FleetQ v1.27.0

What's changed

• chore(phpstan): regenerate baseline on CI runner (PHP 8.4.21) (a72e4a1)
• style: fix pre-existing Pint violations blocking CI (b469e65)
• chore(release): 1.27.0 — UI-gap backlog + docs (0f7d5b9)
• feat(mcp): 13 read/write tools for the new UI features + safe team resolution (d0b32b7)
• feat(outbound+broadcast): chunk broadcast sends; complete 3 outbound channels (fc5d759)
• fix(security): explicitly team-scope project dependency dropdown + lookup (275e638)
• feat(ui): Wave-3 partials — editable agent heartbeat + dry-run, EditProjectForm deps repeater, human-task SLA escalation config (131e947)
• feat(ui): Wave 3 — reasoning bank, error-mode catalog, test suites, KG communities, crew chat room (e538fc3)
• fix(security): close cross-tenant gaps in secret-scan MCP tool + checkpoints page (48f0e1a)
• feat(ui): Wave 2 — blacklist, outbound proposals (RO), skill ops, workflow compensation+simulation, experiment checkpoints, memory proposals queue, credential secret-scan findings (1ee81be)
• feat(outbound): register 5 chat channels as core drivers + config UI (3354c45)
• feat(ui): Wave 1 batch 1 — AgentSession viewer, release signing-key mgmt, drift + eval-monitor dashboards, broadcast list/create, CSV import wizard (afe0ce8)
• chore: correct domain/MCP/migration counts in CLAUDE.md (08d702b)
• feat(crew): QA validation surfaces an honest 'could not verify' coverage gap (4f3adc2)
• feat: searchable model picker component + team-settings refreshManagedModels (ca9a011)
• fix: make dynamicCatalogModels/resolveCatalogApiKey protected for cloud override (0c92c7b)
• fix: annotate credentials cast in resolveCatalogApiKey for larastan (bc9a845)
• feat: dynamic model catalog sync for managed providers (OpenRouter) (d9122dd)
• feat(evaluation): Agentic AI Flywheel — self-growing eval set, error-mode catalog, drift + production monitors (5c52a11)
• fix(chatbot): remove unreachable default match arm (PHPStan match.alwaysTrue) (3f9e699)
• style: fix pre-existing Pint violations blocking CI (34ac72f)
• fix(chatbot): least-privilege access levels for SupportAssistant/Custom (b28aee1)
• test: pin bash_sandbox_mode in GracefulToolDegradationTest (hermetic) (6bfd2f1)
• fix(phpstan): charter property — @Property tag + resolve AgentResource access via ->resource (cd0f3bd)
• feat: Squad + Web IQ borrows — tool-call governance, decision log, evidence citations, agent charter (2859494)
• fix: pipeline-hardening — graceful tool degradation + memory query/embedding fixes (361b58f)
• feat(agent-chat): A2A consumer-side agent-card discovery (flag-gated, discovery-only) (2afd53e)
• fix(phpstan): drop stale isLocalProvider unused-method baseline entry (70e71c9)
• refactor(ai): route all embedding generation through the embedding seam (a20885f)
• feat(ai): pluggable embedding seam + SemanticCache model namespacing (097c75f)
• fix(ai): resolve provider/model mismatch at resolution time + cap memory embedding input (f4fe559)
• feat(widget): thumbs up/down feedback on assistant messages (ea7381d)
• fix(phpstan): type policy/arbiter code; baseline 2 larastan enum/date quirks (12d58fc)
• fix(chatbot): strip tool-call narration, enforce user language, enrich citations for all types (3e702a5)
• fix(governance): tenant-scope AgentPolicyGetTool version query + Gate::authorize on policy Livewire writes (97900fc)
• fix(security): explicit tenant scoping on AgentPolicy Livewire pages (8a9b1c7)
• feat(crew,ui): competitive arbitration + AgentPolicy Livewire UI + proposal explain panel (a21298e)
• feat(approval): versioned policy-governed autonomy (AgentPolicy + replay) (6098009)
• fix(mcp): CrewCostEstimateTool — plain Team::find + reword comment for tenant-scope guard (75716be)
• feat(orchestration): cost-aware orchestration — fan-out cost gate + tier selector (308d83b)
• fix(mcp): add #[IsDestructive] annotation to MetricTagValueTool (4b90dfc)
• feat(metrics): Return on Cognitive Spend (ROCS) — cost↔value ROI (d85d5ed)
• chore(phpstan): baseline taste-sprint false-positives (8.4) (8fcd67e)
• chore(phpstan): bump CreateAgentTool Request::get baseline count 6->7 (pre-existing drift from taste sprint) (d208abe)
• feat(phoenix): per-team project routing + auto-ingest local-agent transcripts (f7f2e1b)
• fix(marketplace): carry taste through publish/install round-trip (3c12026)
• fix(agent): complete taste parity — assistant get + workspace round-trip (0b378e2)
• feat(agent,budget,memory): borrowed-ideas sprint (contextrie + mercury) (89a7d44)
• fix(test): force local media disk in bug-report widget + signal tests (52238c5)
• fix(test): stub resolveInternal in clarification + plan-with-knowledge tests (bf981ce)
• chore(ci): regenerate PHPStan baseline on runner (clears pre-existing drift) (1c00c60)
• fix(ai): resolve Team explicitly for resolveInternal to satisfy PHPStan (ec82144)
• style: fix pre-existing Pint drift on 8 files (CI Code Quality gate) (e0668fa)
