SupaCloud
App öffnen

Changelog

Alle nennenswerten Änderungen an SupaCloud, neueste zuerst. Diese Seite wird beim Build aus der CHANGELOG.md im Repository synchronisiert und kann daher nie von den Release-Notes abweichen.

0.6.0

2026-07-09

Hinzugefügt

  • The web terminal runs on the typed command protocol. The terminal's bespoke command parser is retired onto the shared command backbone — each command resolves and invokes the same neutral handlers the Telegram and Discord bots use, so all three control surfaces stay in lockstep, and prompts for missing arguments are built from the typed contract.
  • Model-native effort levels. When a task or a workflow agent node is pinned to a specific model, the effort slider offers that model's own levels (e.g. Claude xhigh / max / ultracode, Codex ultra), discovered by probing the running harness at task start; auto / unpinned tasks keep the abstract five-step scale.
  • Standalone script runs from the UI — launch a script and see its run history from the launch modal's Script tab.
  • Entitlement overrides — instance admins can grant or revoke per-workspace feature entitlements from the admin console.
  • Subscription usage gains per-model windows and Codex reset-credits in the usage view, alongside the credential's overall budget.
  • Docs: the Reports hub overview and the run-detail Waterfall lens are now captured in the documentation screenshot set.

Geändert

  • Mobile layout overhaul (ADR 0056). A phone-density pass over every board and hub: a board never stacks two pill rows — an in-page status or view switch (e.g. List / Graph / Health, or All / Active / Errors) is now a single segmented control distinct from the section tabs; the table toolbar (search · filter · sort · columns) stays one row, with filter/sort/columns opening as bottom sheets; KPI cards stay a compact two-column-minimum grid so the list keeps the screen; page actions (Refresh, the Reports period chooser) move into the top bar and create uses the round button; Settings becomes a tap-through list of sections instead of an overflowing tab strip; and only the list scrolls while the surrounding chrome stays put. A follow-up audit pass tightened the details: Settings panels use the one shared top-bar back button (no second one); the Reports → Operations tab highlights correctly; the Inbox rows adopt the shared compact card; the Usage view shows its per-provider saturation gauges; multi-stat strips (e.g. the Memory metrics) collapse to one compact row with an icon control; and every board uses the round create button on a phone (never a duplicate next to an empty-state button).

Behoben

  • Telegram live mode no longer freezes on an agent message that interleaves bold and italic (or when a long message is trimmed mid-format) — the renderer now emits properly-nested formatting Telegram always accepts.
  • The web terminal renders the agent's markdown (bold, code, lists, links, fenced blocks) in live / follow mode instead of showing raw ** / ` `` markers.
  • The "Approval required" notification dismisses promptly when the decision is made on another surface, instead of lingering until the next background poll.
  • The live feed self-heals after a connection hiccup. A slow or briefly dropped connection no longer silently skips messages, tool lines or the completion marker: the gap is detected and the missed events are backfilled (deduplicated), and a remote-runner task always shows its completion even if the final live event was lost.
  • Smaller correctness fixes: parenthesised links no longer truncate to the wrong target; an intervention or error notice can no longer accidentally format the live message; a half-open WebSocket is reaped server-side; and interpolated text can't inject Telegram/Discord formatting.
  • Seller earnings and listings/sales are now paginated boards. Their headline figures (available / held / paid / this-month / average, and gross / fee / net) are recomputed on the server over the whole filtered set — so the totals stay correct no matter which page you are on — with entry-type / status filter chips, a 30-day earnings sparkline, and a sort on every column.
  • Admin payout batches became a sortable, status-filterable, paginated board (the detail drawer and the submit / reconcile / TAN actions are unchanged).
  • The Schedules list and the scheduled-reports board gained per-column sorting.
  • Fixes found while auditing the sweep: opening the Schedules filter no longer crashes when a workflow/App schedule is present, and the earnings average is rounded exactly as before.
  • Performance: removed N+1 query loops in workflow dispatch, script-secret resolution, child-run reconciliation, and run-start cap checks; trimmed a SELECT * on the tasks board to its summary columns.
  • Security: tracker webhooks gain replay protection for timestamp-free deliveries (with a bounded retention sweep); the bootstrap-token comparison is constant-time; the deployed-App CSRF carve-out is pinned to the App-token endpoints; dev-mode OIDC discovery is IP-pinned.
  • Type-safety & accessibility: the marketplace-seller and app-run surfaces use their typed contracts instead of unknown casts; actionable quota toasts now announce as alerts, the log terminal exposes its log role, and route fetches abort on navigation. The workflow JSON schema reflects the typed on_failure node field, and the request-locale / tool-approval guards gained branch tests.
  • Doc drift: the MCP tool-count references in CLAUDE.md and ADRs 0044 / 0045 / 0054 now match the live catalog (63 tools), satisfying the new mcp_tool_count_docs_match_catalog gate; the RLS table-enumeration scan skips partition children so a partitioned table in a resource DB no longer wedges provisioning.
  • Command requests resolved against the wrong tenancy on the typed-command path (a user / workspace identifier swap) — corrected, with regression guards.
  • Dark-theme contrast (WCAG AA): the dashboard concurrency-chart peak label no longer renders near-invisible, and the error status badge now meets AA on tinted surfaces.
  • Doc-screenshot fixtures: the nightly capture seeds the run-detail/workflow tree again (a stale fixture admin email had left it empty) and the workflows list shot points at the relocated /build hub.
  • Nav-tab accent tokens (ADR 0056 follow-up): the filter and segmented NavTabs active-tab text now uses --color-accent (the accent-split convention the other tabs already follow) instead of --color-primary, satisfying the ui:guard token audit; the structural border/fill stay primary.

