maestro/CHANGELOG.md

# Changelog

All notable changes to MAESTRO are documented here. The format is loosely based
on [Keep a Changelog](https://keepachangelog.com/), and the project aims to
follow semantic versioning.

## Unreleased

### Added

- Files open in floating windows that stay on top of whatever you are doing —
  dragged by the title bar, resized from the corners, snapped to a screen edge,
  up to eight at once, with position and size kept when you move to another
  chat. A file the agent is writing or editing opens by itself and streams in,
  badged "generating / unsaved" until the write lands, or aborted, failed or
  approval-pending when it does not (2026-09-17).
- Workspace apps can be added from a local HTML file — "Add app" in the Apps
  tab installs it under `apps/{name}/index.html`, takes the display name from
  the document title, and lists anything in the page (downloads, file pickers,
  new windows) that the sandbox may not allow (2026-09-17).
- An LLM log tab shows every request and response — timestamp, purpose, step,
  model, token counts, duration, tools called — and opening a row reveals the
  prompt, the reply, tool arguments and tool results separately. The same
  transcripts are written to the chat's `logs/` with a configurable retention
  (default 30 days), and filtering and full-text search cover the whole
  archive rather than the rows on screen (2026-09-17).
- The trace tab gained per-call graphs (cache hit rate, context size, prompt
  load time, generation speed), a "time by activity" table breaking duration
  down by tool, by LLM purpose and by step, a record of every compaction, and a
  summary of what the last reflection learned with a before/after diff of
  memory (2026-09-17).
- Chats can be spun off from text you select in a message or a Markdown
  preview, into this workspace or another, with the quoted passage passed as
  reference material rather than as instructions. The agent can be asked to
  spin a topic off as well (`SpinOffTask`, off by default); it inherits your
  ownership and visibility, and spinning off into a different workspace asks
  you to approve first (2026-09-13).
- Admins can read the audit log in the UI and export every record matching the
  current filter as JSONL, streamed rather than held in memory (2026-09-13).
- Running workers is easier to see and configure: per-worker cards with live
  state, endpoint auto-fill, a connection type for hosted OpenAI-compatible
  services (health-checked against `/v1/models`, API key sent), per-worker
  image/audio/video capability, per-worker context limits, and automatic
  routing of a task to a suitable model. Worker and node status moved into a
  floating panel reachable from any screen, showing free slots, who holds them,
  and per-node throughput (2026-09-13).
- Speech runs both ways: live transcription of microphone and system audio in
  its own tab with a running translation beside the original, a Voice mode that
  takes spoken instructions and shows listening / working / waiting as a
  character expression, and a `Speak` tool that turns text into an audio file
  playable in place. The two endpoints are configured separately and `Speak` is
  off by default (2026-09-12).
- The `.xlsx` preview is a spreadsheet: colors, fills, borders, column widths
  and row heights render as they are in the file, formulas are recalculated,
  and cells can be edited in place with a ribbon for bold, text color, fill,
  borders, alignment, row height and number format. Columns can be inserted and
  deleted, cells merged and unmerged, edits save by themselves, and a selected
  range can be handed to the agent with "Ask the agent" (2026-09-12).
- A grounded answer mode restricts the reply to workspace material and the
  pages fetched for that turn, prints `[S1]`-style markers linked to source
  cards, and says so when the material does not contain the answer. It can be
  chosen per message and set when creating a task (2026-09-12).
- Reading long documents got easier: a collapsible table of contents in the
  Markdown preview, export of a Markdown preview to HTML with its styling,
  Outlook `.msg` preview, and page-range reads for PowerPoint and email the way
  PDFs already worked (2026-09-11).
