Changelog

feat(orgs): managed invited-employee accounts with no personal org or org switching An account created from an org invite is now "managed": it is registered directly inside the inviting organization with no personal workspace, is tied to exactly one org, and cannot switch, create, join or leave organizations. The signup form, when opened from an invite, hides the workspace-name field and shows the target org read-only, and the top-left org selector becomes a static label (no dropdown) for managed users. Backend: new User.is_managed flag (migration 077, exposed in /users/me); /auth/register accepts org_invite_token for invite-first registration (creates the account in the org, joins with the invite role, marks managed, and the org invite authorizes signup so REQUIRE_INVITE is bypassed); CLI redeem marks created accounts managed and refuses a managed user joining a second org; /orgs switch/create/accept-invite/leave return 403 for managed users. Normal self-signup is unchanged (personal org + switcher).

chore(release): v1.23.0 Docs: update CLAUDE.md migration head to 076 and document the zero-touch CLI onboarding endpoints. Bump VERSION and add the v1.23.0 changelog section.

fix(tests): assemble secret-shaped fixtures at runtime for the OSS mirror The secret_guard fixtures embedded contiguous provider-token patterns (GitLab PAT etc.) that tripped GitHub secret-scanning push protection when publishing the public mirror. Build them from fragments so the source carries no complete token pattern; the values passed to looks_like_secret are unchanged.

- Set PNPM_HOME and added it to PATH in the backend image so the global install of the Claude, Gemini, and Codex CLIs works. Unlike npm, pnpm needs a global bin directory on PATH (ERR_PNPM_NO_GLOBAL_BIN_DIR). No runtime behavior change.

- Pinned pnpm to version 9 in the backend image and CI. Corepack was resolving pnpm 10, which errors on ignored dependency build scripts and no longer reads the build-script allowlist from package.json, breaking the install. No runtime behavior change.

- Hardened the build and CI pipeline against the npm supply-chain compromise. The backend image, the GitLab CI frontend check, and the dev Docker setup now install every Node dependency with pnpm through corepack instead of npm, removing all use of the affected npm client. No runtime behavior changes.

- Accounts now show a live "Resets in 2h 16m" countdown when an account is rate-limited, so you can see at a glance whether you can work right now or when a limited account comes back, instead of guessing. - Added smart rate-limit detection that reads each provider's own limit message. OpenCode Go's "5-hour usage limit, resets in 2hr 16min" is now understood exactly, so the account cools down for the real remaining time and is retried the moment it resets, instead of a flat guess. - Rate-limit detection is modular and data-driven, a few lines of rules per provider, so new providers are easy to teach and existing ones easy to tune. - Provider Types gains a Rate-limit detection editor: define how a provider signals a limit (a match phrase, a regex to pull the reset time, units, and a fallback duration) per provider type, right from Settings. - Orchestrator agents now see which accounts are usable now and which are cooling (and for how long) when they delegate, so they route work to a live provider instead of stalling on an exhausted one. The hint only appears when something is actually cooling. - New availability endpoint summarizing, across the workspace, how many accounts are usable now versus cooling and when each returns.

- Fixed a chat replying "No available providers" when its only AI account had been temporarily flagged as cooling down (for example after a burst of rate-limit or connection errors during a heavy run), even though the account itself was fine. Nexora now makes a last-resort attempt on a cooling account when there is no other option, so one hiccup no longer dead-ends the conversation. - When there genuinely is no usable account, the failure message now explains why (no account set for the chat, all accounts inactive, or all cooling down) and points to Settings, Accounts, instead of the opaque "No available providers".

- Fixed conversations failing to open with a "Couldn't load data" error. When a chat opens, the app reads its saved YOLO and Autopilot toggles; that internal access check had its arguments in the wrong order, so it always returned a server error (500). Opening conversations and reading or saving those toggles works again.

- Fixed the entire chat sidebar failing to load ("Couldn't load data, check your connection") when a single conversation held a corrupted token-usage record. The per-conversation token and tool-call counters are now computed defensively: if that calculation hits a bad row or runs too long, the chat list still loads (just without those counters for that batch) instead of the whole page erroring.

- Fixed the Conversation Hierarchy keeping stopped and failed runs in the "Active only" view. A conversation whose tasks had all ended (failed, killed, or blocked) was still counted as active, so a cancelled run looked like it was running forever. These now leave the active view the moment their work ends, so "Kill All" and "Pause all autonomy" visibly clear it. - Killed and blocked tasks now count toward a conversation's failed total in the hierarchy instead of going missing, so the "X done / Y failed" figures add up.