• fix(ai): BYOK-aware provider resolution for internal pipeline LLM calls (f29892e)
• feat(widget): public streaming media route for bug-report attachments (f032b0a)
• fix(sentry): drop partner-webhook retry noise (issue #811) (b386696)
• fix(storage): address code-review findings (base) (b0b6bf5)
• docs(readme): add architecture flowchart (2b1b6fe)
• feat(storage): migrate upload call sites to TenantStorageManager (stage 3+5) (34c5e2b)
• feat(storage): S3 tenant disks + TenantStorageManager gateway (stage 1-2) (914a07f)
• fix(observability): pt3 hotfix — extract before_send closure to static class (31ed1d6)
• fix(observability): pt3 — move pattern filters to Sentry before_send hook (e79710d)
• fix(phpstan): drop 24 stale baseline entries on ResolveAgentToolsAction (800ed91)
• fix(observability): pt2 — log perms, watchdog queue/timeout, more Sentry filters (5403eef)
• fix(observability): suppress Sentry noise + recover from auth/no-provider errors (5ab32bb)
• fix(phpstan): @Property hints on enum-cast models + targeted bug fixes (8451a75)
• fix: audit_entries team_id + Livewire authorize gates (2feca8d)
• feat(agentforce-borrowed): safety middleware, MCP registry, agent workspace (e2a6765)
• fix(billing): walk back by duration_ms when aggregating execution tokens (bdddaa0)
• feat(billing): expose cost_credits + real tokens in OpenAI usage block (e85a3e3)
• fix(agent): drop trailing tool mention for tool-less agents (29e46b9)
• fix(agent): honor partner system message and stop hallucinating tool calls (f3a0003)
• fix(security): cap transcript span amplification + authorize attribution ids (00427d0)
• feat(observability): ingest local-agent transcripts into Phoenix traces (246fca1)
• fix(ai): count sub-program key in availableProviders gate (f4b8a00)
• fix(ai): scope agent execution to the token/agent team, not the UI team (cf89fb5)
• fix(ai): count sub-program key in providerHasApiKey gate (a325cbb)
• fix(skill): scope lift-eval dataset lookup to team (cross-tenant IDOR) (4bc2670)
• feat(skill): blind A/B skill-lift eval + failure-mode lint + public quality leaderboard (2a09532)
• fix(quality): resolve phpstan findings introduced by refactor extractions (e19fee6)
• refactor(skill): extract ExecuteSkillAction::execute pipeline phases (9d88656)
• refactor(assistant): break up SendAssistantMessageAction Brain Method (58eace3)
• refactor(tool): extract ResolveAgentToolsAction::execute pipeline phases (dff9df4)
• refactor(tool): extract browser_task closure in ToolTranslator::buildBrowserTools (259ff82)
• refactor(workflow): extract resolveNode Brain Method into per-type handlers (883e696)
• fix(code-index): path-traversal guard in PolyglotCodeExtractor materialize (ee2730c)
• feat(code-index): polyglot extraction via CodeGraph + code_impact tool (cee45cc)
• fix(ci): repair pre-existing Multica test failures + secret-proxy phpstan (b2a9e39)
• test: make RunSecretVault tamper assertion deterministic (39dadee)
• feat(ai): proxy-based secret injection for claude-code-vps (596c790)
• feat(local-agents): catalog parity with Multica runtime set (375a387)
• feat(skill): SkillKit hardening — recommended sections + GitHub import (d9926ce)
• chore(phpstan): clean larastan findings for agentskills/nudge (4faf3b0)
• feat(skill): agentskills.io import/export + memory nudge (dc9f03b)
• fix(phpstan): clear this session's larastan regressions (4f0f498)
• fix(mcp): annotate InspectDiffCommentsTool team-self-lookup (CI gate) (139bf8d)
• feat(local-agents): runtime-extensible CLI registry (Multica borrow B) (85b8bec)
• fix(marketplace): symmetric agent publish/install round-trip (34549d8)
• feat(agent): full agent definition round-trip in workspace export/import (e90bd42)
• test(mcp): pin MCP Apps capability gate to SEP-1865 (2026-01-26) (8e5741a)
• feat(guardrail): code comment guardrail (oh-my-opencode borrow) (31b2ba8)
• feat(guardrails): agent action guardrails — SQL gating, N-of-M approvals, LLM approval summaries (247f3a9)
• feat(db): add pgvector columns to existing tables (idempotent, guarded) (f3086ce)
• feat(signal): fix-durability loop — detect & learn from fixes that don't survive (dd87a42)
• fix(signal): annotate Signal metadata + learned_relevance properties for PHPStan (4e92ec5)
• feat(signal): borrow CondenseIt — HN/Reddit/GitHub-Releases connectors, novelty enrichment, learned relevance ranker (81653b6)
• feat(governance): dotCMS-borrowed brand voice, content quality gate, MCP schema introspection (7511d7f)
• chore: align main to develop tree, preserve local-mode CSP fix (138b280)
• chore(phpstan): regenerate base baseline in CI runner env (0f2413d)
• feat(api): support tool_ids on agent update endpoint (f006059)
• fix(sentry-watchdog): dispatch one job per (team, project) (3c8ddfe)
• fix(sentry-watchdog): scope triage to the integration's Sentry project (ff35dcc)
• fix(sentry-watchdog): unblock autonomous PR delegation (07bdf01)
• fix(phpstan): @Property annotations for SkillVer...

