dm, open_modal, push_modal, update_modal, send_ephemeral, publish_home, respond_url, update_message — plus typed event triggers (event_message, event_app_mention, event_command, event_block_action, event_view_submission, event_shortcut, event_app_home_opened, event_view_closed).
Gate umbrella policy — GateConfig now carries PermissionMode (per-tool prompts) + AskUserMode (MCP ask_user) sub-policies. Master switch snaps both to their unguarded defaults when off. MCP ask_user short-circuits with a clean tool error when disabled instead of stalling the run. See Command Gate ▶ Umbrella policy.
Slack OAuth on the connector row — global OAuth credentials moved to a Slack connector row with a "Connect with Slack" button; user-token auto-detected in buildSessionContext; DM via connector user token with signed footer.
Live agent streaming trace — tool calls, thinking, and history are streamed into the session detail page in real time.
MCP provider UI + session full-height layout + markdown table rendering.
Provider-storage sync — exclude-mode rows, glob matcher, folder cascade, retention recompute, repair tree.
Loki push adapter for async run events.
Self-updater + build metadata baked into wick_info.

Changed

Workflow slug field renamed to id across the codebase.
Channel config layer — manual field mapping replaced with MapToStruct; decryptFn callback removed from GetChannelConfigMap; wick_cenc_ tokens decrypted in-place; channel configs hidden from settings page and encrypted at rest.
Gate AppName derives from the binary stem only when it ends in -gate, otherwise the ldflag is the single source of truth.

Fixed

Slack bot replies no longer carry a duplicate signed footer (only sendHandler signs).
Slack cannot_dm_bot — detect bot users before calling conversations.open.
Slack: post with xoxp token without overriding the username, so the real user identity is preserved.
Slack: auto-promote U... channel IDs to target_user_id for session headers; init userTokenCache and pre-build the token map at startup.
Canvas: reject duplicate edges in Connect; guard against deleting the entry node.
wick_info uses the baked app name instead of the cwd basename.
Provider-storage: strings.ReplaceAll for cross-platform backslash normalisation.

Migration notes

The legacy agents.bypass_permissions checkbox is gone. Its value is one-shot migrated to gate.permission_mode at boot — no operator action required.

v0.12.2 — Release Infrastructure

Released on 2026-05-14

Added

Automated self-updater configuration using baked-in repository metadata in the installer build.

Fixed

Build failure on darwin/arm64 by enabling CGO for systray Objective-C bindings.

Improved

CI pipeline visibility through per-target status gates and detailed run summaries for disabled targets.
Release process robustness by allowing artifact attachment during partial-success matrix builds.

This summary was automatically generated by Gemini AI

v0.12.1 — Darwin Release

Released on 2026-05-14

Fixed

Resolved an issue with the release process for Darwin platforms.

This summary was automatically generated by Gemini AI

v0.12.0 — Agent Orchestration

Released on 2026-05-14

Added

Preset support for agent sessions, allowing system prompts to be loaded from local files on spawn.
Global system prompt configuration to append organization-wide instructions to every agent preset.
Idle subprocess preemption to immediately free pool slots for queued sessions when the agent pool is full.
all CLI command to run the HTTP server and cron scheduler within a single process.
Visual status indicators and badges to represent queued states in the sidebar and session list.
Manual triggers for provider storage synchronization in the settings UI.

Improved

User messages are now persisted to disk immediately upon sending to ensure visibility while sessions are queued.
Queue deduplication per session and agent to prevent redundant entries in the queue panel.
Background preemption logic now retries every second while the queue is non-empty.
UI layout for Settings and Channels pages expanded to full width with improved clickable surfaces for channel cards.
Application name resolution in default system prompts to support correct file paths in branded builds.
Automatic provider storage restoration from the database when booting standalone worker nodes.

Fixed

Database migration logic.

This summary was automatically generated by Gemini AI

v0.11.15

Released on 2026-05-13

Fixed

Restored non-root user and home directory configuration in the Dockerfile.
Fixed unit test failures.
Resolved database migration issues.

Improved

Added inline documentation and annotations to Dockerfile build and runtime stages.
Pinned the wick installation to the version specified in go.mod for more predictable builds.
Refined sidecar naming logic by deriving the gate binary stem from the configuration output.

This summary was automatically generated by Gemini AI

v0.11.14

Released on 2026-05-13

Fixed

Corrected content provider storage type handling.
Resolved database migration issues.

Improved

Synchronized go.mod templates and documentation.

This summary was automatically generated by Gemini AI

v0.11.13

Released on 2026-05-13

Fixed

Resolved build artifact generation issues.
Reverted CI/CD workflow and Dockerfile configurations to restore build stability.

This summary was automatically generated by Gemini AI

v0.11.12

Released on 2026-05-13

Fixed

Resolved issues with build artifacts.

This summary was automatically generated by Gemini AI

v0.11.11

Released on 2026-05-13

Fixed

Resolved build artifact issues by removing unnecessary caching.

This summary was automatically generated by Gemini AI

v0.11.10

Released on 2026-05-13

Fixed

Resolved issues with build artifact generation.

This summary was automatically generated by Gemini AI

v0.11.9

Released on 2026-05-13

Added

New wick init command for project initialization.

Fixed

Issues related to build artifact generation.

This summary was automatically generated by Gemini AI

v0.11.8

Released on 2026-05-13

Fixed

Build artifact generation issues.

This summary was automatically generated by Gemini AI

v0.11.7

Released on 2026-05-12

Improved

Optimized the build release caching process.

Fixed

Resolved issues related to build artifacts.

This summary was automatically generated by Gemini AI

v0.11.6

Released on 2026-05-12

Fixed

Added the Go bin directory to the PATH in the binary build process to ensure the templ tool is correctly located and accessible.

This summary was automatically generated by Gemini AI

v0.11.5 — CI/CD Optimization

Released on 2026-05-12

Added

New ci-timing.sh script for workflow performance and timing analysis.

Fixed

Issues with build artifact generation.

Improved

Optimized release workflows by building the wick CLI once and sharing it as an artifact across build-binaries and build-docker jobs.
Implemented binary caching for wick and templ in CI and pull request test workflows.
Added caching for wixl via apt cache to reduce workflow runtimes.
Configured separate wick CLI caching for macOS jobs to support cgo runners.

This summary was automatically generated by Gemini AI

v0.11.4 — Agent Hosting

Released on 2026-05-12

Added

New "agents-only" quickstart guide covering system tray, headless modes, binary downloads, and Docker/Compose configurations.
Comprehensive contribution guide including a commit style guide, build instructions, and repository structure mapping.
Two-use-case framing to documentation to distinguish between the development framework and agent-host functionality.