- Fixed a conversation that kept showing "agents working" (and a sub-agent stuck on "Analyzing...") even after it was stopped and even though nothing was actually running. The chat was rebuilding that state on every refresh from finished tasks whose status the screen did not recognize as finished (an agent that errored out, or a blocked step), so it drew a spinner forever. Those states now count as done. - "Pause all autonomy" is now a true workspace-wide stop. It ends every in-flight task in the workspace, including background helper tasks that were not tied to a specific goal. Those were slipping through before and kept the "working" indicator alive. - Stopping a run now also pauses a goal whose work runs inside that conversation even when the goal itself lives in another chat, so the autonomy loop can no longer quietly restart it a minute later. - On startup, any task still marked in-progress with no live worker behind it is now cleaned up instead of being shown as active, so a restart no longer revives or fakes work left over from a previous session.

- Fixed a conversation showing "agents working" forever (and after every refresh) even though nothing was running. The cause was leftover tasks stuck in an in-progress state after a run was stopped or the server restarted; the chat rebuilt them as active on load. Stopping a run, pausing all autonomy, and deleting a chat now also clear those tasks, and on startup any in-progress task belonging to a stopped/paused run or a deleted chat is cleaned up instead of being shown as active or re-dispatched.

- Deleting a conversation now also stops its autonomous run. Previously a deleted chat could keep working in the background (the run kept being dispatched and came back on refresh); deleting now pauses the run and halts its in-flight work, so removing a chat truly ends it.

- Fixed stopped autonomous runs coming back after a restart even with auto-resume disabled. The cause was the proactive autonomy loop (which dispatches active goals every minute): stopping a run from one of its sub-conversations did not pause the goal that lives at the top of the run, so the loop kept reviving it. Stopping now pauses the goal across the whole run (sub-conversation and the chain above it), and the autonomy loop skips any run whose conversation was just stopped. - Added a "Pause all autonomy" button (in the hierarchy view) and matching API to stop every autonomous run in the workspace at once. Paused runs stay stopped across restarts until resumed.

- Agents now follow a strict communication-discipline rule that cuts wasted tokens: no preamble or filler, short status lines, no meetings/pitches/status ceremony unless asked, and terse one or two line messages between agents. This reduces both the output agents generate and the input other agents receive from them. - The shared thread-memory block injected into every agent turn is now capped (the rest stays queryable on demand), so a long-running conversation no longer keeps inflating the per-turn prompt size.

- Fixed a frontend build failure introduced in 1.18.0 (a missing import broke the production build). No behavior change.

- Fixed the backend becoming unresponsive (502 errors, dropped connections, "Couldn't load data", failed chat deletes) on instances with very large conversation trees. The query that decides which conversations show a "working" spinner is now depth-guarded so it can never run away on a malformed tree, has a hard time limit, and is cached for a few seconds so a burst of updates can't overload the database. - Added a safeguard and an off switch for auto-resuming autonomous runs after a restart: at most a few runs resume per startup, and AUTOPILOT_RECOVERY_ENABLED=false disables auto-resume entirely (useful if many runs are overloading an instance). Stopping a run still keeps it stopped.

- A stopped autonomous run no longer comes back to life after a server restart or rebuild. Stopping (Stop or Kill All) now pauses the run, and startup recovery leaves paused runs alone instead of reviving them (which had also caused a fresh branch to appear on restart). - When a run is stopped, the conversation now shows a clear "Execution stopped" note, and if the run can be continued it offers an optional Resume button that picks up the current milestone where it left off. You can also just send a message to carry on.

- Stopping a run (the chat Stop button or "Kill All" in the hierarchy view) is now fast even on a huge conversation tree: cancellation collects the whole tree in one query and signals every conversation in a single batched round-trip instead of one-by-one. - When you press Stop or Kill All, the working spinner is replaced by the normal chat view instantly, without waiting for the server to finish cancelling. - Deleting a chat from the sidebar now removes it immediately (it reappears only if the server rejects the delete). - New multi-select in the chat sidebar: a "Select" button turns chats into checkboxes so you can pick several and delete them all at once.

- The chat sidebar loads fast again on instances with very large conversation trees: it now loads only top-level conversations and pulls sub-conversations on demand, instead of loading every sub-chat up front (a single autonomous run had grown to nearly 2000). - The conversation hierarchy view now opens showing only the conversations still in progress, with a "Show all" toggle to load the full tree on demand, and it builds the tree in one query instead of one per node, so it opens quickly even with thousands of sub-chats. - A rate limit no longer fails a turn when it will clear in moments: if every account is rate-limited with a short reset (such as an OpenAI per-minute token burst), the platform waits for the soonest reset and retries the chain instead of giving up. Short resets reported in the provider's message are now read accurately. - Accept/Reject in the repository panel no longer shows a raw "405 Method Not Allowed". Merge waits for the host to finish its mergeability check, reuses an already-open merge request, and reports a clear message when a branch genuinely cannot be auto-merged.