0.5.0

2026-06-26

0.4.0

2026-06-25

0.3.9

2026-06-22

0.3.8

2026-06-22

0.3.7

2026-06-22

0.3.6

2026-06-22

0.3.5

2026-06-22

0.3.4

2026-06-22

0.3.3

2026-06-21

Hinzugefügt

  • Closeout memory review + governance. The memory review queue (Intelligence → Memory → Review) gains a Show closeouts only filter and a Closeout: Standard badge, surfacing each completed task's auto-proposed closeout (newest first). A memory's detail drawer now shows its Completion facts (pull request, branch, cost) and a Context usage panel listing which tasks saw it, linking back to each task. A new Settings → Memory tab lets a workspace owner set, per scope (workspace / project / personal), whether new memories auto-publish or require review, and how long they are retained.
  • /api/commands — one command contract for any client. A new client-facing API exposes SupaCloud's command set as typed descriptors (GET /api/commands), live option pickers (GET /api/commands/options/{provider}), step-by-step resolution (POST /api/commands/{word}/resolve) and invocation (POST /api/commands/{word}/invoke). The catalogue is filtered to what your role can actually run, so a new surface — a bot, a CLI, a mobile or voice client — can drive the same commands as the web terminal without re-implementing them.
  • Model capability badges. The model catalogue now shows distinct capability badges — Thinking, Vision and Tools — plus a chip for each extra input modality (audio, video, PDF), so you can see at a glance what a model can do.
  • Images for non-vision agents. When a task's selected model cannot read images, SupaCloud now synthesises a faithful text description of each attached image so a non-vision agent can still act on screenshots, diagrams and UIs; vision-native models still receive the raw image unchanged.
  • Discord live mode. A task launched from Discord — a direct /run, the /run wizard, or the /issues wizard — now streams its progress live into the launching Discord channel as a single message edited in place: the agent's answer, a rolling list of the tools it runs, and its current thinking, all coalesced so the channel stays readable. A persistent Unfollow button stops the stream, the message auto-finalises when the task completes, and any plain (non-command) message you send while following is delivered to the task as an intervention. Following is per-surface — a Discord launch streams in Discord — bringing Discord to full parity with the Telegram live mode.
  • Agents remember a project across runs. An agent harness (Claude, Gemini, Qwen, OpenClaude) now keeps a durable, per-project memory: notes it records in its memory file are captured when a task finishes and restored into the next run, even though the agent container is recreated each time. Each capture and restore shows as a memory line in the run's event log and the chat live view, so you can see what was kept.