- The task overview is now a dashboard — mission goal, current focus, what is
  done and what is left, with constraints and decisions collapsed — plus
  elapsed time, measured tool calls, compaction count, worker and recent
  generation speed. Values that were never measured say so instead of showing a
  zero (2026-09-10).
- Files tab: deleted files and folders go to a Trash and can be put back, with
  a second explicit confirmation before anything is erased for good; files the
  agent writes keep a version history with a colored diff and a "restore this
  version" action; and the list can be filtered by name, by category, by the
  task that produced a file, or down to this task's files, with search covering
  subfolders (2026-09-09).
- Delegate and subtask runs have their own tabs, with their conversations and
  full outputs readable rather than truncated (2026-09-08).
- Admins can change the outbound network mode, the allow list and server-side
  traffic observation from Settings without restarting; deployments that pin
  these in an external config file are told why the fields are read-only.
  Fonts, the editor and the map library are served by the application itself
  instead of third-party CDNs (2026-09-08).
- Chats get a short name generated for them and the list shows it above the
  request text, and a new Activity screen lists the chats you can see across
  every workspace you belong to, newest activity first. Hidden and archived
  workspaces stay out of it (2026-09-08).
- Navigation moved to a vertical icon rail on the left edge, with search in the
  top bar; inside a chat the pane rail sits on the right. The rail folds away
  on narrow windows and opens with a swipe, and the previous horizontal tab bar
  can be restored in Preferences (2026-09-05).
- Human verification (CAPTCHA) is no longer a dead end: the solve screen and
  its login state are per workspace and shared with that workspace's members, a
  card appears in the chat that was blocked, "Resolved (continue)" restarts
  every chat waiting on that screen at once, a task that cannot reach an answer
  any other way parks and frees its worker instead of failing, and "Skip"
  proceeds without solving (2026-09-05).
- Notifications and reminders collect behind the bell across workspaces, with
  90 days of history, upcoming reminders, and a count of what happened while
  the app was closed. The agent can create and cancel reminders, calendar
  events can carry a "notify N minutes before", and workspace editors can add,
  edit and delete calendar events (2026-09-05).
- Chat is a four-column layout — icon rail, conversation, selected pane and
  open files — with keyboard-movable splitters, and the conversation stays
  visible whatever pane you select. Opening files in a column rather than a
  window is a preference (2026-09-01).
- The agent can edit Office documents in place instead of regenerating them:
  Excel values, formulas, cell formats, merges, column widths and number
  formats — charts, pivot tables, conditional formatting, macros and other
  sheets survive, and a save that would disturb untouched cells is aborted —
  Word paragraphs including documents with tracked changes, and PowerPoint text
  (2026-09-01).
- Model reasoning is visible and kept: a reasoning panel in chat, dictionary
  lookups and document Q&A, shown only when the current run actually produced
  reasoning, still readable after the tool call that followed it, and recorded
  so it can be read back later (2026-08-27).
- A run that keeps thinking without producing any text or tool call is rewound
  and resent once its reasoning passes a character limit ("Max Thinking",
  default 100000, 0 to disable), with a single short nudge appended. This only
  works on backends that return reasoning in a separate field (2026-08-25).
- Workspaces can connect an external file store — SharePoint, OneDrive or Box —
  scoped to one folder, read-only, through your own account, and the agent can
  list the permitted locations and the names directly under them. Every
  connection is logged and admins have a kill switch (2026-08-20).
- Whether the command sandbox may reach the network is a per-workspace setting