Fixed

Issues with build artifact generation.

Improved

Documentation hero section and README tagline for better clarity on project use cases.
VitePress sidebar and navigation organization to incorporate new agent-focused content.

This summary was automatically generated by Gemini AI

v0.11.3

Released on 2026-05-12

Fixed

Corrected issues with build artifact generation.

Improved

Optimized CI pipeline to initialize projects from tags and share scaffolding via artifacts.
Removed the mockery dependency.

This summary was automatically generated by Gemini AI

v0.11.2

Released on 2026-05-12

Fixed

Resolved issue where build-docker and build-binaries jobs failed to checkout from the correct tag reference.
Fixed build artifact generation process in CI workflows.

Improved

Optimized CI pipeline to run pull request tests only when Go or templ files are modified.

This summary was automatically generated by Gemini AI

v0.11.1

Released on 2026-05-12

Fixed

Resolved an issue with build artifact generation.

Improved

Upgraded Go version to 1.25.0 in project templates.
Removed Mockery dependency from the codebase.

This summary was automatically generated by Gemini AI

v0.11.0 — Storage & TTY Support

Released on 2026-05-12

Added

Provider Storage Manager tool featuring explorer and flat list modes, sync source auto-detection, and background synchronization jobs.
New providersync package and database entities for provider storage and sources.
Comprehensive documentation and user guides for Provider Storage and Web Terminal.
Automated release-artifacts CI workflow for binary and Docker builds.
Upgrade checks for Dockerfile wick versions with interactive update prompts.

Fixed

Connectivity issues related to TTY.
Upgrade prompt behavior to default to "yes" [Y/n].

Improved

Dockerfile runtime base switched to debian:bookworm-slim to support glibc requirements for the Claude CLI.
Integrated Gotty cross-compiled binaries and Claude CLI into the standard Docker image.
Added non-root app user with sudo privileges for secure credential management.
Integrated app-gate sibling binary into the application runtime image.

This summary was automatically generated by Gemini AI

v0.10.2

Released on 2026-05-12

Added

Hijack functionality.
Additional logging for improved diagnostics.

Fixed

Unit test failures.

Improved

TTY handling and configuration.

This summary was automatically generated by Gemini AI

v0.10.1 — Command Gate Enhancements

Released on 2026-05-12

Added

Web Terminal tool with HandleRaw router support.
Red and amber color tokens to UI for gate-related components and banners.
Automatic injection of .claude/settings.local.json during workspace creation and switching.

Fixed

Command gate interactions including the X button, click-outside behavior, and Block button rendering.
Logic for timeout auto-blocking and Telegram notification deletion on resolution.
Workspace hook injection and GateBinLoader wiring in the server.

Improved

Expanded command gate interception scope to include Bash, file tools, and MCP tools using a catch-all matcher.
Refined tool approval workflow with auto-allow logic for workspace-scoped file tools and interactive approval for unknown tools.
Documentation for command gate intercept scope and approval mode labels.

This summary was automatically generated by Gemini AI

v0.10.0 — Channels & Slack Integration

Released on 2026-05-12

Added

OpenAI-compatible REST channel supporting both stateful and stateless sessions via Personal Access Tokens.
Built-in Slack connector featuring 15 operations for message management, reactions, and lookups.
Health check framework for connectors and integrations to validate API permissions and connectivity.
SharedWorker-based SSE implementation to maintain persistent agent connections across page navigations.
Searchable picker UI component for granular Slack entity selection (users, groups, and channels).
Assistant API integration for Slack including "is thinking" status banners and thread-based activity signals.

Improved

Redesigned chat composer featuring an overlay style with inline provider and workspace switchers.
Session performance through persistent cache probing and in-memory metadata label caching for faster sidebar rendering.
Slack access control logic supporting complex whitelist combinations for users, groups, and channels.
Channel management interface with theme-aware documentation, configuration cards, and sample code blocks.
Refined Slack UX by deferring queued reactions and removing redundant status emojis.
Session detail layout with approvals moved to a dedicated tab for better space utilization.

Fixed

Encrypted fields tool now defaults to private visibility to ensure authenticated access.
Claude settings injection narrowed to project-scope to avoid affecting global machine configurations.
Session history and provider dropdown loading delays.
CSS layout issues causing scrollbar flashing on session detail pages.
SSE connection timeouts by removing server-side deadlines and sending immediate connection headers.

This summary was automatically generated by Gemini AI

v0.9.6 — Slack Mention Trigger

Released on 2026-05-11

Added

Support for app_mention events in public and private Slack channels.
The app_mentions:read scope to the application manifest.

Improved

Slack message dispatching logic to require explicit mentions in channels while maintaining direct passthrough for DMs.
Automatic stripping of the <@BOTID> prefix from mention events before dispatching to the message handler.
Application manifest configuration by replacing broad channel and group message event subscriptions with targeted app mentions.

This summary was automatically generated by Gemini AI

v0.9.5 — Multi-Provider Command Gate

Released on 2026-05-11

Added

Multi-provider support for Command Gate with per-provider capability detection for Claude, Codex, and Gemini.
Global Command Gate master switch that cascades state changes to all configured provider instances.
Per-instance hook configuration allowing granular opt-in/opt-out for tool execution gating.
Asynchronous capability probing system with UI status badges for verified, testing, and unverified states.
Support for --probe-deny and provider-specific flags in the gate command to verify capability layer enforcement.
Capability registry for self-registering provider hooks and runtime probe verification.

Fixed

Enforced mutual exclusivity between Command Gate and Permission Bypass mode to prevent conflicting behaviors.
Added missing runtime imports to ensure Codex and Gemini providers correctly self-register for capability lookups.
Replaced native title tooltips with theme-aware custom tooltips that respect dark and light modes.
Removed duplicated Command Gate descriptions across provider cards to clean up the interface.
Resolved a regression where Claude would ignore deny envelopes when specific permission flags were set.

Improved

Implemented an in-memory instance cache for providers to eliminate redundant disk reads during agent spawning.
Refactored the spawner factory to dispatch by ProviderType, enabling cleaner integration of future providers.
Optimized CI workflows to skip PR tests when targeting the release branch.
Updated technical documentation for Command Gate architecture, adapter patterns, and channel integration guides.
Enhanced the provider UI to display "locked (bypass)" states when permissions are globally bypassed.