Geändert

  • Re-edit a failed task with its full config. "Edit & restart" now reopens the complete launch dialog prefilled with the task's entire configuration — model, effort, profile, agent, Git workflow and issue link — so you can adjust anything before relaunching, instead of a stripped prompt-only dialog.
  • Prompt-first Start-Task dialog. The dialog leads with the prompt; secondary fields fold into a "More options" disclosure, scheduling is a Now / Plan segment, and agent/model capability glyphs make the reasoning-effort control self-explanatory. Every segment is fully keyboard-navigable.
  • Edit-Project as a tab spine. Repository / Issues / Automation are now three tabs; the Automation tab reads as two zones with identical lane-cards (PR-Review, Debate, Backlog), a one-click safe-backlog Quick-Setup, masked secret fields with a configured badge, and a mobile stepped wizard.

Sicherheit

  • Authentication hardening sweep. SupaCloud's in-tree authentication was hardened to match the two audit rounds of the shared bw-auth library it was extracted from: OIDC sign-in now requires a provider-verified email (email_verified), signs the sign-in state cookie (HMAC-SHA256, tamper-proof against cookie-tossing) and validates issuer / discovery-endpoint URLs structurally (rejecting embedded credentials and unexpected schemes); ID-token and session-token verification now honour not-before with zero clock-skew leeway; the session lifetime is range-validated at start-up; cross-site auth POSTs are fail-closed on a missing Origin/Referer; and the TOTP second factor rejects undersized secrets. No user action is required on a correctly-configured deployment.

0.3.2

2026-06-20

0.3.1

2026-06-19

Hinzugefügt

  • OAuth account email. Connecting an Anthropic provider fills the account email via the user:profile endpoint; each provider now shows its identity honestly — email, GitHub handle, or "unavailable" — instead of guessing.
  • GitHub Copilot OAuth. Copilot joins the method-aware provider dropdown with a device-code sign-in dialog.
  • Per-account budget windows. Subscription-saturation windows carry the credential and account email, so a provider with several credentials is disambiguated per account.
  • Audit actor identity + correlation. Audit rows resolve the actor to a name/email, and the event drawer loads the full correlation group.
  • Review recommendation detail. A suggestion now shows its reason, the evidence behind it, and the concrete action it would apply.
  • Cost-anomaly context. The operator cost-anomaly view names the workspace and links the top-spend task behind each anomaly.
  • Token, cost & TL;DR on task detail. GET /tasks/{id} folds in task-outcome usage (tokens, cost, summary) — previously board-only — so the task peek and full-screen detail render them.

Geändert

  • Seat billing follows the plan quota. Operator/role seats pool against the plan's included seat quota (headcount overage) instead of an orthogonal flat per-seat add-on; a role seat's flat per-seat Stripe quantity is reconciled to 0.
  • Consistent tables & surfaces. Admin audit/overrides, the intelligence auto/experiment panels and the operator cost-anomaly table use the shared DataTable; sidebar tooltips are collapsed-only; the structured run view and the task peek drawer scroll internally; the dashboard spend-range, the segmented toggle and the single-file script editor are aligned.
  • Agent-image staleness is visible. When a base/channel agent image's baked agent-runners tree differs from the server's, the run logs a loud warning instead of silently executing an outdated harness (the max-turns / capabilities class of surprise). Pairs with the CI staleness label + release gate.

Behoben

  • Dropdowns above modals. Portaled select popovers inside runner modals no longer render behind the modal backdrop (z-index layering corrected).