  (inherit / allow / block; blocked by default, owner-only, logged), and
  whether isolation is actually in force is shown in Settings → Safety, as a
  badge on the workspace and task headers when commands can reach out, and
  recorded per job and per command (2026-08-20).
- A per-user cap on concurrently running tasks (default 1 for users, 2 for
  admins, 0 for unlimited) stops one person's queue from filling every slot.
  Tasks over the cap are passed over rather than failed, and worker slots are
  now shared across every feature that needs a model (2026-08-18).
- Whole tool groups can be switched off for a deployment through
  `tool_packs.disabled` in `config.yaml` — X, YouTube, maps, Amazon,
  transcription, text-to-speech, Microsoft Learn search and slide generation. A
  disabled group disappears from the agent and from the workspace tool list;
  the change is applied at startup (2026-08-15).
- Webhook notification delivery (Discord, Teams and similar) has a Settings
  section for enabling delivery, the public URL and the sending limits, so a
  workspace no longer registers a destination and watches test sends fail for
  no visible reason. Failures are separated into "delivery disabled", "rejected
  by the endpoint" and "could not be reached" (2026-08-12).
- A2A: external agents can fetch a run's output files from a link, a delegation
  can only target workspaces you can write to, and admins can enable or disable
  A2A from Settings without a restart (2026-08-10).
- Pages the agent opens are kept along with the images they contained, under
  `source/` in the workspace, with limits on how many and how large — 20 images
  and 5MB each by default, adjustable in Settings (2026-08-10).
- Selecting text in a message or a Markdown preview opens a selection menu (on
  by default) offering a short explanation of the passage or a web-backed
  lookup with sources (2026-08-09).
- Admins can set instructions that apply to every user's agents, and a
  workspace can carry automation rules that add instructions, deny an
  operation, or require your approval before a tool runs or before the agent
  finishes. Rules are off by default, and those that fire show up in the chat
  (2026-08-03).
- The agent can list the other chats in the workspace newest-first
  (`ListWorkspaceTasks`) as well as search them. Search defaults to "any of
  these words" ranked by relevance, with an all-words filter available, and a
  phrase written without spaces that matches nothing is retried word by word
  (2026-07-24).
- A Discord connector (beta) joins Slack: mention the bot in a Discord server
  and it runs a task and replies with the result. The bot token is registered
  under Settings → chat connections; a dedicated private channel and
  least-privilege permissions are recommended (2026-07-21).
- A compact Movement Map in chat shows the current step, completed work,
  retries, and user messages without taking over the conversation. Nodes can
  be used for navigation, while concise tooltips explain each step
  (2026-07-12).
- Slack channel connections can be managed from Settings, including
  channel-to-workspace bindings and reliable mention ingestion and replies.
  Reminders and in-app notifications make scheduled and background work easier
  to follow (2026-07-12).
- Chat now provides per-task model and reasoning-effort selection, plus prompt
  coaching before sending follow-up instructions (2026-07-11).
- Research pieces (`research` / `sns-research` / `sns-deep-sweep`) now write
  date-stamped outputs (e.g. `output/report-2026-07-09.md`,
  `output/deepdive/2026-07-09/`) so repeated runs in a persistent workspace
  accumulate instead of overwriting the previous report. The agent system
  prompt now always includes the current date/time (2026-07-09).
- Draft autosave for the new-task dialog, chat composer, feedback comments,
  and continue instructions — text survives an accidental close or reload.
  Files can be attached by pasting (Ctrl+V) into the new-task dialog
  (2026-07-09).
- Settings: a "Skill quotas" section plus editors for several previously
  config-file-only options (max stream time, subtask debounce, summary
  headroom, .msg size limit, TLS minimum version, worker health-check
  interval) (2026-07-09).