v1.26.0 — Kanwas context suite, Sentry Watchdog, Phoenix tracing, agent governance

What's changed

• chore(release): 1.26.0 (3412924)
• fix(ai): resolve sub-program teams to their dedicated LLM key (bf08aff)
• fix(deploy): use getAttribute for team_id in context-git-sync model hooks (7825c5a)
• fix(sandbox,git-sync): symlink-safe teardown + serialize workflow YAML pushes (4cba192)
• fix: address QA + security review findings (kanwas-inspired) (9a5696d)
• feat: kanwas-inspired sprint — unified timeline, git-backed context, sandbox observability, project snapshots (8104649)
• fix(integration): dedup polled signals by source_native_id (fe734ce)
• feat(ai): dedicated provider for internal classification LLM (ff9c235)
• fix(signal): cap Sentry Watchdog batch + dispatch one job per team (6638a53)
• fix(integration): use valid Sentry search query for unresolved issues (4fb247e)
• feat(ai): dedicated sub-program platform LLM key (4833f4e)
• fix(signal): correct Sentry Watchdog signal matching and issue ingestion (5c4941b)
• fix(signal): team-aware intent classification, skip sentry source (9df3753)
• feat(api): default agent provider/model to team-resolved platform default (4ef64b1)
• fix(mcp): annotate SentryWatchdogRunTool as destructive (75881a7)
• fix(scheduler): remove ->sentryMonitor() — crashing cron check-ins (9599d8e)
• feat(integration): per-project scoping for the Sentry driver (6ebeac5)
• feat(signal): Sentry Watchdog — email digest channel (d544272)
• feat(signal): Sentry Watchdog — autonomous Sentry issue triage (8bacf67)
• fix(sentry): raise cron monitor failureIssueThreshold to 4 (d879cd6)
• fix(sentry): stop shadowing sentry-laravel's HubInterface binding (af2ae76)
• feat(sentry): cron monitoring, profiling, logs, MCP tool tags (bd58524)
• fix: resolve four Sentry issues — Builder/HAVING/pgvector/Alpine var (dc2a57b)
• feat(phoenix): complete pilot — hierarchy, sampling, masking, MCP, metrics, alert (8fdbcb5)
• fix(ai-gateway): Phoenix exporter must speak protobuf, not JSON (9329d4b)
• feat(ai-gateway): add Phoenix OTLP export middleware (3943748)
• fix(dashboard): add Gate::authorize to DashboardPage::setPersona (a169b9c)
• feat(memory): route extractors through proposal review pipeline (8e0c0c4)
• chore: add circuit-breakers:reset command before branch sync (2809f4e)
• feat(mcp): auto-discover Tool classes from app/Mcp/Tools/** (d6de9b3)
• fix(mcp): add #[IsDestructive] to 4 write-tier tools (b93458d)
• fix(mcp): add #[IsDestructive] to 4 write-tier tools (09380d1)
• feat: borrow 5 ideas from prilog.ai (1c844ff)
• fix(mcp): rename notFound() to notFoundError() in governance sprint tools (787a6f4)
• chore(phpstan): regenerate baseline to absorb develop debt (68a4d5e)
• chore: update CLAUDE.md boost guidelines (cf211e9)
• feat(bug-reports): admin UX improvements — reopen, edit, sort, dates, search (#81) (56be79e)
• fix(livewire): add Gate::authorize to BugReportDetailPage::saveEdit (cd23b25)
• fix(ci): fix PHPStan errors and regenerate baseline (dd27034)
• fix(ai): use setex instead of set with array options in ComputeProviderRankingJob (3c046cc)
• fix(ai): use setex instead of set with array options in ComputeProviderRankingJob (a47b460)
• style: apply pint fixes — observability sprint files (8197ad2)
• fix(deps): regenerate composer.lock — add prometheus + laravel-health (8b6fea7)
• feat(bug-reports): admin UX improvements (1863277)
• feat: SSE streaming + optimistic UI for agent status toggles, assistant panel, and step terminal (81e0918)
• fix: remove unsupported .minimum()/.maximum() JsonSchema calls from new MCP tools (f996165)
• feat: agent governance — auto-memory, credential domain allowlist, signal relevance scoring, strict protocol audit (eddb826)
• feat(mcp): add MCP tools for 5 determ-borrowed features (52507b3)
• fix(crew/agent/shared): address review findings from determ-borrowed sprint (8df7aa2)
• feat(crew/agent/shared): implement 5 Determ-borrowed patterns (3bcc4a8)
• feat(bug-reports): render markdown in comments (edde9dc)
• fix(observability): ignore stale circuit breakers in alert metric (e1b2b1b)
• fix(observability,bridge,ai): close 3 outstanding bugs from observability sprint (dd655c5)
• refactor(ai): make teamHasProvider() protected so cloud can override (fb29b98)
• fix(observability): close known gaps + ship spatie/laravel-health checks (d7a728d)
• feat(observability): platform observability overhaul — Sprints 1-4 (21879e8)
• feat(widget): refresh bundle + add auto-triage classifier (bug-triage Stage 2 + 3) (3fa42a5)
• feat: add reported_type column to signals (bug-triage Stage 1) (49bbc8d)
• fix: unstick debug-track experiments from building state (fd62648)
• feat(workflow,ui): node executor tests + approval inbox tier badge (7f0757f)
• feat(workflow): bug-fix-merge template + seeder + classify_pr_tier MCP tool (6eafa7c)
• feat(signal): wire bug-fix delegation to per-agent/team default workflow (2158244)
• feat(workflow): node executors + T4 floor invariant for PR tier merge (378c0c7)
• feat(workflow): add PrTierClassifier + foundation for tier-gated PR merge (cd85f0c)
• ci(phpstan): bump memory-limit 512M -> 2G (37d2bda)
• fix(phpstan): set maximumNumberOfProcesses=1 to avoid OOM in CI (6813b97)
• fix: add IsDestructive annotation to 3 Release MCP tools (682873f)
• chore: regen phpstan baseline for entityhq-borrowed features (72f7ac3)
• fix: pint formatting on signal_comments idempotency migration (c6b854f)
• feat: 4 full implementations of previously deferred items (bc7f5bc)
• feat: 10 out-of-scope EntityHQ items (1 deferred — GPG) (c02aa4c)
• feat: borrowed EntityHQ-inspired features (4 features) (ef920a3)
• feat(signal): close bug-fix-agent loop on both ends — reporter follow-up + PR merge (4365fd0)
• feat(signal): idempotent add_comment via optional idempotency_key (dff7892)
• fix(pipeline): use flat input_tokens/output_tokens cols in stage telemetry (b93d062)
• chore(tests): bump phpunit memory_limit 512M → 1G (fd251d3)
• style: pint trailing comma in ProviderHasApiKeyTest (2cf96aa)
• fix(ai-gateway): align providerHasApiKey field name with config/ai.php (6052c3d)
• test(seeders): pin Harbormaster popular-tool entry shape (#76) (e3a50f4)
• feat(seeders): register Harbormaster as a popular MCP stdio tool (#75) (6ce1a3c)
• feat(bridge): SSE streaming consumer for HTTP-mode bridges (5747554)
• fix(signal): route bug-report delegation through canonical state machine (5bd57ee)
• fix(bridge): pass 4xx daemon errors through, drop generic 502 wrap (#73) (2a8f029)
• chore(mcp): bump tools/list page size 300 → 1000 (19ed3a2)
• feat(bridge): HTTP-direct MCP routing for HTTP-tunnel-mode bridges (3f44684)
• fix(test): apply Pint concat_space style to Redis isolation block (1ca0f4b)
• fix(test): isolate Redis cache DB per paratest worker via TEST_TOKEN (3211940)
• fix(test): TeamFactory slug must be unique to avoid SQLite UNIQUE constraint flake (e866d49)
• test(mcp): catch attribute namespace bugs via newInstance() in schema test (c81aef1)
• feat(console): add opcache:clear command (c99b2f7)
• fix(mcp): replace null-bind hack with real McpTeamBinding middleware (067deb0)
• fix(mcp): unblock Barsy bug-fix-agent — schema drift + null-bind null-blindness (563ae42)
• fix(signal,ai): valid ExperimentTrack + per-agent MCP for non-VPS Claude Code (022ebaf)
• fix(local-agents): relay discovery must not depend on local_agents.enabled (e5cbfb0)
• style: pint fully_qualified_strict_types on Credential @Property docblock (d845d9f)
• fix(phpstan): unblock CI on develop — Credential @Property + 1Password fallout (1d52d66)
• fix(bitbucket): drop redundant credential_type guard, harden secret_data typing (35a0124)
• style: pint fix no_multiline_whitespace_around_double_arrow in BitbucketToolsTest (64b5565)
• feat(bitbucket): basic-auth driver + 4 MCP tools for bug-fix-agent (dbc5993)
• feat(auth): passkey login flow on /login (1Password / Apple Keychain / Hello) (3b3c1fe)
• feat(1password): functional CLI-backed integration + site-compat hygiene (41b347d)
• style: pint autofix HttpRequestNodeExecutor (CI green) (dbc4b30)
• fix(security): strip CRLF from tenant-supplied signature header names (31591bc)
• feat(workflow,webhook): close FleetQ Finance migration gaps (8a04002)
• fix(mcp): accept Sanctum tokens at /mcp HTTP endpoint (5a8ce26)
• fix(docker): pivot to mcp-remote wrapper — connects to user's real FleetQ (813097b)
• fix(docker): slim Glama Dockerfile — drop unused exts, ignore platform reqs (f754486)
• fix(phpstan): drop redundant array_values, fix Redis::set ext-redis args, drop dead ?? on int return (798c652)
• refactor(mcp/compact): TDQS-friendly tool descriptions for Glama AAA (91d8ca6)
• feat(glama): root Dockerfile + stdio MCP boot for Glama AAA (c9fa5e3)
• style: pint autofix (7 files) — CI green (8f0bd66)
• feat(ai-gateway): Tier A — per-request BYOK override + cost/latency ranker (a6e4aeb)