This summary was automatically generated by Gemini AI

v0.9.4 — Channels & Command Gate

Released on 2026-05-10

Added

Per-transport subpackages for Slack and Telegram integrations to improve modularity.
New agent-channel-module skill to enhance agent capabilities.
Diagnostic "Test gate" button on the Providers page to verify command gate enforcement.
--probe-deny subcommand for the gate binary to detect contract drift in production.

Fixed

Command gate compatibility with Claude Code 2.1.138+ to prevent silent permission bypass.
Issue where the gate failed to block sessions due to incorrect exit code and stdout handling.
Sandbox blocking of approved tools by ensuring explicit allow signals are emitted to the permission system.
Permission mode conflict where --permission-mode bypassPermissions was incorrectly forced when a gate was attached.

Improved

Refactored channel infrastructure into a modular root registry with dedicated subpackages.
Streamlined transport registration and setup using a centralized composer.
Enhanced context for new chat threads by injecting session-specific turns for first messages.
Updated the Command Gate rejection contract to utilize exit-0 with specific JSON output for reliability.
Renamed the Command Gate modal action from "Block" to "Reject" for better clarity.
Migrated the Slack application manifest to JSON format.
Updated documentation to reflect 2.1.x compatibility, failure modes, and new testing tools.

This summary was automatically generated by Gemini AI

v0.9.3

Released on 2026-05-10

Added

GitHub Actions workflow to run unit tests on all pull requests.

Fixed

Crash in wick.yml tasks when using plain run blocks without background execution flags.
Template version mismatch during build processes.
Data races in the provider agent and pool worker logic identified during concurrent testing.
Permission denied errors during test cleanup on Linux caused by read-only module cache files.
Various broken unit tests across Slack channels, CLI doctor command, and gate manager integration.

Improved

Task execution now utilizes a real POSIX shell (or Bash on Windows) to support multi-line scripts, pipes, and command substitution.

This summary was automatically generated by Gemini AI

v0.9.2

Released on 2026-05-10

Fixed

Resolved application crashes.
Pinned templ CLI to the version specified in go.mod to ensure consistent release builds.

This summary was automatically generated by Gemini AI

v0.9.1 — AI Agents

Released on 2026-05-10

Added

Slack app manifest for the Wick agent bot.
Comprehensive documentation for AI Agent workspaces, providers, channels, and pools.
Detailed guide for Command Gate architecture, covering IPC, auditing, and the wick doctor utility.
Reference documentation for gate sidecar bundling.

Fixed

Connector registration idempotency on Meta.Key to ensure stability across server restarts.
Critical application crash in the core service.

Improved

Documentation structure to highlight AI Agent features across Slack, Telegram, and Web.
Environment variable management, removing deprecated GATE_ prefixes.
Release workflow automation to synchronize headlines within the changelog.

This summary was automatically generated by Gemini AI

v0.9.0 — AI Agents

Released on 2026-05-10

The headline release: wick can now host AI coding agents — Claude, Codex, Gemini — as long-lived subprocesses, reachable from Slack threads, Telegram chats, and the web UI at the same time. Per-command Command Gate intercepts every Bash call. Multi-instance providers (two PATs, side-by-side). Workspaces on disk. AskUser MCP tool. State persisted under ~/.<app>/agents/ — backup is tar, restart re-scans.

Plus: a generic HTTP connector, a GitHub connector, per-connector rate-limiting and per-operation access control, wick doctor, and a /metrics endpoint.

Added — AI Agents subsystem

Multi-channel routing. Slack (Socket Mode default + HTTP Event API), Telegram (long polling with inline-keyboard approvals), and the always-on web UI at /tools/agents. Each thread / chat / conversation = one wick session, automatically created on first message. See AI Agents and Channels.
Multi-session subprocess pool. Slot cap (default 2), FIFO queue, idle-kill (default 120s), --resume <cli_session_id> revive. Per-session message buffer survives wick restart via meta.PendingInput. See Pool & Sessions.
Workspaces. Folders on disk used as the agent's cwd — managed at ~/.<app>/agents/workspaces/<name>/files/ or any custom absolute path. Multi-session sharing without locks. Built-in default workspace seeded on fresh install. See Projects.
Multi-instance providers. claude/work + claude/personal with different PATs. Per-instance binary override, extra args, env vars, disabled toggle. Persistent status cache with manual / 24h-stale / boot-prime rescan. Page render never blocks on --version. See Providers.
Binary scan. --version lookup walks registry → PATH → known install locations (npm prefixes, nvm, fnm, volta, asdf, Homebrew, MacPorts, Claude / Codex installer paths). Closes the gap between tray-launched wick (Explorer PATH) and shell PATH.
Console hiding on Windows. Tray-spawned claude.exe / codex.exe / npm shims no longer flash a console window — CREATE_NO_WINDOW applied to provider probe + spawn paths.
Command Gate. Sidecar binary <app>-gate intercepts every Bash command via Claude's PreToolUse hook. Whitelist via glob, escalate to interactive approval modal with 4 modes: approve_once / approve_session / approve_always / block. Approval surfaces in whichever channel the conversation lives in (web modal, Slack approval message, Telegram inline keyboard). 25-second daemon deadline (under Claude's 30s hook timeout). See Command Gate.
Gate IPC. Unix domain socket at ~/.<app>/agents/gate/gate.sock, raw newline-delimited JSON, chmod 0600. Single shared spec / socket / audit log per app — daemon routes approvals to the right session by matching the hook's cwd against known workspace paths.
Gate audit. Multi-stage entries to ~/.<app>/agents/gate/commands.jsonl (received → socket_dial → socket_sent → socket_recv → terminal), all tied by RequestID. Plus a human-readable daily tail log at ~/.<app>/logs/gate-YYYY-MM-DD.log.
Gate binary resolution — zero env vars. Sibling-of-executable (<app>-gate[.exe] next to the main binary, shipped by wick build --installer) → embedded //go:embed extract → PATH. WICK_GATE_BIN / GATE_BIN / WICK_GATE_SPEC / GATE_SPEC all dropped.
Installer ships the gate sidecar. Windows MSI ships <App>-gate.exe, Debian .deb ships /usr/bin/<app>-gate, macOS .app bundle ships Contents/MacOS/<App>-gate. Builder absorbs the gate compile step (no separate CI job); soft-skips on downstream forks without cmd/gate/.
AskUser MCP tool. Agent-initiated mid-turn question — wick registers the question, broadcasts SSE, blocks the MCP call, surfaces an inline card in the web UI composer. Default 5min timeout. Works in pipe mode (-p) where Claude Code's harness AskUserQuestion doesn't.
Provider spawn log. Per-spawn JSONL at ~/.<app>/agents/providers/spawns/<type>__<name>__<session>__<unix-ms>.jsonl with start (PID, argv, binary, first user message) and exit events. ls-friendly filter without reading file bodies.
Slack channel. Reaction lifecycle (⏳ → ⚙️ → ✅ / 🚫 / ❌), chunked replies at 3800 chars (under Slack's 4000 hard limit), access control (everyone / users / groups) checked per-message, hot-reload on 30s config poll, pool.OnSessionCreated hook so dashboards see new sessions immediately.
Telegram channel. Long polling, dormant-mode on missing/invalid token, inline-keyboard approvals with short-token mapping (Telegram's 64-byte callback_data limit), edit-in-place approval message on resolve.
Meta-commands intercepted in every channel before dispatch: /agent <name>, /reset, /status, /dashboard (/link), /log. Both / and ! prefixes accepted.
wick doctor [binary] diagnostic. Verifies environment + gate setup. Pass a binary path to inspect a specific branded build — derives its AppName, locates the matching <app>-gate sidecar, dials the socket with a probe request that auto-replies without bothering a human, verifies socket / spec paths align.
AppName single source of truth. internal/appname.Resolve() is the only chain: BuildAppName ldflag → wick.yml name: → "wick". APP_NAME env is now a display label only (~/.<app>/ namespace stays slug-safe). Gate binary derives <app> at runtime from its own filename (strip -gate[.exe]), so a branded wick-lab-gate.exe lands in ~/.wick-lab/agents/gate/ automatically.