### Changed

- The trace tab no longer lists individual records. What remains is the graphs,
  the time-by-activity table and the compaction record; prompts, replies and
  tool results are read in the LLM log tab, which the trace tab links to
  (2026-09-17).
- Viewers can no longer start new chats, and workspace editors can now delete
  files — deletion became reversible with the Trash, so there was no longer a
  reason to separate who may edit from who may delete (2026-09-09).
- Chat and scheduled-run visibility is no longer chosen per item from
  private / organization / public. Who can see a chat follows from its owner
  and the members of the workspace it lives in, which is how it already behaved
  inside a workspace, and the route that let such a chat be switched to public
  after creation is closed. Chats outside a workspace keep their current
  visibility (2026-09-08).
- Settings are fully localized: field labels, section names, sub-headings and
  the settings search all appear in the interface language, as do task states
  and the remaining English strings elsewhere in the UI (2026-09-07).
- A follow-up to a finished chat passes the previous exchange verbatim by
  default instead of a summary, so file contents and decisions survive at the
  cost of a larger request; the history icon in the composer switches back to a
  compacted hand-off, per chat. Summarization still applies where verbatim
  cannot be trusted — old chats with no transcript, a shared log directory, a
  turn sent with grounded answers on, and re-runs after a failure
  (2026-08-28).
- A server whose Bash sandbox is set to `auto` refuses to start when the
  isolation mechanism (bwrap) is unavailable, rather than starting unprotected
  while the settings still claim outbound traffic is blocked. Install bwrap to
  enforce it, or set `safety.bash_allow_network: true` to accept the risk; the
  startup error names both routes and the setting that stopped the boot. `off`
  still starts with a warning (2026-08-27).
- The A2A `issuer` must be the exact public URL with the pathname `/oidc` — a
  trailing slash or any other shape stops A2A from starting, with the reason
  shown in Settings, so correct it before upgrading. The URLs advertised over
  OIDC now match that public URL even when the server is reached over internal
  HTTP behind a proxy (2026-08-27).
- Web search is more restrained: a provider that has just served a
  human-verification page is set aside for a while, the same query is not
  repeated within a short window, uploaded files are no longer all read up
  front, and the number of searches a task should need is given as a budget
  (2026-08-27).
- The LLM Gateway's OpenAI-compatible `/chat/completions` streams only when
  `stream: true` is set, matching the OpenAI default, instead of streaming
  whenever `stream` was omitted. External clients that relied on the old
  behavior should set `stream: true` explicitly (2026-08-26).
- When a conversation hits the model's context limit, the hand-off to the next
  step replaces the conversation with a summary rather than passing the
  oversized history plus a summary, which made the receiving step hit the limit
  again immediately. A verify step that hits the limit completes the task with
  the summary instead of discarding finished work; steps that have not produced
  an answer yet still abort and retry (2026-08-18).
- Office files are rejected before being opened when their contents do not
  match the declared type, or when they would expand far beyond their stored
  size, at every entry point rather than only the main one (2026-08-12).
- A fresh install that listens on an externally reachable address (Docker does)
  creates an admin account at startup and prints the password to the startup
  log and `data/.initial-admin-password`, instead of coming up with no
  authentication at all. Changing the password stops the log output, and a
  warning bar appears if authentication is left off while exposed (2026-08-03).
- The LLM Gateway authenticates only keys that have been issued and recorded,
  so every call is attributed; keys written in `config.yaml` are imported at
  startup and keep working. Usage is now recorded for external clients too, and
  gateway callers appear in the worker view (2026-07-30).
- Pieces are called **workflows** in the interface and their movements are
  called **steps**, replacing the mix of "Piece", "piece" and "task type" that
  appeared in different places. Only the wording changed (2026-07-29).
- Database migrations are applied before the server process starts, and a
  migration failure stops the boot with the error on the console rather than
  leaving a half-updated database running (2026-07-14).

### Removed

- The `slide`, `brainstorming` and `ssh-ops` workflows were retired — each had
  been run a couple of times in total, and a longer catalogue makes automatic
  routing less accurate. Nothing became impossible: the tools remain, so the
  same requests work in `chat`. The interactive `ssh-console` workflow stays
  (2026-08-12).
- The database-less Gateway startup mode (`AAO_GATEWAY_NO_DB`) is gone. It
  existed to authenticate against keys in the config file, which is no longer a
  supported route (2026-07-30).
- Per-task share links are gone; sharing is by workspace. Add people as members
  or send an invite link. Opening an already-issued task link explains the
  change (2026-07-29).