0.3.0

2026-06-19

Hinzugefügt

  • Steerable dispatch. Beyond "first available runner", the fleet now supports graceful drain/cordon (quiesce a runner without killing its in-flight work), a per-runner concurrency cap, opt-in weighted least-loaded ordering, task priority, and a manual pin (run a task on a specific runner, queueing if it is busy). Every lever is off by default, so a zero-config fleet is unchanged.
  • Fleet operator UI. The /runners page gains an Advanced panel showing each runner's live load, cap, drain state and staleness, with drain/cordon/resume controls and the least-loaded toggle.
  • Secure third-party onboarding. Onboard a runner on a machine you do not fully control: an admin mints a single-use enrollment token (choosing trust class, tier, isolation and the workspaces it may serve); the runner exchanges it on boot for a short-lived, scoped JWT and refreshes it automatically. An edge runner is untrusted by default — dispatched nothing until granted a workspace — and the grant is enforced at both dispatch and claim time.
  • Named worker groups. Group runners by capability/locality with labels and route work to them via a workspace floor plus per-project / per-agent-profile bindings (first-non-null precedence; AND across required groups, OR within a group's members). A task with no group demand runs anywhere, as before.
  • SSH execution backends (experimental). A runner can run its claimed tasks on a remote host over SSH — either remote Docker (recommended; the same container isolation, preserved on the remote host) or a double-gated, unsandboxed raw remote process. Behind a non-default ssh-backends build feature; the default local-Docker backend is unchanged. Host-key handling is fail-closed (raw-ssh verifies in-code; ssh-docker requires an explicit delegation acknowledgment). See SSH execution backends.
  • Lower dispatch latency. Runners pick up work over an HTTPS long-poll released by a Postgres LISTEN/NOTIFY wake instead of fixed-interval polling — near-instant pickup with no idle-poll load. It degrades safely to interval polling on any uncertainty, so behaviour is unchanged when nothing notifies.
  • Published runner docs (en + de): set up a runner securely (incl. cross-platform install), steer & monitor the fleet, and the runner-fleet security model.
  • An opt-in per-automation toggle to include the agent's metered cost in the linked issue's closing comment (default off, so a public forge repo never leaks internal spend).
  • Multi-language agent runtime. Projects in Python, Rust, C#/.NET, Go and Java now run in an agent image carrying the matching SDK, selected automatically from the detected stack — previously every project ran in a Node-only image and a non-Node toolchain failed with command not found. A detected language with no toolchain (Swift, Ruby, PHP) is flagged with a clear warning instead of failing silently (#551).

Behoben

  • Dead runners no longer receive work. A crashed or unreachable runner is now swept to offline once its heartbeat goes stale (SUPACLOUD_RUNNER_STALE_SECS, default 90s) and is filtered out of dispatch immediately by a freshness gate — so a task is never handed to a runner that has gone away. Work that was stuck on such a runner is released and surfaced as failed instead of hanging forever.
  • Autodev backlog items now persist the issue's clean title and description, not the <<<UNTRUSTED_EXTERNAL_CONTENT>>>-wrapped text used for the agent prompt (a Linear/Notion webhook enqueue had stored the wrapped variant).
  • Forensic audit follow-ups: the "Approval required" toast now clears when a tool/question gate is decided or times out; the live per-step log poll settles on a non-gated workflow run; mobile run-step cost/tokens mute while pending (to match desktop); a no-op sticky-tabs modifier was removed; the return-to-sender ceiling audit no longer labels a state-race or DB error as max_effort; and duplicated definitions were consolidated (issue-seed builder, MAX_TURNS default, the severity constants, the tooltip positioner).
  • Ratcheted the web bundle budget to the dashboard's legitimate v0.2.3 floor (the app-wide tooltip system) and aligned the issue-credential test with the typed MissingIssueCredential variant — greens the post-merge build/test gates.

Sicherheit

  • Bumped the agent runner's transitive hono to 4.12.25+ (CVE-2026-54290, the CORS-credentials origin-reflection issue) via an npm override.
  • Bumped russh 0.54 → 0.60.3 (and russh-cryptovec) — clears RUSTSEC-2026-0153 and RUSTSEC-2026-0154 (unbounded / unchecked CryptoVec allocation, both HIGH) in the optional, default-off ssh-backends execution backend.

Documentation

  • Documented the autodev concept-first approval mode, the per-automation completion action (close / comment / nothing), per-task TL;DR chat notifications with the per-account opt-out, and backlog dev-pipeline tuning across the user docs (en + de).

0.2.3

2026-06-16

Hinzugefügt

  • Model pickers show every model. A picker now lists every model in the live catalogue; a model whose provider has no key is shown greyed out with a link to add one in Settings, instead of being hidden. New catalogue models appear on their own.
  • Multi-agent work lane. A backlog or simple project can hand work to more than one agent. Choose Single agent (the unchanged default), All agents (the auto-selection router picks the best agent per item across every connected agent, including ones you add later), or Selected agents (the router picks per item from a set you choose). Unkeyed agents are greyed, consistent with the model picker.
  • GitHub Copilot agent. Connect a GitHub Copilot subscription with a device code in Settings and run tasks with the Copilot CLI; its subscription models appear in the catalogue once connected.
  • Task TL;DR to your chat. When you link a Telegram or Discord account, a short digest of each finished task — its result and a one-line summary — is sent to that chat. Turn it off per account from the chat settings.
  • Concept-first review mode. A project can require an agent to write a code-grounded implementation concept for you to approve before it implements, pausing for your sign-off in the middle of the run.
  • Per-project completion action. Choose what happens to a linked issue when its task finishes: comment and close it, comment but leave it open, or do nothing.
  • Review tail with a self-improvement loop. A backlog/simple project can run an independent forensic audit after the implement step; on a failed audit the item is re-queued at higher effort, optionally as a bounded auto-retry loop you tune by severity threshold, max rounds and max cost.