- The main conversation and every conversation above a working sub-agent now show a "Sub-agents working…" indicator while a deeply nested sub-agent is active, instead of looking idle. The indicator clears on its own shortly after the deep work stops.

- The Docker tools an agent can use (list containers, view logs, build an image, run a command) now actually work. They were listed but had no implementation, so an agent that tried them got stuck repeating a failing "tool not available" call. They run against Docker directly, and the run command keeps the safety guard that blocks anything that could take down the platform.

- Fixed the repository panel's changed-files list showing rows of "?" with no names or counts. The compare endpoint now returns each changed file with its path, status, and added/removed line counts (for both GitHub and GitLab) instead of just a filename, so the list, diff view, and per-file stats render correctly. - The repository file tree now shows the branch you are viewing (the selected agent branch when there is one) instead of always the base branch, so the explorer reflects the agent's work rather than appearing almost empty.

- The repository panel inside a conversation no longer crashes the whole app ("Application error: a client-side exception") when it hits unexpected data. It is now wrapped in an error boundary that shows a contained, retryable message with the actual error, and the file tree tolerates malformed entries instead of throwing.

- Fixed the chat sidebar failing to load with a repeated "Couldn't load data" error. A single message whose stored data contained an invalid NUL character made the conversation-list query fail, which blanked the entire sidebar and left conversations stuck loading. The query now tolerates such a message, and messages are stripped of these characters when saved so it cannot recur. - Fixed autonomous runs not starting later milestones because their tasks were created without an owner (a not-null constraint failed). The owner is now resolved from the conversation, so multi-milestone Autopilot runs proceed past the first milestone.

- Fixed repeated "Couldn't load data" errors and chats not loading on a busy conversation. The task list was running several database queries per task, so the once-per-second refresh on a conversation with hundreds of tasks could exhaust the database connection pool and make every request time out. Task lists are now loaded in a fixed number of queries regardless of how many tasks there are.

- Autonomous runs no longer balloon into hundreds of conversations. Agent broadcasts are now bounded by a per-run budget and a fan-out cap, so a team can still coordinate but a broadcast can no longer trigger an exponential storm of new conversations. A targeted message to one agent is never capped, and both limits are configurable.

- Fixed an error that made updating a task or completing a plan step fail with "cannot access local variable timezone"; these now work reliably during autonomous runs. - Agents can now create agents and issues without hitting a database type error: numeric and text fields the model fills in (an agent's max tokens or temperature, an issue's title or project) are normalized to the right type instead of being rejected. - Raised the shell command timeout from 60 to 300 seconds so real installs and builds (pnpm install, docker build) are no longer killed partway through.

- When an autonomous run is resumed after a server restart, the conversation now posts a short note saying it is continuing, so the self-recovery is visible in the chat instead of only in the logs.

- An autonomous Autopilot run now survives a backend restart or redeploy: on startup the platform resumes any in-progress goal, re-dispatching the current milestone's remaining work or advancing to the next milestone, so a deploy no longer kills a run that was in progress. - Moving from one milestone to the next is now guarded so it cannot happen twice at once, preventing duplicate follow-up tasks when two tasks finish at the same moment.

- Agents can no longer run a shell command that takes down the platform itself (stopping, killing, removing or restarting containers, rebooting, or mass-killing processes); they can still bring their own project up with docker compose. This fixes the backend restarting in the middle of an autonomous run. - The shell command timeout is configurable and was raised so builds and installs do not time out instantly; a timed-out command is now stopped cleanly.

- Approval requests for risky commands now appear in the top-level conversation, so you can approve or deny every sub-agent's action from one place without opening each sub-chat. - The YOLO and Autopilot toggles now stick: they are remembered per conversation across refreshes and chat switches, apply to all of a conversation's sub-agents, and save the moment you flip them. - Fixed the look of the YOLO and Autopilot toggle switches.

- A tool call that keeps failing with the same arguments is now blocked after two identical failures, so a weaker model can no longer get stuck repeating the same failing action in a loop.