### Fixed

- A failing MCP server says why: a connection error after saving a server is
  reported instead of only reaching the server log, "Refresh tools" failures
  are classified (HTTPS required, private IP blocked, name resolution,
  connection refused, HTTP status, authentication, timeout) with the next step
  spelled out, a server whose tools were never fetched is marked unverified,
  and both calls honor a timeout instead of hanging for minutes (2026-09-17).
- Log cleanup no longer removes another chat's records, and SSH operations left
  "running" by a restart are reconciled (2026-09-12).
- A broken or unresponsive web page no longer holds up a read, a model that
  returns nothing no longer keeps a task waiting for tens of minutes, and
  browser pages opened behind web search are closed instead of accumulating
  (2026-09-11).
- "Max stream time (minutes)" from Settings is actually applied (2026-09-08).
- A turn that produced only reasoning is no longer aborted as an empty
  response, and a continued task no longer rebuilds the same summary each time
  (2026-09-07).
- Several controls were unreadable in one of the two themes — the SSH console
  tab strip and its close buttons, delete buttons in Settings, dialog
  backdrops, and a handful of labels that matched their background
  (2026-09-05).
- One unreadable entry or one dangling link no longer hides an entire folder in
  the Files tab, in the workspace file list or in a shared app (2026-08-31).
- Mermaid diagrams render sharply and a diagram that failed to draw is no
  longer delivered as-is, and right-clicking no longer clears the text you had
  just selected (2026-08-25).
- Passwords typed during browser automation are no longer written verbatim to
  the browser operation log (2026-08-20).
- LLM backends behave consistently again: a worker no longer silently runs a
  different model than the one configured, backends that omit tool-call
  identifiers no longer collide with the ones generated for them, vLLM behind
  the Gateway works, a vLLM worker's context limit is read from the value it
  was launched with, and a task connected to a hosted AI service no longer
  drops out mid-run (2026-08-20).
- Reading a workbook now always reports the sheets it contains and marks the
  ones it could not read, instead of leaving the agent to believe a multi-sheet
  file had only the first sheet once the cell budget ran out. Large PDFs no
  longer lose content, and a task that had read an image no longer stalls on
  its follow-up run or loses that image permanently (2026-08-17).
- A single unreadable attachment no longer keeps a task from finishing, and
  invented tool names no longer appear in a run (2026-08-13).
- Reflection no longer saves a workflow that would not load, and it works again
  on the backends where it had been failing (2026-08-12).
- The server no longer starts without authentication when its config file
  cannot be read, and a queued task with no eligible worker says so in the UI
  instead of sitting silently (2026-08-10).
- The agent can use Python for spreadsheets, plots and images again, and
  generated SSH keys are always usable (2026-08-09).
- Deleting a task now clears its subtask records too, and subtasks no longer
  leak between tasks (2026-07-31).
- X (Twitter) search and post retrieval work again (2026-07-21).
- The Movement Map's "go to this movement" control lands on the right step,
  search result cards stay attached to the answer instead of disappearing, and
  an image pasted into a message sent while the agent is working is linked to
  that message so the agent reads the file it was meant to (2026-07-18).
- Model selection menus no longer get clipped by the chat viewport, and the
  “jump to latest” control stays anchored above the composer
  (2026-07-12).
- Pet and star animations now retain stable identities and smoother timing,
  reducing flicker and visible jumps around worker activity
  (2026-07-12).
- Repeated Slack mention events no longer create duplicate tasks or replies,
  and connector status and failure feedback are clearer in Settings
  (2026-07-12).
- Delegate run cards showed "0 tool calls" (and empty tool/file breakdowns)
  regardless of actual activity; tool events now carry their own run
  attribution (2026-07-09).

## v0.2.0 (2026-07-09)

A month of work since the initial release, centered on shared workspaces,
agent-to-agent (A2A) collaboration, and much deeper visibility into what agents
are doing.