Upgrade

git fetch --tags origin
git checkout tags/v1.26.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

v1.25.0 — AI Gateway routing test + PHPStan detox

Maintenance release pairing with FleetQ Cloud 1.25.0 (Document OCR + cross-provider AI Gateway routing).

Changes

• AiGatewayProviderMatrixTest referenced from cloud — asserts FallbackAiGateway correctly routes the three provider archetypes (cloud Prism, claude-code-vps, bridge_agent) through their respective leaf gateways.
• PHPStan baseline detox — 20,599 → 18,913 lines (-8.2%) via two safe levers: bulk-fix ?->X ?? Y → ->X ?? Y for nullsafe.neverNull entries (186 replacements / 119 files) plus baseline regen to drop stale entries.
• DisposableDomains CI fix — manually re-added baseline entry that PHPStan-in-Docker misses but the CI runner catches.

No new MCP tools, migrations, or behavior changes — static-analysis hygiene only.

Full changelog: CHANGELOG.md

v1.22.0 — MCP observability (structured errors, deadlines, OpenTelemetry) + SEO overhaul

What's changed

• docs: 1.22.0 release — MCP observability + README/SEO overhaul (e3ed0fa)
• docs(mcp): promote Phase 3 deferred work from implicit to explicit (1d8c3ef)
• feat(mcp): Phase 2c — retrofit 129 more MCP tools (final retrofit pass) (99ebb26)
• feat(mcp): Phase 2b — retrofit 71 more MCP tools with structured errors (74ac353)
• hardening(mcp): Phase 2 security review fix — classify InvalidArgumentException (f164746)
• feat(mcp): Phase 2 — retrofit 121 MCP tools with structured error codes (886b463)
• hardening(mcp): Phase 1 security review follow-ups (07e7764)
• feat(mcp): Phase 1 observability — structured errors, deadlines, SSE backpressure, OpenTelemetry (6c278be)
• fix(test): pin anthropic key in ScanListingRiskTest (c4fa6f1)
• fix(docker): install GD extension in base PHP image (e539298)
• fix(users): add is_super_admin column to base schema (12a1e62)
• fix(test): isolate browser policy tests from cloud plan gates (cb8dc7c)
• fix(website): wire managing_crew_id + annotate mcp write tools (8f2366f)
• fix(chatbot): own MemoryContextProviderInterface, drop Barsy coupling (a73fc96)
• fix(test): assert decoded breadcrumbs array, not raw JSON string (de56c0e)
• fix(signal): include signal_comments in bug-report delegation thesis (f7af150)
• fix(llm): replace hardcoded 'anthropic' default with cascading helper (6091535)
• fix(sanitize): strip control chars, not non-ASCII — preserve UTF-8/Cyrillic (d9b0216)
• fix(composer): unblock consumers — VCS repos + optional plugins (5e18e75)
• fix(website): add missing Generating case to WebsiteStatus enum (99fc929)
• feat(tool): enforce network_policy.allowed_domains on browser tools (61bf5a7)
• fix(ui): show bug-reports pagination summary even on single page (aba6855)
• fix(migrations): remove duplicate websites create-table migrations (b08733a)
• fix(livewire): hook form Cancel button throws 500 on agent detail (b99aa2d)
• fix(blade): @php() short syntax crashes compiler in agent detail overview (d1fe72f)
• fix(ui): security + content + a11y polish from fresh review (6735e51)
• feat(ui): UI coverage + content polish for shipped features (d4c02c0)
• fix(ai): propagate new DTO fields through all gateway/middleware copies (9c16653)
• fix(security): UUID guard on tool search filter + CRLF strip on fast-mode beta (2de58e0)
• feat(ai): Anthropic Fast Mode per-request beta header (a09ad36)
• feat(tool): tool search observability stats (part 4/4) (c217837)
• feat(tool): tool search debug page + append-only log (part 3/4) (c71fa53)
• feat(tool): tool search — UI + API + MCP surface (part 2/4) (4730eca)
• feat(tool): tool search auto-discovery from team-wide pool (part 1/4) (d19c5e1)
• feat(steering): audit log entries for queue + consume events (e061305)
• feat(experiment): Steer button + modal in ExperimentDetailPage (4d64562)
• feat(experiment): add steering injection for running experiments (MVP) (77480db)
• feat(agent): expose environment + reasoning_effort in detail view and resource (5d21ba0)
• feat(api,mcp): expose environment and reasoning_effort in agent surface (dfbd51d)
• feat(agent): add environment preset for auto-attaching tool bundles (2906bdb)
• fix(agent): validate reasoning_effort at config boundary (076f088)
• feat(agent): wire reasoning_effort through UI, config, and execution (0186e36)
• fix(ai): cap thinkingBudget at 32K, forward effort in normalizeCustomEndpoint (edc5ebf)
• feat(ai): add ReasoningEffort enum and effort-based thinking budget (64faa41)
• fix: remove null byte from delegate action test (Postgres JSONB rejects \u0000) (6ab55db)

