sync: update from private repo (2336949a)

CHANGELOG.md

@@ -8,6 +8,163 @@ follow semantic versioning.
 
 ### Added
 
+- Files open in floating windows that stay on top of whatever you are doing —
+  dragged by the title bar, resized from the corners, snapped to a screen edge,
+  up to eight at once, with position and size kept when you move to another
+  chat. A file the agent is writing or editing opens by itself and streams in,
+  badged "generating / unsaved" until the write lands, or aborted, failed or
+  approval-pending when it does not (2026-09-17).
+- Workspace apps can be added from a local HTML file — "Add app" in the Apps
+  tab installs it under `apps/{name}/index.html`, takes the display name from
+  the document title, and lists anything in the page (downloads, file pickers,
+  new windows) that the sandbox may not allow (2026-09-17).
+- An LLM log tab shows every request and response — timestamp, purpose, step,
+  model, token counts, duration, tools called — and opening a row reveals the
+  prompt, the reply, tool arguments and tool results separately. The same
+  transcripts are written to the chat's `logs/` with a configurable retention
+  (default 30 days), and filtering and full-text search cover the whole
+  archive rather than the rows on screen (2026-09-17).
+- The trace tab gained per-call graphs (cache hit rate, context size, prompt
+  load time, generation speed), a "time by activity" table breaking duration
+  down by tool, by LLM purpose and by step, a record of every compaction, and a
+  summary of what the last reflection learned with a before/after diff of
+  memory (2026-09-17).
+- Chats can be spun off from text you select in a message or a Markdown
+  preview, into this workspace or another, with the quoted passage passed as
+  reference material rather than as instructions. The agent can be asked to
+  spin a topic off as well (`SpinOffTask`, off by default); it inherits your
+  ownership and visibility, and spinning off into a different workspace asks
+  you to approve first (2026-09-13).
+- Admins can read the audit log in the UI and export every record matching the
+  current filter as JSONL, streamed rather than held in memory (2026-09-13).
+- Running workers is easier to see and configure: per-worker cards with live
+  state, endpoint auto-fill, a connection type for hosted OpenAI-compatible
+  services (health-checked against `/v1/models`, API key sent), per-worker
+  image/audio/video capability, per-worker context limits, and automatic
+  routing of a task to a suitable model. Worker and node status moved into a
+  floating panel reachable from any screen, showing free slots, who holds them,
+  and per-node throughput (2026-09-13).
+- Speech runs both ways: live transcription of microphone and system audio in
+  its own tab with a running translation beside the original, a Voice mode that
+  takes spoken instructions and shows listening / working / waiting as a
+  character expression, and a `Speak` tool that turns text into an audio file
+  playable in place. The two endpoints are configured separately and `Speak` is
+  off by default (2026-09-12).
+- The `.xlsx` preview is a spreadsheet: colors, fills, borders, column widths
+  and row heights render as they are in the file, formulas are recalculated,
+  and cells can be edited in place with a ribbon for bold, text color, fill,
+  borders, alignment, row height and number format. Columns can be inserted and
+  deleted, cells merged and unmerged, edits save by themselves, and a selected
+  range can be handed to the agent with "Ask the agent" (2026-09-12).
+- A grounded answer mode restricts the reply to workspace material and the
+  pages fetched for that turn, prints `[S1]`-style markers linked to source
+  cards, and says so when the material does not contain the answer. It can be
+  chosen per message and set when creating a task (2026-09-12).
+- Reading long documents got easier: a collapsible table of contents in the
+  Markdown preview, export of a Markdown preview to HTML with its styling,
+  Outlook `.msg` preview, and page-range reads for PowerPoint and email the way
+  PDFs already worked (2026-09-11).
+- The task overview is now a dashboard — mission goal, current focus, what is
+  done and what is left, with constraints and decisions collapsed — plus
+  elapsed time, measured tool calls, compaction count, worker and recent
+  generation speed. Values that were never measured say so instead of showing a
+  zero (2026-09-10).
+- Files tab: deleted files and folders go to a Trash and can be put back, with
+  a second explicit confirmation before anything is erased for good; files the
+  agent writes keep a version history with a colored diff and a "restore this
+  version" action; and the list can be filtered by name, by category, by the
+  task that produced a file, or down to this task's files, with search covering
+  subfolders (2026-09-09).
+- Delegate and subtask runs have their own tabs, with their conversations and
+  full outputs readable rather than truncated (2026-09-08).
+- Admins can change the outbound network mode, the allow list and server-side
+  traffic observation from Settings without restarting; deployments that pin
+  these in an external config file are told why the fields are read-only.