Added — Connectors

Generic HTTP/REST connector for calling JSON APIs with configurable authentication and methods.
GitHub connector supporting repository listing, issue management, file retrieval, and pull request tracking.
Per-operation access control restricting specific connector operations to administrators.
Sliding-window rate limiting per connector with admin UI for quota tuning.
Cross-connector audit log API and admin UI for monitoring run history and status across all connectors.
/metrics endpoint (Prometheus-compatible) for connector execution telemetry and latency.
pkg/conntest helper package to simplify unit testing for custom connector authors.

Fixed

Updater reliability on Windows and Linux: verify post-install state, use a detached helper script to swap binaries, prevent partial installs.
Agent pool race on Windows. markStatus(idle) now runs before releaseSlot (pool.go:378) so a fast Send arriving right after Active==0 cannot collide its meta.json write with the trailing idle write (two os.Rename to the same target). Killed flaky TestPipeline_ResumeAfterIdleKill + TestQueueWhenPoolFull.
Double-spawn / slot-count race. Pool now tracks an in-flight spawningKeys set; concurrent Send calls cannot each see "slot free" and call spawn simultaneously. Same guard prevents two exit hooks from popping the queue at the same time.
SSE delivery & flush. Switch to ResponseController for proper chunked flushing in the agent dashboard. Larger subscriber buffer + dropped-message logs.
Agent kill-on-respond + SSE timeout. Lifecycle FSM now correctly distinguishes "still responding" from "idle" so the kill timer doesn't fire mid-response.
Bypass permissions logic. --permission-mode bypassPermissions is now passed to Claude only when a gate is wired (allowed_cmds non-empty), preventing permission-less Slack sessions.
Gate hook injection. Hooks injected via Claude's user settings.json (per-spawn --settings flag), with fail-open behavior when no socket is present so the agent can still start during gate setup.
Configs back-fill. Empty config rows now back-fill from seed defaults instead of leaving the value blank — fixes "field is blank after upgrade" reports.
Server banner now shows the configured app_url and logs host mismatches during 403 rejections (was logging the bare listen address).
Lab / CLI request logs. Component-tagged logger correctly injected into the execution context — request lines no longer disappear in lab mode.

Improved

Claude parser + spawner aligned with real Claude 2.1.x. Verified against the live claude CLI's stream-json protocol and long-lived process lifecycle (multi-turn within one process, no respawn per message). Real-claude E2E test gated by WICK_CLAUDE_E2E=1.
Approval flow architecture. Two patterns of approval are now both available: system-intercept (gate, mandatory) and voluntary ask (AskUser MCP tool). Wick uses gate for security enforcement and AskUser for UX questions the agent decides to ask.
Workspace model rewrite. Replaced the project-centric model (1 project = 1 git repo, session = git worktree) with a workspace-centric model (folder shared across sessions, no git ops, custom paths supported). Fixes the "session without project fails to spawn" bug and matches how teams actually work — one folder full of stuff that several conversations touch.
Provider rename from "backend" — session.AgentEntry.Provider, pool.FactoryOptions.ProviderType/Name, userconfig.ProvidersConfig. Single package internal/agents/provider/ consolidating driver + spawner + per-instance config + spawn logger.
Registry split. RegisterBuiltins (default-on agents tools) vs RegisterLabSamples (lab-only); cmd/lab/ renamed to cmd/wick-lab/.
Multi-turn + multi-session integration tests via simulated spawners; 91 tests across 21 packages green at release.
Design docs synced to implementation for agent phases 1–7 (foundation, pool, gate, UI, providers, Slack, mid-session approval). Stage 9 follow-ups (env vars dropped, single shared spec/socket, installer-shipped sidecar) captured in command-gate-architecture.md.

Migration

No DB migration required — agent_channels, provider_statuses, and the gate spec/audit files are auto-created on first boot.

If you ship a downstream branded build, rebuild with the new wick build so the installer ships <app>-gate[.exe] next to the main binary. Without it the gate falls back to embedded extract on first use, which still works but loses the installer-managed sibling location. There is no env-var override (WICK_GATE_BIN / GATE_BIN were removed).

Curated for the v0.9.0 release.

v0.8.11

Released on 2026-05-07

Fixed

Resolved an issue where the application version was incorrectly baked during builds by aligning CI environment variables with the expected build flags.

Improved

Updated installer filenames to include version, operating system, and architecture details for better visibility and management.

This summary was automatically generated by Gemini AI

v0.8.10

Released on 2026-05-07

Fixed

Resolved an issue where the Windows updater failed to locate assets by switching from .exe to .msi format.
Fixed Windows silent installation failures by utilizing msiexec to ensure the update properly overwrites the existing installation.

Improved

Added diagnostic logging for Windows updates, saving logs to msiexec-install.log in the cache directory to aid in troubleshooting.
Updated the release template configuration.