- New Autopilot mode (per-chat toggle): describe a project and the platform plans it once into a roadmap of milestones and small tasks, then builds it autonomously by assigning each task to a capable agent, running them, verifying acceptance, and advancing milestone by milestone until done. The orchestration is driven by code, so it works even with smaller models.

- Delegated tasks are now routed to a capable agent automatically: when an agent creates a task without naming who should do it, the platform picks the best-fit specialist by skills and tools (with a sensible fallback), so delegation no longer depends on the model knowing agent names.

- Clearer error when an agent guesses a non-existent GitHub/GitLab API action such as create: the message now points it to commit_file or the git_local workspace flow, so a model is less likely to loop on it.

- The built-in Infrastructure Manager agent can now use local git, so a delegated agent can clone, branch, commit, and push a project's repository instead of only writing files that never reach the repo. - Stronger guidance for agents working in a shared workspace: write each file once, commit and push with git, and stop when the deliverable is done, which prevents weaker models from rewriting the same file in a loop.

- The Files panel no longer fills with duplicates when an agent rewrites a file: re-writing the same path updates one entry in place, files keep their folder structure so the panel shows a real folder tree of what the agents are building, and the per-file toast spam during generation is gone.

- Fix delegated sub-agent work stalling when the durable run queue is enabled but no runner process is consuming it: the platform now detects whether a runner is alive and otherwise runs the work in-process, so delegation never silently disappears. - Tasks an agent creates now inherit their conversation's project, so they group on the project board and delegated runs get the right repository and workspace context. - The built-in Project Manager can now list the available agents, so it routes each task to a suitable specialist instead of guessing.

- The create-repository destination picker is now a fast lazy tree: it loads your accounts and top-level groups instantly and lets you drill into subgroups on demand, in their natural order, instead of slowly listing everything flat.

- Creating a repository from a project now uses a proper picker dialog: search and select the destination personal account, organization, or group, instead of a cramped dropdown.

- Fix a production frontend build failure introduced in 1.11.0 (the new Workspaces settings tab referenced the wrong toast and store modules).

- Agents can now run real git in the shared workspace: a new local git tool clones, branches, commits and pushes a live working tree, authenticating with the project's stored GitHub/GitLab credential without ever exposing the token. - Projects gain commit and push rules: a short note you write in the project Repository tab is shown to every agent working in that project's workspace, so they follow your branch naming and commit conventions. - Create a repository straight from a project: pick a stored credential, choose the GitHub org or GitLab group to put it in, name it, and it is created and linked in one step. - New superuser Workspaces settings tab to see every agent workspace with its size and git status, and delete stale ones.

- Risky-command approvals gain an "Always allow similar" action: approving a held command with it stops re-prompting for commands with the same content for the rest of the conversation (sub-agents included), while different commands still ask. - New optional shared agent workspace: when enabled, an agent and all of its sub-agents work inside one persistent directory per project (or per conversation when there is no project), so a team can build a real git-backed codebase together, and the directory survives restarts.

- Provider-native function calling, system-prompt caching, parallel read-only tools, and event-driven sub-agent delegation are now on by default after production validation; each can still be turned off with its setting. - Nested sub-agent delegation is now bounded at every level: a delegating agent frees its concurrency slot while it waits for its children, and the children run within the normal global, per-agent, and per-organization limits instead of off-pool, so deep fan-out can no longer overrun a worker. - Cancelling a turn now takes effect within about two seconds even when the model is mid-response and streaming nothing back, not only between chunks.

- Knowledge base and agent memory search now use a real vector index (pgvector) for faster, more accurate semantic results, with an automatic fallback when the extension is not available. - Agents can delegate to a sub-agent and receive its answer reliably: peer messaging resolves the right organization in every context, replies no longer fail, and a completed task automatically answers the waiting agent. - New built-in KB Researcher agent: a read-only research specialist you can delegate knowledge base and web lookups to without giving the caller direct knowledge base access. - A safety guard stops weaker models from looping the same tool forever and forces them to deliver the answer. - Provider-native function calling is available for the built-in tools (opt-in), with argument schemas for almost all of them. - Optional system-prompt caching reuses the static part of the prompt across turns to cut token cost (opt-in, Anthropic). - WebSocket connections now carry the auth token off the URL (via subprotocol or header) so it no longer appears in server or proxy logs. - Sub-agent delegation can wait on an event instead of polling the database (opt-in), and independent read-only tools in a turn can run in parallel (opt-in). - Cancelling a turn now takes effect within about a second, even during a long tool call. - Local tool execution and presence now work correctly across multiple backend workers. - Chat cleanups: no more empty assistant bubbles or duplicate replies on weaker models, the activity card no longer blinks or jumps and now sits above the answer, failed tools stay marked failed after reload, a sub-chat no longer lists itself, and the live view now matches exactly what a refresh shows. - All feature, autonomy, and tool-governance flags are documented in .env.example.