+  Fonts, the editor and the map library are served by the application itself
+  instead of third-party CDNs (2026-09-08).
+- Chats get a short name generated for them and the list shows it above the
+  request text, and a new Activity screen lists the chats you can see across
+  every workspace you belong to, newest activity first. Hidden and archived
+  workspaces stay out of it (2026-09-08).
+- Navigation moved to a vertical icon rail on the left edge, with search in the
+  top bar; inside a chat the pane rail sits on the right. The rail folds away
+  on narrow windows and opens with a swipe, and the previous horizontal tab bar
+  can be restored in Preferences (2026-09-05).
+- Human verification (CAPTCHA) is no longer a dead end: the solve screen and
+  its login state are per workspace and shared with that workspace's members, a
+  card appears in the chat that was blocked, "Resolved (continue)" restarts
+  every chat waiting on that screen at once, a task that cannot reach an answer
+  any other way parks and frees its worker instead of failing, and "Skip"
+  proceeds without solving (2026-09-05).
+- Notifications and reminders collect behind the bell across workspaces, with
+  90 days of history, upcoming reminders, and a count of what happened while
+  the app was closed. The agent can create and cancel reminders, calendar
+  events can carry a "notify N minutes before", and workspace editors can add,
+  edit and delete calendar events (2026-09-05).
+- Chat is a four-column layout — icon rail, conversation, selected pane and
+  open files — with keyboard-movable splitters, and the conversation stays
+  visible whatever pane you select. Opening files in a column rather than a
+  window is a preference (2026-09-01).
+- The agent can edit Office documents in place instead of regenerating them:
+  Excel values, formulas, cell formats, merges, column widths and number
+  formats — charts, pivot tables, conditional formatting, macros and other
+  sheets survive, and a save that would disturb untouched cells is aborted —
+  Word paragraphs including documents with tracked changes, and PowerPoint text
+  (2026-09-01).
+- Model reasoning is visible and kept: a reasoning panel in chat, dictionary
+  lookups and document Q&A, shown only when the current run actually produced
+  reasoning, still readable after the tool call that followed it, and recorded
+  so it can be read back later (2026-08-27).
+- A run that keeps thinking without producing any text or tool call is rewound
+  and resent once its reasoning passes a character limit ("Max Thinking",
+  default 100000, 0 to disable), with a single short nudge appended. This only
+  works on backends that return reasoning in a separate field (2026-08-25).
+- Workspaces can connect an external file store — SharePoint, OneDrive or Box —
+  scoped to one folder, read-only, through your own account, and the agent can
+  list the permitted locations and the names directly under them. Every
+  connection is logged and admins have a kill switch (2026-08-20).
+- Whether the command sandbox may reach the network is a per-workspace setting
+  (inherit / allow / block; blocked by default, owner-only, logged), and
+  whether isolation is actually in force is shown in Settings → Safety, as a
+  badge on the workspace and task headers when commands can reach out, and
+  recorded per job and per command (2026-08-20).
+- A per-user cap on concurrently running tasks (default 1 for users, 2 for
+  admins, 0 for unlimited) stops one person's queue from filling every slot.
+  Tasks over the cap are passed over rather than failed, and worker slots are
+  now shared across every feature that needs a model (2026-08-18).
+- Whole tool groups can be switched off for a deployment through
+  `tool_packs.disabled` in `config.yaml` — X, YouTube, maps, Amazon,
+  transcription, text-to-speech, Microsoft Learn search and slide generation. A
+  disabled group disappears from the agent and from the workspace tool list;
+  the change is applied at startup (2026-08-15).
+- Webhook notification delivery (Discord, Teams and similar) has a Settings
+  section for enabling delivery, the public URL and the sending limits, so a
+  workspace no longer registers a destination and watches test sends fail for
+  no visible reason. Failures are separated into "delivery disabled", "rejected
+  by the endpoint" and "could not be reached" (2026-08-12).
+- A2A: external agents can fetch a run's output files from a link, a delegation
+  can only target workspaces you can write to, and admins can enable or disable
+  A2A from Settings without a restart (2026-08-10).
+- Pages the agent opens are kept along with the images they contained, under
+  `source/` in the workspace, with limits on how many and how large — 20 images
+  and 5MB each by default, adjustable in Settings (2026-08-10).
+- Selecting text in a message or a Markdown preview opens a selection menu (on
+  by default) offering a short explanation of the passage or a web-backed
+  lookup with sources (2026-08-09).