This summary was automatically generated by Gemini AI

v0.8.9

Released on 2026-05-07

Added

Secure first-boot flow requiring password rotation and email setup upon initial login.
Automatic generation of a 5-word (CVCVC) admin passphrase stored in a secure local file.
"wickmanager" built-in connector providing 24 operations for managing app, job, tool, and connector configurations.
Host allowlist middleware to restrict HTTP requests to the configured application host.
OS toast notifications triggered upon system tray launch.
Auto-launch functionality for Windows systems after installation.
Tray menu items for quick access to initial credentials and the server URL.
Sensitive data redaction in logs for authentication and configuration endpoints.
Dedicated mcp.log for auditing management plane activities.

Fixed

Log file initialization on Windows to prevent 0KB log files when running without a console.
Windows pipe communication for MCP by replacing -H=windowsgui with dynamic console management, allowing 'mcp serve' to function correctly with external clients.

Improved

Migrated standard library logging to structured zerolog calls throughout the application.
Enhanced logging strategy to prioritize file output to ensure logs are captured in GUI environments.
Relocated application data storage to the user's home directory.
Refined process management lifecycle for server and worker components.
Build process feedback with status indicators for MSI and DMG packaging.
Documentation for environment variables, system tray usage, and secure-by-default workflows.

This summary was automatically generated by Gemini AI

v0.8.3

Released on 2026-05-06

Added

Installer-friendly artifact generation via the --installer flag, providing per-user .msi packages for Windows and .dmg drag-to-install images for macOS.
Automatic detection of MSYS2 environments on Windows to auto-register gemini-msys2, codex-msys2, and claude-code-msys2 configurations for MSYS2 shells.

Improved

Refactored MCP configuration to utilize a global ~/.claude.json user config instead of project-specific .mcp.json variants.
Standardized Windows installation paths to %LocalAppData%\Programs to ensure reliable self-updates and autostart functionality without requiring UAC elevation.

This summary was automatically generated by Gemini AI

v0.8.2

Released on 2026-05-06

Fixed

GitHub updater behavior to treat 404 errors as "no releases yet" instead of a hard error.
Build documentation.

Improved

Release workflow and GitHub Actions configuration by renaming environment variables to RELEASE_* prefixes to prevent reserved keyword collisions.
Updater security by obfuscating embedded GitHub Personal Access Tokens (PAT) using XOR and base64.
Logging architecture by splitting app, server, and worker logs into dated files and routing via zerolog.Ctx(ctx).
Log management functionality to open the logs directory instead of individual files to improve compatibility.

This summary was automatically generated by Gemini AI

v0.8.1

Released on 2026-05-06

Fixed

Documentation build configuration.

Improved

Automated build processes.

This summary was automatically generated by Gemini AI

v0.8.0

Released on 2026-05-06

Added

AUTO_VERSION repository variable to automate version bumping, tagging, and committing changes back to the repository during CI.
wick version next subcommand to increment the last numeric segment of the wick.yml version.
Windows executable metadata embedding, including brand icons, product descriptions, and version information.
Automatic bundling of binaries into platform-native distributables: .exe for Windows, .dmg for macOS (host-only), and .deb for Linux.
Support for multi-platform build targets using --target, --goos, --goarch, and --all flags.
Native self-updater support for extracting binaries from .dmg and .deb packages.

Fixed

Issue where the application would fail to launch from Windows Explorer due to Cobra's automatic CLI mousetrap check.
Console window flashing on Windows when triggering the "Open in editor" command.
Port collision issues by implementing synchronous pre-flight checks and reflecting failures directly in the tray menu.

Improved

Consolidated application logs, databases, and configuration files into the platform-specific UserConfigDir.
Redirected standard output and error streams to log files for Windows GUI builds to ensure diagnostic data is captured.
Replaced the global TCP-based single-instance lock with per-app PID files to allow different Wick-built applications to run concurrently.
Changed the default server behavior to opt-in, with auto_start_server now defaulting to false.
Refactored build orchestration into platform-specific modules to support better maintainability and future package formats.
Updated CI/CD release workflows and Docker multi-arch build templates to support native bundling.

This summary was automatically generated by Gemini AI

v0.8.0

Released on 2026-05-05

Added

AUTO_VERSION repository variable support to automatically bump versions in wick.yml and commit changes back to the repository.
wick version next subcommand to increment the last numeric segment of the application version.
Windows executable resource embedding to include brand icons and file metadata such as FileDescription, ProductName, and Version.
--bundle flag for wick build to generate native macOS .app bundles (including Info.plist and icons) and Linux .deb packages.
Automatic bundle identifier derivation based on the go.mod module path.

Fixed

Issue where Windows binaries failed to launch from Explorer due to the default CLI double-click guard.
Global single-instance lock conflict by replacing the fixed TCP port with a per-app PID file and liveness check.
Console window "flash" when opening editors on Windows by suppressing the command wrapper window.
Sample release workflow configuration.

Improved

Application data organization by consolidating logs, databases, and configuration files under a single UserConfigDir tree.
Windows logging by piping stdout and stderr to log files, ensuring output is captured for GUI-only builds.
System tray server management with synchronous port collision pre-flight checks and inline failure reporting in the menu.
Sample Docker configuration and release YAML files.
Documentation for CLI subcommands, single-instance locking mechanisms, and server default settings.

This summary was automatically generated by Gemini AI

v0.7.1

Released on 2026-05-05

Improved

Automated the generate task (templ, tailwind, and go generate) to run during wick build, streamlining CI workflows and minimizing project configuration.
Updated and synchronized documentation files.

This summary was automatically generated by Gemini AI

v0.7.0

Released on 2026-05-05

Added

System tray architecture for desktop applications, replacing the previous GUI implementation with a lightweight tray-based control center.
wick build subcommand to handle cross-compilation with automatic metadata injection for application name, version, and repository info.
Integrated self-updater for desktop binaries with support for GitHub Release tracking, SHA256 verification, and stepwise UI feedback.
OS-level autostart support for Windows (Registry), macOS (LaunchAgents), and Linux (XDG) via user-scoped configuration.
Automatic SQLite database path resolution that prioritizes environment variables, user config, or local binary paths.
CI/CD templates for GitHub Actions to automate version tagging and multi-platform release builds.
Headless build tag support to compile binaries without system tray dependencies.
Daily log rotation and retention management, storing logs in user cache directories.
Stateful tray icons that provide visual feedback on server and worker status.
"About" submenu in the tray displaying application version, framework version, commit hash, and build time.