Upgrade

git fetch --tags origin
git checkout tags/v1.22.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

v1.21.0 — Founder Mode + widget comments + OAuth account-takeover fix

[1.21.0] - 2026-04-18

Added

• Founder Mode pack — platform-owned marketplace bundle of 6 persona agents (Strategist, Product Lead, Growth Hacker, Finance Advisor, Ops Manager, Risk Officer), 20 framework skills covering product/growth/finance/ops/testing methodologies (RICE, SPIN, BANT, MEDDIC, OKRs, Bullseye, Lean Startup, Shape Up, Unit Economics, Kano, TAM-SAM-SOM, K-Factor, Cash Flow, NPV-IRR, RACI, Lean Ops, A/B Testing, 3-Day MVP, OWASP, Bessemer), and 5 pre-built workflows. New Framework enum (20 cases) + FrameworkCategory (6) on skills.framework. DeliverableType enum (8 cases: ExecutiveReport/ActionPlan/ResearchBrief/Forecast/Pitch/ContentPiece/TechnicalSpec/Template) on artifacts.deliverable_type with typed Blade partials. /frameworks Livewire browser. 3 MCP tools (framework_list, founder_mode_status, founder_mode_install).
• Bidirectional widget comments for bug reports — reporters and agents can now exchange comments through the public JS widget. New public endpoints: GET /api/public/widget/bug-reports (list with optional ?project= filter), GET /api/public/widget/bug-reports/{signal}/comments, POST /api/public/widget/bug-reports/{signal}/comments. New CommentAuthorType enum (human/agent/reporter/support) with isWidgetVisible() helper. signal_comments.widget_visible column + partial index. Admin reply defaults to support type (visible to reporter) with opt-in downgrade to human (internal only). Reporter name shown in admin UI from signal.payload.reporter_name. unread_comments_count exposed via withCount. SignalCommentAdded event.
• Structured intake for widget bug reports (opt-in) — bug_report_project_configs table allows per-project configuration of required fields and intake workflow. MCP tools: bug_report_project_config_get, bug_report_project_config_update.
• AI risk scanning for Marketplace listings — automatic risk assessment before publish, exposed in marketplace_browse MCP results.
• MCP coverage audit gap fixes — signal_get now exposes metadata; bug_report_detail exposes ai_extracted; marketplace_browse exposes risk_level; agent_list/agent_get expose scope and owner_user_id; agent_list adds scope filter; new bug_report_delete tool; new bug_report_project_config get + update tools.
• Configurable VERIFIED_EMAIL_PROVIDERS — comma-separated env var (default: gmail.com,outlook.com,yahoo.com,...). Controls which OAuth email domains qualify for auto-link.
• Bug report list — delete button added to admin list page.

Fixed

• Bug report detail — only the first attachment was rendered; now renders all attachments in the media collection.
• Widget bug-report list — unread_comments_count was always 0 (missing withCount); now returns real counts.
• InsightsPage — team scoping via whereHas, correct stage column names, correct deduction type for spend calculations.
• AiControlCenterPage — circuit_breaker_states query was broken; fixed column reference.
• StageType enum — cast to ->value in Insights Blade template to prevent Object of class StageType could not be converted to string.
• Sidebar — light-bulb icon now registered in sidebar-link.blade.php for the Insights nav item.

Security

• CRITICAL — OAuth account takeover via unverified email auto-link. SocialAccountService::handleCallback() step 4 auto-linked any OAuth account whose email matched an existing user without verifying the provider was trustworthy. Attacker could use a provider that hands out unverified emails (e.g. a custom OAuth provider) to hijack any account. Guard added: auto-link only runs when the OAuth provider is on the verified_email_providers list. Configurable via VERIFIED_EMAIL_PROVIDERS env.
• Prompt injection guard in chatbot memory context. User-controlled content (agent name, memory tags) was interpolated unsanitized into the LLM context string. Strip to printable ASCII + truncate applied before interpolation.
• IDOR fix in chatbot memory context provider. Memory lookup was missing team-scope check; fixed with explicit where('team_id', ...).