Geändert

  • The "Strukturieren" prompt assist uses your connected provider. The new-task prompt-restructure button now runs a real model completion on your workspace's best available credential (a pinned system credential, then any connected provider key or OAuth account), and falls back to the built-in template when no credential is set.
  • Rename a task. You can edit a task's title after it is created.
  • Agents work longer before stopping. Agents run up to 500 turns per task before stopping, so they can finish larger pieces of work in one run.

0.2.2

2026-06-16

Hinzugefügt

  • Autodev mode per project — Off · Simple · Backlog. A single mode picker says what a project does with its issues. Simple works each new issue directly to a pull request, in arrival order. Backlog collects, classifies and prioritises issues, then dispatches within the autonomy level, the concurrency caps and the budget. Off stops dispatch. Either way issues are always imported — from every connected tracker (Git forge, Linear, Notion) — and PR-review and issue-debate stay separate, orthogonal lanes you can turn on independently.
  • Backlog dispatch panel — a workspace dispatch view shows the dispatch rate, the time since the last tick, the in-flight count, and per-project the effective cap, queued items and any blocked reason. It collapses to a one-line status, and an owner can tune it in place: parallelism (per-project, under a workspace ceiling), daily budget, autonomy, the classifier, the merge policy and the dispatch strategy.
  • Editable backlog classifier — choose a rules classifier or an LLM one; for the LLM, set its model, system prompt and the category list. Every item is classified along three axes — its kind, a priority that maps to a severity, and a scope (small / medium / large) that nudges how much effort the router spends.
  • Tenant operator console — workspace owners and admins get a read-only operability view of their workspace (dispatch metrics, the routing decision-log, and tripped circuit breakers), laid out in the familiar tabbed Settings shell. Cross-tenant reads and the global dispatch kill-switch stay with the instance owner.
  • Voice input — dictate a prompt or an intervention; speech-to-text uses the instance's Groq Whisper key, so it works everywhere the instance has one configured.
  • Visual-verify gates per agent profile — turn the visual check on for a profile and set which routes and viewports to capture and the judge's pass threshold; the gate captures and judges those exact screens on the profile's runs.
  • Memories follow repo-sync — workspace and project memories serialise into the synced repository alongside workflows and scripts (personal memories stay private). The new-memory editor is a full Markdown editor in a side drawer.

Geändert

  • Every model picker reads a live catalog. Model dropdowns — for tasks, agent profiles, the classifier, schedules and workflow nodes — list models from the live models.dev catalog, filtered to the providers you actually have a key for, so the list reflects what can really run.
  • Pin the system credential for internal LLM calls. When a workspace has more than one usable key, an owner can pin which credential backs SupaCloud's own internal calls — issue classification, recommendations and the quality judge — instead of leaving it to automatic precedence.
  • Editable included seats per plan. An admin can set each billing plan's included-seat quota (a whole number, or unlimited); the seat and € figures shown stay coherent with the deployment edition.
  • The sign-in headline catches the ambient light. On the login promo, the drifting background orbs now bleed their colour into the animated headline as they pass behind it, so the shimmer and the glow read as one motion, not two.

Behoben

  • The dispatch kill-switch is honest end to end. A workspace pause and the instance-wide red button now compose — dispatch runs only when both allow it, and the dry-run preview agrees with what a real dispatch does.
  • Authenticated reads no longer trip the rate limiter. The API rate limiter is segmented so ordinary signed-in GET traffic has a generous tier, ending the request-storm throttling that could surface on busy boards.