Improved

SQLite concurrency performance by enabling Write-Ahead Logging (WAL) mode and busy_timeout settings.
Default application port changed from 8080 to 9425.
wick init process now automatically substitutes the project name into the generated wick.yml.
Task execution now respects double quotes in commands, allowing complex -ldflags to be passed during builds.
Single-instance lock mechanism using a local TCP port to prevent conflicting background processes.
MCP server identification now advertises the downstream application version rather than the framework version.
Expanded documentation for desktop tray architecture, build workflows, and environment variable references.

Fixed

Issue where task command parsing incorrectly split arguments containing spaces or quotes.
Database connection failures when running desktop binaries from arbitrary working directories.
Menu display errors where update status or PAT expiration feedback was not surfaced to the user.

This summary was automatically generated by Gemini AI

v0.6.4

Released on 2026-05-04

Fixed

Bind Stdio MCP context to a real admin identity to enable decryption of tokens in the web UI.
Resolved an error occurring during database migrations.
Updated generated template files.

Improved

Refined internal application workflows.

This summary was automatically generated by Gemini AI

v0.6.3

Released on 2026-05-04

Added

MCP instructions for wick_enc_.

This summary was automatically generated by Gemini AI

v0.6.2

Released on 2026-05-04

Improved

Automated the registration of encfields for all consumers by moving the registration logic into the package initialization.

Fixed

Resolved an issue where consumer applications lacked the /tools/encfields route, which previously caused wick_encrypt and wick_decrypt MCP redirects to fail.

This summary was automatically generated by Gemini AI

v0.6.1

Released on 2026-05-03

Added

At-rest encryption for configuration values tagged as secrets using a master-keyed system.
Per-field metadata for connector credentials, allowing for individual tracking of field types, requirements, and descriptions.

Fixed

Potential plaintext credential leaks in connector error messages and audit logs through a centralized masking interface.
Data leak paths where decrypted tokens could be passed into non-secret fields.

Improved

Connector configuration architecture, migrating from a single JSON blob to a normalized per-field storage schema for better queryability and performance.
Database migration logic to automatically backfill legacy connector configurations into the new centralized configuration table.
Secret field handling in the UI to allow keeping current values when input fields are left blank.

This summary was automatically generated by Gemini AI

v0.6.0

Released on 2026-05-03

Added

Implemented an encrypted-fields layer using AES-256-GCM and per-user HKDF salts to secure credentials flowing between LLMs and connectors.
Introduced wick_enc_ tokens to ensure credentials issued for one user cannot be decrypted by another.
Added automatic decryption of input configurations and masking of sensitive plaintext in connector responses and audit logs.
Created a security-tagged tool at /tools/encfields for manual JSON-based encryption and decryption.
Added wick_encrypt and wick_decrypt MCP tools that redirect to the UI for secure processing.
Introduced the encrypted-fields skill, embedded into the binary for propagation via wick skill sync.
Added Mask and MaskIgnoreCase methods to connector.Ctx to allow connectors to mask sensitive data dynamically.
Integrated encryption key bootstrapping with support for auto-generation and WICK_ENC_KEY environment overrides.

Improved

Refined the encryption API by splitting MaskSensitive into Mask and MaskIgnoreCase to improve call site clarity and eliminate boolean traps.
Updated the sample connector and crudcrud template to demonstrate response masking for secret keywords and ignore-case configurations.
Enhanced system documentation, including a new reference page for encrypted fields and updated guides for MCP and connector modules.
Updated AGENTS.md and skill labels to include and cross-link the new encryption capabilities.

This summary was automatically generated by Gemini AI

v0.5.6

Released on 2026-05-03

Added

New config-tags skill as a standalone, single source of truth for configurations.
Automatic injection of config-tags alongside design-system during wick init.
Support for config-tags in wick skill sync and wick skill list commands.

Fixed

Issue where wick:"default=..." seed values were not applied when Go fields were zero.

Improved

Chart functionality with the implementation of limits.
UI for default and secret fields, including masking set values with bullet characters.
Module architecture by referencing the config-tags sibling folder in tool-module and connector-module.

This summary was automatically generated by Gemini AI

v0.5.4

Released on 2026-05-02

Added

New kvlist editable table widget for storing values as JSON arrays.
Support for wick:"kvlist=..." tags to define table columns.
Per-field status indicators showing saving, success, and error states.
New config_helpers.go utility for input handling and list processing.
Dedicated reference/config-tags.md documentation.

Fixed

Non-deterministic ordering in ListOwned by implementing a declOrder slice.

Improved

Revamped configuration forms to use always-visible inputs instead of click-to-edit.
Implemented per-field auto-saving with 800ms debounce for text and immediate updates for other input types.
Synchronized wick tag grammar across tool, connector, and design-system modules.
Streamlined module documentation by centralizing configuration tag references.

This summary was automatically generated by Gemini AI

v0.5.3

Released on 2026-05-02

Fixed

Updated upgrade logic to fetch the latest version from both Go proxy and GitHub to ensure real-time accuracy and resolve proxy sync delays.

This summary was automatically generated by Gemini AI

v0.5.2

Released on 2026-05-02

Added

Added a status field to wick_list and wick_search responses to identify connectors requiring manual configuration before execution.

Fixed

Resolved an issue on Windows where active binaries were locked during upgrades by implementing a rename strategy for the running executable.

This summary was automatically generated by Gemini AI

v0.5.1

Released on 2026-05-02

Added

Model Context Protocol (MCP) support via stdio transport, enabling integration with LLM clients.
CLI subcommands for mcp serve, mcp config, and mcp install.
Support for four MCP build modes: auto, dev, build, and rebuild.
Automated MCP configuration installation for Claude Desktop, Cursor, Gemini, Codex, and Claude Code.
wick_info tool to provide version, build time, and commit metadata to LLM clients.
CLI commands to start the server and worker directly.

Improved

Automatic directory resolution to the project root during MCP startup to ensure correct loading of .env files and SQLite databases.
Detection for Windows Store installation paths for Claude Desktop.
Binary execution logic on Windows to bypass extension requirements for PE binaries.
MCP auto mode using mtime-based staleness checks instead of roundtrip flags.
Documentation for local MCP setup, including guide sections for all build modes and installation targets.
Metadata field naming in wick_info for better clarity in LLM responses.

Fixed

Versioning inconsistencies and build flag propagation across CLI tools.

This summary was automatically generated by Gemini AI

v0.4.2

Released on 2026-05-02

Improved

Reorganized the crudcrud connector into a three-file layout to improve maintainability.
Updated the connector skill functionality.

This summary was automatically generated by Gemini AI

v0.4.1

Released on 2026-05-01

Added

New functionality for the wick upgrade command to self-install the CLI binary.