- Structured audit log for sensitive actions (member changes, invites, backup export/import/migrate) with a superuser and org-admin viewer. - Incoming custom webhooks can now verify an HMAC signature of the request body, not just the path secret. - Rate limits added to marketplace import and install, git proxy file and tree fetches, and new WebSocket connections. - First-run registration is hardened against a race that could let two concurrent signups both skip the invite requirement. - Integration config is validated against a per-type allowlist, and user backup import now enforces field size limits. - Pagination added to users, memories, notifications, proposals, and knowledge base files; old notifications are trimmed automatically. - Faster organization, knowledge base, and integration list endpoints by removing per-row extra queries. - New database indexes for the recovery scan, scheduler, and proposals, plus trigram-accelerated chat and message search. - Schedules now retry on failure and surface errors instead of failing silently, reject overlapping runs, validate the cron expression when you save, and support a per-schedule concurrency limit and timeout. - Global search now spans agents, tools, skills, projects, and knowledge bases, not just chats and messages. - Marketplace import now installs the declared dependencies of skill, tool, and persona packages, not only agents and packs. - API keys can be scoped to read-only or restricted to specific organizations. - Notifications can be delivered by email or Telegram for events missed while you were offline. - Knowledge base search accepts a relevance threshold to drop low-quality matches.

- Outcome tracking and decision log: agents record what an action or goal achieved (with optional KPI) and the decisions they made, and can query that history to learn. - Outcomes are recorded automatically when a goal completes. - Persistent agent org chart: assign durable roles and areas of ownership, with escalation paths. - Backlog planner: a prioritised plan across all open goals and tasks (priority, then oldest first, dependency-blocked items held out) instead of reactive FIFO. - Turn control is now a deterministic state machine in code (resume, wait, nudge, final), not prompt instructions.

- Human-in-the-loop tool approval: tools at/above a configurable risk tier are held for review instead of running (flag, default off). - Approve or deny inline in the chat or from the Approvals page; on approve the tool runs and the agent responds. - Approval card is collapsible and shows the exact command + console-formatted output. - Per-chat YOLO toggle to skip the prompt, like the CLI. - Agents now wrap command output, code, logs and JSON in fenced code blocks across web, CLI and Telegram.

v1.3.0 - The instance now applies license plan and limit changes from NexoraGateway automatically on the next heartbeat, with no need to re-activate or re-install the license key. - Plan and limits are now driven by the live license instead of a subscription tier snapshot taken at signup, so an operator changing the plan (for example to Enterprise) takes effect within a few minutes across the whole instance. - A complimentary internal license now unlocks the full feature set with unlimited agents and users, while a no-license or expired-trial instance stays on the restricted defaults.

- Updated the bundled core so the backend image sets PNPM_HOME and adds it to PATH, fixing the global CLI install (ERR_PNPM_NO_GLOBAL_BIN_DIR). No runtime behavior change.

- Pinned pnpm to version 9 in the frontend image and CI so the dependency install no longer fails under pnpm 10 (ignored build scripts for sharp and unrs-resolver). Updated the bundled core to the matching fix.

- Hardened the build and CI pipeline against the npm supply-chain compromise. The cloud frontend image and the GitLab CI frontend check now install Node dependencies with pnpm through corepack instead of npm, removing all use of the affected npm client. - Updated the bundled core to the matching hardened release (npm fully replaced by pnpm in the backend image, core CI, and dev tooling). No runtime behavior changes.

- Core synced to Nexora v1.1.0 - Instance heartbeat now reports org/user/agent/tool/skill/persona/KB counts - Gateway admin org/user roster proxy endpoints - Full-platform backup companion (enterprise tables) + migration

chore(ci): remove notify-gateway job — replaced by GitLab webhook

Release v0.1.2: security fix + brand refresh

Release v0.1.1

First release — native iOS & Android client for a self-hosted Nexora / Nexora Cloud instance. - QR device pairing from the web Settings → Devices (no password on the phone; per-device revocable token) - Real-time chat with WebSocket streaming, Markdown, tool-result cards and reasoning blocks - No agent selection required — routes to the workspace's default provider/agent - In-chat Tasks / Plan / Notes / Agents (live sub-agent hierarchy) panels - Stop generation, sub-agent activity strip, brand-matched dark UI - Auto device-token refresh; internal/system messages hidden like the web app