0.2.1

2026-06-15

Hinzugefügt

  • Guided onboarding — a first-run flow over the dashboard walks a new workspace owner through what a task actually needs — a harness, Git access, a project, then the first run — and then graduates the workspace into the autonomy engine, lifting the onboarding cap. The matching harness login is used automatically; optional MCP and skill steps stay out of the way.
  • Operator console in the sidebar — instance admins reach the cross-tenant operator console (dispatch metrics, routing decision-log, circuit-breaker state, and the global kill-switch / per-workspace pause) straight from the navigation, authorized by their own admin session.

Geändert

  • Mobile-first across the app — every board, detail page, editor and dialog now adapts to a phone. One unified top bar owns the screen title and its primary action (so a button never hijacks a row above the header), list pages share a pixel-consistent pill→list rhythm with a single round create button, side drawers and modals rise as bottom sheets, long pickers open as option sheets, the run detail becomes a Tree / Events / Approval drill, the workflow builder gains a vertical node-stack, and create / edit screens dock their actions in a bottom bar.
  • Settings opens on Workspace — the Settings area now lands on its first tab (Workspace) instead of an arbitrary middle one.

0.2.0

2026-06-14

Hinzugefügt

  • Autonomy Slider — one calm control (workspace → project → profile → task) that sets how autonomously the engine runs: dispatch aggressiveness, how much it asks before acting, an effort-bias preview (not yet consumed by the router), and how far it may merge. Five named stops from Manuell to Entfesselt, with an Advanced panel for experts.
  • Per-harness Effort as a polished range slider next to the model picker — for Claude, Codex, Gemini/Antigravity and Qwen — shown only for reasoning-capable models.
  • Global, quota-aware Backlog — a workspace-wide board (toggle Project ⇄ Workspace) and a global auto-dispatcher with a real concurrency ceiling, that maximises subscription usage (fills the rolling 5h + weekly windows for Claude Max / Codex / Antigravity) and hard-caps API-key spend.
  • Usage & subscription saturation view — the budget panel expands to show everything: API-key $-budget and subscription window saturation (5h/weekly fill, Opus/Sonnet hours, time-to-refresh, "throttling soon").
  • Interactive Rückfragen — agents can pause mid-run to ask a human for a tool approval or a clarifying answer, delivered to Telegram / Discord / the web terminal and resumed in the same session (Claude, Codex and Gemini/Antigravity).
  • Smart approvals with before/after screenshots — UI/UX changes arrive as a visual before/after (and diff) in your linked Telegram/Discord, so you can approve from your phone at a glance.
  • Consolidated Automation — the four automations (Backlog · PR-review · Tracker · Debate) become one honest section with a per-automation severity gate, a uniform approval mode, source-agnostic triggers, and an explicit auto-agent (profile / auto-select / team) per automation.
  • Self-learning auto-agent selection — a verification-gated cascade (cheap first, escalate on a failing gate) plus a contextual bandit over agent profiles that engages automatically as outcome data accrues. No new classifier; it reuses the existing outcome telemetry.
  • Seat overage handling — paid plans count active members automatically and surface overage on the Usage surface and in billing, so adding people never silently blocks work or surprises the next invoice.
  • Operator dispatch metrics — the operator console gains a quota-aware dispatch view: per-provider window saturation, concurrency-ceiling occupancy and backlog throughput, so a fleet operator can see where runs are queued and why.
  • Smart error recovery & retry across all harnesses — transient provider limits (e.g. "Server is temporarily limiting requests") are retried with backoff; real usage-limit hits pause/downshift; context-overflow hands off to a fresh session; auth errors prompt action.
  • Changelog — this file, rendered human-nice on the marketing site.

Geändert

  • The budget panel becomes a full Usage surface (see above).
  • "Auto-Developer" is retired as a user-facing umbrella; automations are labelled by what they do (Backlog · PR-review · Tracker · Debate).
  • Effort is decoupled from execution mode and made first-class per harness.

Behoben

  • Backlog dispatch gains a workspace-level concurrency ceiling (a workspace with many projects could previously launch unbounded concurrent runs).
  • Manual backlog state moves now cancel the linked run (no more leaked slots); stale in-flight runs are auto-recovered.
  • The vision-quality gate gains retry + cost tracking.

Sicherheit

  • The issue-debate webhook now rejects unsigned/mismatched requests with 403 before parsing, against a dedicated secret.
  • New approval/quota/automation tables are authorised at the service layer (workspace membership), and delegated child tasks no longer inherit parent credentials.