Improved

Upgrade process split into distinct prompts for the CLI binary and go.mod dependencies.
Support for binary-only upgrades when no go.mod file is present, preventing errors during the upgrade process.

This summary was automatically generated by Gemini AI

v0.4.0 Connectors + MCP

Released on 2026-05-01

Added

Connector module — third class of wick module beside Tool and Job, designed for LLM consumption via MCP (Model Context Protocol). Each module wraps one external API with a typed Configs struct + N typed Operations. See Connector Module.
MCP server at POST /mcp with the four-tool meta-dispatch pattern (wick_list, wick_search, wick_get, wick_execute). Tool IDs are opaque (conn:{connector_id}/{op_key}) and stable across admin renames. See MCP for LLMs.
Personal Access Tokens at /profile/tokens — wick_pat_<32hex>, hash-only stored, render-once banner. For MCP clients that cannot speak OAuth (Claude Desktop, Cursor, cURL). See Access Tokens.
OAuth 2.1 with Dynamic Client Registration (RFC 7591), PKCE S256 mandatory, refresh rotation + replay detection. Access wick_oat_<32hex> (1h TTL), refresh wick_ort_<64hex> (30d TTL). For browser-based MCP clients (Claude.ai). See OAuth Connections.
Connected Apps at /profile/connections — per-grant disconnect (revokes every token for one user × client pair).
Admin pages: /admin/connectors, /admin/access-tokens, /admin/connections for cross-user management.
Built-in System job connector-runs-purge — daily cleanup of connector_runs audit rows older than 7 days (configurable). Code-managed; cannot be disabled. See Connector Runs Purge.
Per-row test panel + history at /manager/connectors/{key}/{id} — Postman-style runner with URL-synced operation dropdown, prefill from history runs, paginated audit log with filter chips, expand-row inline detail, manual Retry navigation.
Bundled skill connector-module — added to wick skill sync and the template's bundled skill set. The example connectors/crudcrud/ ships in scaffolded projects.
Three-module mental model in docs — introduction page now lists Tool, Job, and Connector side by side.

Changed

template/AGENTS.md documents the connectors/ folder, app.RegisterConnector registration site, and the connector-module skill row.
template/README.md lists the connector test page URL and /profile/mcp install snippets in the Quick Start.

Migration notes

Existing wick deployments upgrading to this version: the connectors, connector_operations, and connector_runs tables are auto-created on first boot. The connector-runs-purge job auto-registers and auto-enables. No manual action required.

v0.3.0

Released on 2026-04-22

Added

SSO domain allowlisting to restrict sign-ins to specific email domains, including a chip-based editor in the admin UI for management.
A wick upgrade command to facilitate internal version updates.

Improved

Default theme resolution for new users and guests, providing GitHub-styled themes for unauthenticated or unset user sessions.
Tool operator interface via a unified ToolHeader component and standardized setup-required banners across all tool pages.
Tool rendering architecture to pull configuration state directly from context rather than manual service injection.
Release workflow automation to synchronize version references across documentation, templates, and agent installation hints.
Agent session initialization with a preflight check to verify local go and wick toolchain installations.
Internal Go dependencies to their latest versions.

This summary was automatically generated by Gemini AI

v0.2.0

Released on 2026-04-21

Added

wick skill list and wick skill sync commands to manage bundled skills and synchronize the AGENTS.md skill table.
MobilePrompt component to display inline prompts specifically for mobile users.
Downstream tool-module skill template featuring flat tool paths and mandatory clarify+plan loops.
Comprehensive CLI reference documentation categorizing built-in commands and YAML task shortcuts.
AI-agent quickstart section and skill sync pointers in the template README and AGENTS.md.

Fixed

License synchronization logic.
Text alignment for prompts on mobile devices to ensure left-alignment.

Improved

CI/CD pipeline configurations.
Homepage hero layout responsiveness for both mobile and desktop viewports.
wick init scaffolding to include downstream tool-module skills and shared design-system components.
Documentation structure by renaming agent.md to AGENTS.md across all guides and pages.
Prompt instructions updated to utilize the wick dev command and version v0.1.13.
Desktop-specific visibility for installation components via CSS optimizations.

This summary was automatically generated by Gemini AI

v0.1.13

Released on 2026-04-19

Fixed

Corrected project license to MIT.
Synchronized license documentation and repository metadata.

This summary was automatically generated by Gemini AI

v0.1.12

Released on 2026-04-19

Added

MIT license for the repository.

Improved

Project versioning and internal metadata.

This summary was automatically generated by Gemini AI

v0.1.11

Released on 2026-04-19

Added

Added license information to the repository.

Improved

Configured CI to trigger documentation and pkg.go.dev synchronization on version tags.

This summary was automatically generated by Gemini AI

v0.1.10

Released on 2026-04-19

Fixed

Fixed changelog formatting and removed duplicate entries for version v0.1.0.

Improved

Automated CI workflow to merge trigger PRs to the release branch upon release completion.
Enhanced changelog documentation with version comparison links for v0.1.1 through v0.1.7.
Synchronized documentation and go.mod.tmpl templates for version v0.1.9.
Performed general cleanup and synchronization of project documentation.

This summary was automatically generated by Gemini AI

v0.1.9

Released on 2026-04-19

Fixed

Changelog formatting and duplicate entry for version 0.1.0.

Improved

CI workflow to automatically trigger pull requests to the release branch after a release completes.
Project documentation through synchronization and the addition of comparison links for versions v0.1.1 to v0.1.7.

This summary was automatically generated by Gemini AI

v0.1.8

Released on 2026-04-19

Added

Retry logic with rate-limit backoff for Gemini API requests.
Tag comparison links to documentation changelog entries.

Fixed

CI reliability issues by fetching full repository history and origin/master before merging.
Stale branch errors by ensuring the release-sync branch is deleted prior to pushing updates.

Improved

Release pipeline architecture by splitting tasks into five modular jobs for easier retries.
CI automation by utilizing the GitHub API for PR merges and branch deletions instead of local git operations.
Documentation workflow by automatically syncing changelog updates directly to project docs.
CI security and permission management through the use of ADMIN_TOKEN for checkout and merge actions.
Workflow efficiency by pushing sync updates directly to the master branch and removing redundant PR steps.
Repository structure by removing the root CHANGELOG.md and centralizing logs within documentation.

This summary was automatically generated by Gemini AI

v0.1.7

Released on 2026-04-19

Fixed

Logic for automatic documentation version updates.