FleetQ v1.20.0

What's changed

• chore: release v1.20.0 — public widget endpoint + changelog (34c078a)
• feat: public widget endpoint with team key auth — no CORS per-domain setup required (e3726d1)
• fix: replace raw Tailwind v3 inputs with standard form components on bug report pages (24f5396)
• feat: bug report signal system v1.19.0 (836dbee)
• fix: invalidate web sessions immediately on team member removal (0ed9a34)
• fix: security hardening for enterprise governance features (81715ee)
• feat: enterprise governance — model allowlist, member cleanup, session TTL, per-user cost, personal agents (4971338)
• fix: cap crew blackboard at 1000 entries per execution (security) (b97b200)
• feat: crew blackboard + mesh_llm provider (mesh-llm inspired) (a362519)
• feat: add CONTEXT_COMPACTION_ANTHROPIC_API_KEY for platform-level compaction (f39597f)
• feat: add crew_execution_pause/resume tools + extend crew_update with coordinator/QA/process_type (0a6e25b)
• fix: guard jsonb_set against array-typed metadata in ConversationCompactor (182ab72)
• fix: use --system-prompt-file to avoid ARG_MAX with large tool lists (f003a8e)
• fix: remove ->minimum()->maximum() calls on IntegerType in SupabaseProvisionMemoryTool (2be2a3f)
• fix: make bridgedMcpTools protected so CloudAssistantToolRegistry can call it (cbc871a)
• feat: annotate 230 MCP tools with #[AssistantTool] for assistant registry (db30165)
• feat: expose crew_update, crew_execution_status, crew_executions_list to assistant (3c6f850)
• feat: Approach 2 — MCP→Assistant bridge via #[AssistantTool] attribute (f8e0f7b)
• feat(mcp): add crew_delete tool (9d629df)
• feat(mcp): add 25 missing MCP tools across 11 domains (9ba824c)
• feat(git): implement SandboxGitClient + HtmlSanitizer label[for] fix (8c42da4)
• fix(assistant): prevent empty reply when model stops after tool calls (c1f65af)
• fix(memory): address QA issues in topic namespace feature (c6482f2)
• feat: memory topic namespace pre-filter + hall taxonomy + auto-save (3351791)
• fix(browser-use-cloud): recognise v2 'finished' terminal status (2d9a0c3)
• fix(tools): 500 on detail page + add browser_use_cloud tool kind (62f99c9)
• fix(assistant): claude-code-vps artifact parsing + progressive streaming (c015fff)
• fix(assistant): enable tool loop for claude-code-vps (bb33618)
• fix(claude-code-vps): add --verbose to claude CLI flags (43ecca6)
• fix(claude-code-vps): set IS_SANDBOX=1 so the CLI runs in root container (4c9cc91)
• fix(ai-gateway): widen FallbackAiGateway localGateway type to interface (004c536)
• fix(ai-gateway): keep LocalAgentGateway reachable for VPS Claude Code (1560d47)
• fix(assistant): preserve claude-code-vps provider in relay-mode rewrite (14c6263)
• feat(assistant): enable UI artifacts by default for all teams (dd1716e)
• feat(assistant): pop-out modal + Show all N + mobile force-collapse (Gap 2 phase 8c) (4de1568)
• feat(assistant): harden artifact click handlers — role gating + rate limit + audit (Gap 2 phase 8b) (5954127)
• test(assistant): security corpus + fuzz for UI artifacts (Gap 2 phase 8a) (3508d40)
• feat(assistant): click handlers for interactive artifacts (Gap 2 phase 6) (68cb400)
• feat(assistant): wire UI artifacts into SendAssistantMessageAction + panel (Gap 2 phase 5b) (1f22b6a)
• feat(assistant): 9 Blade renderers for UI artifacts (Gap 2 phase 4) (e9c7d67)
• feat(assistant): parser + persister for UI artifacts (Gap 2 phase 5a) (e64b21f)
• feat(assistant): feature flag for UI artifacts (Gap 2 phase 3) (2462663)
• feat(assistant): 9 artifact Value Objects + sanitizers (Gap 2 phase 2) (dfb493f)
• feat(assistant): data model for UI artifacts (Gap 2 phase 1) (e1835b9)
• feat(agent): LLM-generated clarification forms (Gap 1 ephemeral UI) (3d5ff93)
• fix(ai): decouple VPS Claude Code from global local_agents.enabled flag (30408c1)
• chore: land pending assistant + website builder accumulated changes (613337d)
• feat(seo): default og:image to /og-image.png with absolute URL resolution (90d65c6)
• feat(docker): install claude binary for VPS provider (545df91)
• feat(ai): super-admin-gated Claude Code on VPS (ce17aee)
• fix(queue): use atomic redis SET NX for per-agent serial execution (393bbe5)
• docs: major docs refresh — add Website Builder, Evaluation, Voice Agents pages (c770dc0)
• docs(mcp): correct tool counts and endpoint architecture (467315c)
• docs(mcp): add Troubleshooting section to docs/mcp-server (0c046c1)
• fix(mcp): remove duplicate SearxngSearchTool registration (44b9bc7)
• feat(mcp): annotate all 454 tools with readOnlyHint / destructiveHint (77c9884)
• docs(changelog): add v1.18.0 entry — website builder feature complete (7417bad)

Upgrade

git fetch --tags origin
git checkout tags/v1.20.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

FleetQ v1.17.0

What's changed

• chore: release v1.17.0 — GPU templates, MCP marketplace, integrations (8f4839e)
• feat: add ToolTemplate REST API (index, show, deploy) (30565d4)
• feat: 1Password integration — MCP tool + native driver (95b5794)
• fix: remove hardcoded stats from marketplace seeder (d995052)
• feat: seed marketplace with 34 official listings (22 skills + 12 agents) (45937cb)
• feat: GPU templates, MCP marketplace, Apify, screenpipe, quick agent, integrations UX (78a3801)
• feat: AgentScope-inspired patterns — 5 features + test fixes (946ab4f)
• feat: a2ui MCP tools, migration, security audit, tests (88954ee)
• feat: GSD-2 inspired AI Gateway intelligence + full UI (e989be6)
• fix: KG search havingRaw bug + add chat memory extraction listener (9e1f86b)
• fix: add A2uiRenderer class (missed in a2ui surface commit) (136fb3c)
• fix: update tpetry/laravel-postgresql-enhanced 3.5→3.6 (tsvector compat fix) (1253c96)
• feat: add view/edit modals to Knowledge Graph browser page (b63027b)
• fix: add a2ui surface blade component (fixes view:cache on production) (7d2c902)
• fix: add a2ui surface blade component (fixes view:cache on production) (10c7c14)
• feat: assistant tools, MJML rendering, memory scoping, KG quality, artifact fixes (45d5a3d)
• fix(artifacts): resolve file references + add missing content types (15f0940)
• fix: remove 'team-knowledge' fallback — pass null for agentless experiments (397ace6)
• feat: assistant email theme tools, MJML CLI+HTTP rendering (977ec88)
• feat: assistant streaming, KG data quality, memory tag scoping (bf28b6e)
• fix(outbound): remove simulated sends, fix email target resolution, add agent/trigger/signal improvements (a11c6e4)
• feat(chatbot): add SSE streaming endpoint for chat messages (466374f)
• fix(chatbot): extract 'text' output key + fallback for all chatbot types (d9edd9e)
• fix(chatbot): lower RAG similarity threshold from 0.72 to 0.5 (b04ad96)
• fix(chatbot): add 'text' key to delivery output extraction (ea4c191)
• fix(chatbot): skill execution error messages + playbook step retry (6a9a13d)
• fix(chatbot): skill execution error messages + playbook step retry (5a4c077)
• feat(chatbot): add delivery listener for workflow results (370fd3a)
• fix(workflow): handle string input_mapping in resolveInput (0723ad4)
• fix(chatbot): skip scoring stage for chatbot workflow experiments (aa24389)
• fix(chatbot): use team owner_id instead of team_id as actorUserId (e8f6c95)
• fix(bridge): permanent stability improvements for unstable networks (1fba583)
• fix(security): IDOR guard on knowledge_base_id, authorization on saveAiFeatures, stage_model_tiers validation (9b016c2)
• feat: pre-existing config gaps — per-team overrides, GlobalSettings, agent fields (08c8ac6)
• feat: cloud configurability for Hermes-inspired features — per-team settings, UI, API, MCP (a5bb80d)
• fix: use experiment.thesis instead of non-existent goal column (9268982)