### Added

- **Shared workspaces** — the workspace is now the single home for everything:
  a workspace rail, per-workspace chats with search/filtering, colors and
  descriptions, running-count badges, workspace-scoped schedules, reusable
  invite links, and credential sharing with scoped grants. The separate
  "Tasks" tab is gone.
- **Workspace tool policy** — enable/disable tools per workspace from
  Settings → Tools; piece YAML no longer controls tool availability. Agents can
  request a missing tool or Python package mid-task and use it as soon as you
  approve in chat; workspaces can also pre-install extra Python packages.
- **A2A protocol support** — publish an Agent Card, delegate skills to external
  agents with per-delegation resource limits, run long A2A tasks non-blocking,
  and list/revoke delegations from Settings (OAuth-based authorization server
  underneath).
- **SSH integration** — register SSH connections per workspace, run one-shot
  remote operations, or open an interactive console where you and the agent
  share one PTY (multiple sessions with tab switching).
- **Delegate observability** — sub-agent (delegate) runs are now visible:
  live cards with the currently running tool, result previews and abort
  reasons, LLM token counts, child-run rollups, and a live console. LLM
  execution itself shows live state, attempt badges, and classified
  interruption reasons.
- **Workspace apps** — self-contained HTML mini-apps that read/write workspace
  files, generated with starter templates and a self-E2E pass, shareable via
  read-only public links.
- **Files tab upgrades** — folder create/rename/move/delete/download,
  drag-and-drop organization, touch support, a details view (size, modified
  time), file provenance (which task created a file), a protected `readonly/`
  area, and automatic recognition of files you drop into the workspace.
- **Richer previews and reading** — Excel/PowerPoint/Word preview, PDF
  page-range reads, and a single `Read` tool that auto-detects
  .xlsx/.docx/.pdf/.pptx/.msg.
- **X (Twitter) research** — tools restored (new transaction-id scheme), home
  timeline support, full text of long-form X Articles, and an "SNS deep sweep"
  piece that triages a timeline and deep-dives each post with a clean-context
  sub-agent.
- **Cross-task recall** — agents can search other chats in the workspace
  (`SearchWorkspaceTasks`), search their own long conversations, and subtasks
  can look back at their own transcript; multi-keyword AND search included.
- **Memory & learning** — lessons captured mid-task into persistent memory /
  AGENTS.md, a Memory & Learning settings tab with reflection history and
  revert, and an extended mission brief that pins user constraints and
  decisions.
- **English UI** — recently added screens are fully localized (i18next);
  UI is bilingual Japanese/English throughout.

### Changed

- Chat screen: taller conversation viewport, a card-style auto-growing
  composer, an always-visible context-usage gauge, and tool rows with
  execution timestamps.
- Research pieces split large investigations into serial delegate runs to keep
  the orchestrator context small.
- Context handling keeps more of the recent conversation verbatim when
  compacting and retains longer histories on large-context models.
- Job time limits are configurable from Settings, with clearer hard-kill
  reasons (default 180 minutes).

### Fixed

- A context-limit livelock that aborted tasks seconds after start with
  "max iterations (200) exceeded" while doing no work.
- Docker: clean `docker compose up --build` reliably installs Chromium (npm
  bin-name collision), and Windows/WSL2 checkouts build cleanly (`.env`
  optional, LF pinned via `.gitattributes`).
- HTTPS redirect kept firing after HSTS was disabled (sticky-HSTS opt-in fix).
- Shift_JIS and other non-UTF-8 Japanese text was misdetected as binary; BOM
  handling fixed.
- Raw HTML in chat messages no longer breaks the conversation layout.
- Models that require the system message first no longer error mid-task.
- Skills whose folder name diverged from their display name could not be
  deleted or edited.
- Attaching a file with an existing name no longer overwrites it silently —
  the old version is evacuated to `old/`.

## v0.1.0 — Initial public release (2026-06-02)

First open-source release of MAESTRO, an agent orchestration platform:

- Runs tasks against any OpenAI-compatible LLM endpoint (Ollama, vLLM, …).
- LLM-classified task routing into **Pieces** (YAML workflows) of **movements**.
- Sandboxed tool runtime (Read/Write/Edit/Bash/Glob/Grep, Office, Web, Browser,
  Image, Data/SQLite, Knowledge/RAG, SSH, MCP, sub-tasks, and more).
- Bash tool sandbox (bwrap-based filesystem/network/env isolation with a
  hardened fallback) and a declarative pre-baked Python toolchain.
- Optional LLM Gateway (virtual keys, budgets, metrics), reflection-based
  learning, scheduled tasks, and a React web UI.
- Apache-2.0 licensed.