Improved

CI/CD workflow to automatically delete release-sync branches after merging.
Synchronization process for go.mod.tmpl and CHANGELOG files.

This summary was automatically generated by Gemini AI

v0.1.6

Released on 2026-04-19

Fixed

Synced go.mod.tmpl before tagging new versions.
Enabled automatic merging of release-sync pull requests to the master branch using ADMIN_TOKEN.

This summary was automatically generated by Gemini AI

v0.1.5

Released on 2026-04-19

Improved

Synced go.mod.tmpl and CHANGELOG files for v0.1.4.

This summary was automatically generated by Gemini AI

v0.1.4

Released on 2026-04-19

Improved

Improved auto release process.

This summary was automatically generated by Gemini AI

v0.1.3

Released on 2026-04-19

Fixed

Bumped go.mod.tmpl before tagging and fixed version order in the release process.
Resolved issue with pushing to refs/heads/release instead of HEAD in a detached state.
Checked out the release branch before commit and tag to prevent detached HEAD push errors.
Synchronized Go modules.

Improved

Updated pipelines.

This summary was automatically generated by Gemini AI

v0.1.2

Released on 2026-04-19

Added

Add version command.

Fixed

Resolve CI/CD issues.
Resolve documentation build issues.
Correct wick init setup call.
Address version-related issues.

Improved

Update README.md documentation.
Enhance CI/CD processes.
Update project pipelines.
Update go.mod template version during releases.
Optimize package JSON location.

This summary was automatically generated by Gemini AI

v0.1.1

Released on 2026-04-19

Improved

Update pipelines.
Update README.md documentation.
Update CI/CD for documentation builds.
Update go.mod template version during release.

This summary was automatically generated by Gemini AI

v0.1.0

Released on 2026-04-19

Initial public release.

Added

wick init <name> — scaffold a new project from template, auto-run go mod tidy + go run . setup
wick.yml cross-platform task runner — setup, dev, build, test, tidy, generate
Tool modules (tools/<name>/) — mount at /tools/{key}, typed Config with wick:"..." tags
Background job modules (jobs/<name>/) — operator surface /jobs/{key} + admin surface /manager/jobs/{key}
Tag system — group and filter tools/jobs with DefaultTag, admin-managed
Visibility control — VisibilityPublic / VisibilityPrivate per tool
Runtime config — Config structs reflected into admin-editable configs table rows
SSO support — configurable from /admin/configs, no redeploy needed
AES-GCM stateless sessions — per-job access, theme cookie persistence
Tailwind CSS + templ — standalone Tailwind CLI (no Node.js), type-safe Go templates
Claude Code integration — agent.md + Claude skills shipped with every wick init project
External link cards — register URL shortcuts as tool cards via RegisterToolNoConfig
Dark/light theme — user preference persisted via cookie

Changelog ​

[Unreleased] ​

v1.9.0 — Graceful Upgrades & Workflows ​

Added ​

Improved ​

Fixed ​

v1.8.1 — Providers & Fixes ​

Fixed ​

Added ​

v1.8.0 — Providers & Fixes ​

Added ​

Improved ​

Fixed ​

v1.7.3 — Plugins & Autosave ​

Added ​

Improved ​

v1.7.2 — Channels & Files ​

Added ​

Improved ​

v1.7.1 — Trace UI ​

Fixed ​

v1.7.0 — Trace Improvements ​

Improved ​

Fixed ​

v1.6.0 — Job, Session, Migrate ​

Improved ​

Added ​

Changed ​

Fixed ​

v1.5.0 — Tickets ​

Added ​

Improved ​

Fixed ​

Dev ​

v1.5.0 — Ticket Descriptions, Card Fields, Custom Buttons ​

Added ​

Security ​

v1.4.3 — Conversation Pagination ​

Added ​

v1.4.2 — Enhancements ​

Added ​

v1.4.1 — Web UI ​

Fixed ​

v1.4.1 — Chime Hang Fix ​

Fixed ​

v1.4.0 — Agents ​

Fixed ​

v1.3.0 — Agents, Tickets, Tools ​

Added ​

Fixed ​

v1.2.0 — Agents, UI, Connectors ​

Added ​

Fixed ​

v1.1.0 — Identity & Ticket Management ​

Changed ​

v1.1.0 — Caller Identity Everywhere ​

Added ​

Fixed ​

Removed ​

Notes ​

v1.0.0 — User Identity & Channels ​

Added ​

Changed ​

Fixed ​

Notes ​

v0.40.1 — Board Columns ​

Added ​

Changed ​

v0.40.0 — Tickets & Notes ​

Added ​

v0.39.10 — Session Management ​

Improved ​

v0.39.9 — Agents & Skills ​

Changed ​

v0.39.7 — Skills & Agents ​

Agent Memory Management ​

Fixed ​

Changed ​

Added ​

Shipped Skills Reachable from Claude and Codex ​

Changelog

[Unreleased]

v1.9.0 — Graceful Upgrades & Workflows

Added

Improved

Fixed

v1.8.1 — Providers & Fixes

Fixed

Added

v1.8.0 — Providers & Fixes

Added

Improved

Fixed

v1.7.3 — Plugins & Autosave

Added

Improved

v1.7.2 — Channels & Files

Added

Improved

v1.7.1 — Trace UI

Fixed

v1.7.0 — Trace Improvements

Improved

Fixed

v1.6.0 — Job, Session, Migrate

Improved

Added

Changed

Fixed

v1.5.0 — Tickets

Added

Improved

Fixed

Dev

v1.5.0 — Ticket Descriptions, Card Fields, Custom Buttons

Added

Security

v1.4.3 — Conversation Pagination

Added

v1.4.2 — Enhancements

Added

v1.4.1 — Web UI

Fixed

v1.4.1 — Chime Hang Fix

Fixed

v1.4.0 — Agents

Fixed

v1.3.0 — Agents, Tickets, Tools

Added

Fixed

v1.2.0 — Agents, UI, Connectors

Added

Fixed

v1.1.0 — Identity & Ticket Management

Changed

v1.1.0 — Caller Identity Everywhere

Added

Fixed

Removed

Notes

v1.0.0 — User Identity & Channels

Added

Changed

Fixed

Notes

v0.40.1 — Board Columns

Added

Changed

v0.40.0 — Tickets & Notes

Added

v0.39.10 — Session Management

Improved

v0.39.9 — Agents & Skills

Changed

v0.39.7 — Skills & Agents

Agent Memory Management

Fixed

Changed

Added

Shipped Skills Reachable from Claude and Codex