Upgrade

git fetch --tags origin
git checkout tags/v1.17.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

FleetQ v1.16.0

What's changed

• feat: Hermes-inspired improvements — tool profiles, smart routing, transcript search, auto-skills, context compression (4ef22f8)
• fix: github_repo default, evolution icon, nginx reverb resolver (45713fe)
• fix: github_repo default, evolution icon, nginx reverb resolver (cd83e1f)
• fix: correct github_repo default and evolution sidebar icon (7d45233)
• fix: correct github_repo default and evolution sidebar icon (4abb3b4)
• fix(telegram): use team owner_id instead of team_id as actorUserId (623d113)
• feat(chatbot): add Telegram channel management UI (d10463d)
• chore: update package-lock.json for FontAwesome dependency (91a831d)
• fix: bundle FontAwesome via npm instead of CDN — no CSP issues (f6222e0)
• fix: add FontAwesome 6 CDN to app layout — required by rail+flyout sidebar icons (79d6041)
• feat(search): add SearXNG service for native web search (d2c56f8)
• fix: add purpose to evolution analyze AiRequestDTO — prevent NOT NULL violation in ai_runs (fc7a441)
• feat: modernize sidebar to rail+flyout layout matching cloud version (4fa13cf)
• docs: add capabilities.md and reference in CLAUDE.md for coding agents (fef45d6)
• feat(skill): metric-gated benchmark improvement loop (972b605)
• chore: reset Monolog handler buffers after each Horizon job (47fde7d)
• fix(security): harden voice session — SSRF guard, narrow token abilities, fix env race condition (655b1d1)
• fix(voice): use SanctumTokenIssuer for worker dispatch token (267b720)
• feat(voice): per-team LiveKit credentials via Integration driver (4f25003)
• fix(security): address QA/security review findings from UI entry points PR (dcb37ff)
• feat(ui): add missing UI entry points for 6 deployed backend features (3775be1)
• fix(ui): move provider badges under name, clean up agent header action buttons (c22014b)
• feat(ui): add Voice Session link button to agent detail header (add5228)
• fix(workflows): escape all remaining {{}} Blade-parsed literals in builder (375ea26)
• fix(workflows): escape {{variable}} placeholders in Blade template (859bdae)
• feat(ui): replace custom SVG icons with FontAwesome Free in sidebar-link (46eaa97)
• fix(workflows): remove current_team() calls in WorkflowBuilderPage (47156f6)
• fix(assistant): replace userRole() with memberRole() in assistant panel (08449d6)
• fix(tests): build Stripe fixture keys at runtime to bypass GitHub push protection (2b5c98d)
• fix: resolve 10 PHPStan errors in 5 new-feature files (344cd68)
• fix(security): truncate broadcast outputPreview, add realpath guard for repo paths, validate Portkey key format (b09cd85)
• fix(security): add experiment broadcast channel auth + SSRF guard for ConfluenceConnector (a222bb8)
• feat(experiments): block-based execution log grouped by pipeline stage (f4ac6a9)
• feat(knowledge): add Notion, Confluence, GitHub Wiki passive ingestion connectors (32e4e7e)
• feat(workflows): real-time node status via Reverb events, reduce polling to 30s fallback (3f6c470)
• feat(agents): inject repo-map context for git-linked experiment executions (65e7911)
• feat(ai-gateway): add PortkeyGateway as optional team-level AI backend (41e672a)
• fix(ci): resolve PHPStan errors and test failures from 5 new features (48e70e3)
• feat(voice): add LiveKit voice session domain with API, Livewire UI, and MCP tools (ca81337)
• feat(credential): add version history and secret scanner (67b3f71)
• feat(skills): add Prompt IDE with model comparison and annotation-based improvement (4571cc4)
• feat(integrations): add Activepieces MCP integration with auto-sync (fcc34e4)
• feat(outbound): add Ntfy push notification connector with MCP tool (abe0492)
• fix(webhook): allow test env to bypass missing-secret guard in SignalWebhookController (e9befc8)
• test(agent): add missing AgentConstraintTemplatesTest (23caaaf)
• fix(security): patch cross-tenant leakage in MCP worklog and uncertainty tools (362cfa6)
• feat(crew): conversational crew creation via Assistant design_crew tool + MCP registration (454a189)
• feat(crew): add process_reviewer/output_reviewer roles and per-member context_scope (c5d76d2)
• feat(evolution): add crew restructuring proposal action via Evolution domain (604c854)
• feat(experiment): add three-layer knowledge enrichment before planning (3802705)
• feat(experiment): add structured worklog entries for agent reasoning audit trail (ebb4ce9)
• feat(assistant): add conversation quality review action and API endpoint (fda7454)
• feat(experiment): add uncertainty signal protocol for agent clarification requests (4696b79)
• feat(agent): add behavioral constraint templates for anti-sycophancy and quality defaults (a46248b)
• fix: use HasMany where() instead of wherePivot() for crew members (012c464)
• fix(security): address security review findings — add team guard, role gate, input allowlist, XSS-safe prompt encoding (6c293bc)
• feat(ux): Accio-inspired UX improvements — prompt gallery, stepper, inline approvals, bento dashboard, NL scheduling, marketplace tabs, evolution badge (ac13fdb)
• docs: expand and fix documentation for 9 undocumented features (493e96c)
• fix: resolve merge conflict in landing hero/cta + update stats to current numbers (4dc56ce)
• fix: ExecutePlaybookStepJob — retry bridge-unavailable failures properly (a5d368e)
• fix: RecoverStuckTasks — escalate experiments with no stage via meta counter (e0b22ec)
• security: fix 7 vulnerabilities from QA/security review (7ce521f)
• fix(memory): guard failure lessons query against missing table in unit tests (c45e423)
• feat(outbound): WhatsApp Business Cloud API connector with webhook receipts (b57eec4)
• feat(crew): per-member permission policy with tool allowlist and step/credit limits (7005cd6)
• feat(agent): heartbeat scheduling — UI, MCP tools, and Livewire integration (f26824e)
• feat(memory): failure lesson extraction on experiment terminal failure (a6ca907)
• feat(memory): tier system with proposed/canonical/facts/decisions/failures UI + MCP tools (bd47734)
• feat(experiment): context health monitoring with checkpoint handoff (f36ee47)
• feat(agent): add avg_steps warning badge on AgentDetailPage (07bd8fa)
• security: fix cross-tenant isolation and nesting depth in workflow saga/fork features (f5511d0)
• feat(workflow): saga/compensation pattern (per-step rollback) (4768af0)
• feat(workflow): stub-based WorkflowSimulator for unit testing (0d09af4)
• feat(workflow): dynamic fork sub_workflow fan-out + fan-in (e6a7b45)
• feat(workflow): extend LlmNode with embed, extract, and search operations (f7c7256)
• feat(workflow): Workflow Gateway — expose workflows as MCP tools (a2a7f24)
• chore: minor code cleanup and dependency ordering (253f674)
• fix(security): 7 security findings from pre-deploy audit (5ea614e)
• fix(integration): add missing interface methods + AuthType::BearerToken (47b47de)
• security: harden context-mode improvements against injection and DoS (6626c78)
• feat: context-mode inspired improvements (5 features) (512492f)
• fix(chatbot): add missing 'error' case to KnowledgeSourceStatus enum (bf1ae3a)
• fix(security): apply withoutGlobalScopes team scoping to all MCP tools (b5cd92e)
• fix(security): tenant scoping and IDOR fixes in federation tools (687b43e)
• fix(security): security review hardening from audit (cfa7020)
• fix(security): QA fixes — 5 issues resolved (73f74d5)
• feat(security): Phase 4 — security review queue for high-risk contacts (e288575)
• feat(security): Phase 3 — entity risk scoring on ContactIdentity (7afee4d)
• feat(security): add IP reputation check on webhook signal ingestion (e98cfc3)
• fix: correct StageType enum-as-string/key bugs and missing error column (2ad405e)
• feat: register integration_execute in CompactMcpServer for LLM discoverability (fe698aa)
• fix: rename IntegrationExecuteTool action param to integration_action (42d5280)
• fix: include transport_config headers in MCP HTTP tool calls (90c0f49)
• fix: use named variadic args in MCP tool closure to fix PHP 8 named parameter error (1c9f9e2)
• fix: BuildArtifactJob now uses experiment agent model and tools (6fce480)
• fix: correct consecutiveFailures() to count truly consecutive failures (badcf9d)
• fix: use project title instead of name in TelegramBotsPage (882d309)
• fix(crew): split self-referential FK into separate ALTER TABLE for PostgreSQL compatibility (db43499)
• feat(crew): Phase 3 & 4 — adversarial debate process type + UI (705b1da)
• feat(crew): Phase 2 — self-claim task pool process type (579b955)
• feat(crew): Phase 1 — inter-agent messaging (fbe3a49)
• fix(security): SQL injection and input validation in ToolSearchTool (0a997d6)
• feat(agent-orientation): improve agent discoverability and efficiency (6fc17fc)
• fix(ragflow): align client and tools with RAGFlow v0.17 API (e854543)
• fix(ragflow): security hardening — sanitize exception messages, restrict file paths, add IsDestructive (f63bc5d)
• feat(workflow,tool): workflow execution live overlay + MCP tool federation layer (8de67f1)
• feat(ragflow): integrate RAGFlow as optional deep document understanding layer (364c945)
• fix(memory): correct StageType::Evaluating and experiment_stages status filter (e08fe4b)
• feat(ui): surface hidden backend features with Livewire UI pages (31418b1)