+- Admins can set instructions that apply to every user's agents, and a
+  workspace can carry automation rules that add instructions, deny an
+  operation, or require your approval before a tool runs or before the agent
+  finishes. Rules are off by default, and those that fire show up in the chat
+  (2026-08-03).
+- The agent can list the other chats in the workspace newest-first
+  (`ListWorkspaceTasks`) as well as search them. Search defaults to "any of
+  these words" ranked by relevance, with an all-words filter available, and a
+  phrase written without spaces that matches nothing is retried word by word
+  (2026-07-24).
+- A Discord connector (beta) joins Slack: mention the bot in a Discord server
+  and it runs a task and replies with the result. The bot token is registered
+  under Settings → chat connections; a dedicated private channel and
+  least-privilege permissions are recommended (2026-07-21).
 - A compact Movement Map in chat shows the current step, completed work,
   retries, and user messages without taking over the conversation. Nodes can
   be used for navigation, while concise tooltips explain each step
@@ -32,8 +189,146 @@ follow semantic versioning.
   headroom, .msg size limit, TLS minimum version, worker health-check
   interval) (2026-07-09).
 
+### Changed
+
+- The trace tab no longer lists individual records. What remains is the graphs,
+  the time-by-activity table and the compaction record; prompts, replies and
+  tool results are read in the LLM log tab, which the trace tab links to
+  (2026-09-17).
+- Viewers can no longer start new chats, and workspace editors can now delete
+  files — deletion became reversible with the Trash, so there was no longer a
+  reason to separate who may edit from who may delete (2026-09-09).
+- Chat and scheduled-run visibility is no longer chosen per item from
+  private / organization / public. Who can see a chat follows from its owner
+  and the members of the workspace it lives in, which is how it already behaved
+  inside a workspace, and the route that let such a chat be switched to public
+  after creation is closed. Chats outside a workspace keep their current
+  visibility (2026-09-08).
+- Settings are fully localized: field labels, section names, sub-headings and
+  the settings search all appear in the interface language, as do task states
+  and the remaining English strings elsewhere in the UI (2026-09-07).
+- A follow-up to a finished chat passes the previous exchange verbatim by
+  default instead of a summary, so file contents and decisions survive at the
+  cost of a larger request; the history icon in the composer switches back to a
+  compacted hand-off, per chat. Summarization still applies where verbatim
+  cannot be trusted — old chats with no transcript, a shared log directory, a
+  turn sent with grounded answers on, and re-runs after a failure
+  (2026-08-28).
+- A server whose Bash sandbox is set to `auto` refuses to start when the
+  isolation mechanism (bwrap) is unavailable, rather than starting unprotected
+  while the settings still claim outbound traffic is blocked. Install bwrap to
+  enforce it, or set `safety.bash_allow_network: true` to accept the risk; the
+  startup error names both routes and the setting that stopped the boot. `off`
+  still starts with a warning (2026-08-27).
+- The A2A `issuer` must be the exact public URL with the pathname `/oidc` — a
+  trailing slash or any other shape stops A2A from starting, with the reason
+  shown in Settings, so correct it before upgrading. The URLs advertised over
+  OIDC now match that public URL even when the server is reached over internal
+  HTTP behind a proxy (2026-08-27).
+- Web search is more restrained: a provider that has just served a
+  human-verification page is set aside for a while, the same query is not
+  repeated within a short window, uploaded files are no longer all read up
+  front, and the number of searches a task should need is given as a budget
+  (2026-08-27).
+- The LLM Gateway's OpenAI-compatible `/chat/completions` streams only when
+  `stream: true` is set, matching the OpenAI default, instead of streaming
+  whenever `stream` was omitted. External clients that relied on the old
+  behavior should set `stream: true` explicitly (2026-08-26).
+- When a conversation hits the model's context limit, the hand-off to the next
+  step replaces the conversation with a summary rather than passing the
+  oversized history plus a summary, which made the receiving step hit the limit
+  again immediately. A verify step that hits the limit completes the task with
+  the summary instead of discarding finished work; steps that have not produced
+  an answer yet still abort and retry (2026-08-18).
+- Office files are rejected before being opened when their contents do not
+  match the declared type, or when they would expand far beyond their stored
+  size, at every entry point rather than only the main one (2026-08-12).
+- A fresh install that listens on an externally reachable address (Docker does)
+  creates an admin account at startup and prints the password to the startup
+  log and `data/.initial-admin-password`, instead of coming up with no
+  authentication at all. Changing the password stops the log output, and a
+  warning bar appears if authentication is left off while exposed (2026-08-03).
+- The LLM Gateway authenticates only keys that have been issued and recorded,
+  so every call is attributed; keys written in `config.yaml` are imported at
+  startup and keep working. Usage is now recorded for external clients too, and
+  gateway callers appear in the worker view (2026-07-30).
+- Pieces are called **workflows** in the interface and their movements are
+  called **steps**, replacing the mix of "Piece", "piece" and "task type" that
+  appeared in different places. Only the wording changed (2026-07-29).
+- Database migrations are applied before the server process starts, and a
+  migration failure stops the boot with the error on the console rather than
+  leaving a half-updated database running (2026-07-14).
+
+### Removed
+
+- The `slide`, `brainstorming` and `ssh-ops` workflows were retired — each had
+  been run a couple of times in total, and a longer catalogue makes automatic
+  routing less accurate. Nothing became impossible: the tools remain, so the
+  same requests work in `chat`. The interactive `ssh-console` workflow stays
+  (2026-08-12).
+- The database-less Gateway startup mode (`AAO_GATEWAY_NO_DB`) is gone. It
+  existed to authenticate against keys in the config file, which is no longer a
+  supported route (2026-07-30).
+- Per-task share links are gone; sharing is by workspace. Add people as members
+  or send an invite link. Opening an already-issued task link explains the
+  change (2026-07-29).
+
 ### Fixed
 
+- A failing MCP server says why: a connection error after saving a server is
+  reported instead of only reaching the server log, "Refresh tools" failures
+  are classified (HTTPS required, private IP blocked, name resolution,
+  connection refused, HTTP status, authentication, timeout) with the next step
+  spelled out, a server whose tools were never fetched is marked unverified,
+  and both calls honor a timeout instead of hanging for minutes (2026-09-17).
+- Log cleanup no longer removes another chat's records, and SSH operations left
+  "running" by a restart are reconciled (2026-09-12).
+- A broken or unresponsive web page no longer holds up a read, a model that
+  returns nothing no longer keeps a task waiting for tens of minutes, and
+  browser pages opened behind web search are closed instead of accumulating
+  (2026-09-11).
+- "Max stream time (minutes)" from Settings is actually applied (2026-09-08).
+- A turn that produced only reasoning is no longer aborted as an empty
+  response, and a continued task no longer rebuilds the same summary each time
+  (2026-09-07).
+- Several controls were unreadable in one of the two themes — the SSH console
+  tab strip and its close buttons, delete buttons in Settings, dialog
+  backdrops, and a handful of labels that matched their background
+  (2026-09-05).
+- One unreadable entry or one dangling link no longer hides an entire folder in
+  the Files tab, in the workspace file list or in a shared app (2026-08-31).
+- Mermaid diagrams render sharply and a diagram that failed to draw is no
+  longer delivered as-is, and right-clicking no longer clears the text you had
+  just selected (2026-08-25).
+- Passwords typed during browser automation are no longer written verbatim to
+  the browser operation log (2026-08-20).
+- LLM backends behave consistently again: a worker no longer silently runs a
+  different model than the one configured, backends that omit tool-call
+  identifiers no longer collide with the ones generated for them, vLLM behind
+  the Gateway works, a vLLM worker's context limit is read from the value it
+  was launched with, and a task connected to a hosted AI service no longer
+  drops out mid-run (2026-08-20).
+- Reading a workbook now always reports the sheets it contains and marks the
+  ones it could not read, instead of leaving the agent to believe a multi-sheet
+  file had only the first sheet once the cell budget ran out. Large PDFs no
+  longer lose content, and a task that had read an image no longer stalls on
+  its follow-up run or loses that image permanently (2026-08-17).
+- A single unreadable attachment no longer keeps a task from finishing, and
+  invented tool names no longer appear in a run (2026-08-13).
+- Reflection no longer saves a workflow that would not load, and it works again
+  on the backends where it had been failing (2026-08-12).
+- The server no longer starts without authentication when its config file
+  cannot be read, and a queued task with no eligible worker says so in the UI
+  instead of sitting silently (2026-08-10).
+- The agent can use Python for spreadsheets, plots and images again, and
+  generated SSH keys are always usable (2026-08-09).
+- Deleting a task now clears its subtask records too, and subtasks no longer
+  leak between tasks (2026-07-31).
+- X (Twitter) search and post retrieval work again (2026-07-21).
+- The Movement Map's "go to this movement" control lands on the right step,
+  search result cards stay attached to the answer instead of disappearing, and
+  an image pasted into a message sent while the agent is working is linked to
+  that message so the agent reads the file it was meant to (2026-07-18).
 - Model selection menus no longer get clipped by the chat viewport, and the
   “jump to latest” control stays anchored above the composer
   (2026-07-12).