Upgrade

git fetch --tags origin
git checkout tags/v1.16.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

FleetQ v1.14.0

What's changed

• chore: release v1.14.0 — Searxng web search connector + bridge fix (87b89bf)
• feat(signal): add Searxng web search connector + MCP tool (82c245e)
• fix: reset continuous project to active after successful run (6e8a977)
• fix: guard bridge disconnect against reconnect race condition (b2baf91)
• fix(security): address security review findings (f031d43)
• feat(memory,signal): PentaGI-inspired success patterns + Searxng connector (8d9e49d)
• fix: prevent experiments from getting stuck when CollectMetrics/Evaluate stage fails (fee0097)
• fix: tenant isolation on knowledge base search endpoint (d3e044f)
• fix: QA+security fixes for MCP/API parity changes (2ee60a4)
• feat(mcp,api): MCP/API parity improvements — metrics tools, agent reset, KB update, KG invalidate, experiment cost (f3a3be8)

Upgrade

git fetch --tags origin
git checkout tags/v1.14.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

FleetQ v1.13.0

What's changed

• chore: release v1.13.0 — autonomous web dev pipeline, ClawWork quality improvements (21a7dcf)
• feat(chatbot): is_enabled toggle for knowledge sources (8070557)
• fix(crew): validate task_rubrics at crew creation and update (a205c2d)
• fix(agent): QA and security fixes for ClawWork improvements (a0baddb)
• feat(agent): ClawWork-inspired agent quality improvements (5477028)
• fix: harden host-bridge.php working_directory against path traversal (a3bcd5a)
• fix: path traversal + wrong attribute name in working_directory support (0a433fa)
• feat: per-call working directory, Web Dev Cycle workflow, pipeline tool tests (f93b0d6)
• fix: security and correctness fixes in autonomous pipeline tools (339d6d6)
• feat: full autonomous web dev pipeline — git ops, deploy drivers, test & lint tools (c00f710)
• fix(migration): guard pgvector column behind extension availability check (088c490)

Upgrade

git fetch --tags origin
git checkout tags/v1.13.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.