team: manifest trait gates lead/worker toolsets; propose_team pre-spawns worker sessions on approval (fail closed on solo personas).
Deliveries + lead subscriptions are cursor-consumed projections; turns end with a queue kick, ticks replay; timer wakes carry the code-computed staleness digest; hourly wake cap is the budget gate.
Plan proposals live in the conversation (plan-approval flow); items are created open/unassigned and work starts at assignment — the granted, revocable authority.
Also closes a verify gap: tail truncation is now caught against the stored head hash.
Board+journal endpoints act as the user; sessions get lead verbs behind OPENWORKER_TEAM_BOARD=1 until the team trait lands.
Rail hides all team chrome until the workspace has items; expand opens a full-width state-column board.
Cases outlive boards/teams, so entries+per-case chains move to journal.db with a grant table (creator-on-attach, assignment-fed, explicit shares).
Adds the raw capture kind: excerpt inline under a body cap, full payload as a sha256-referenced artifact; reads skip raw unless asked.
One hash-chained append-only log; board, journal, and per-agent deliveries are projections (rebuild == replay).
Six board verbs + journal verbs with role authority; worker slice and case access ride assignment.
max_tokens defaults to 32k (compat servers were capping at ~2k, truncating file
writes); a below-limit model 400 drops the param and retries on the server default.
effective_connectors intersects the declared allowlist, so the drawer no longer
renders undeclared connectors as live sources and inbound delivery is gated too.
Builder-based builtins (no manifest) stay unrestricted for channel bindings.
Drop allow-same-origin (srcDoc ran the page same-origin with the privileged
webview) and inject a no-network CSP so a poisoned report can't exfiltrate at
display time. Inline script/style keep working; system browser is the escape hatch.
Sessions expose declared-and-connected only; 'all' is builtin-only; legacy true
migrates to the recommended refs, else nothing. Consent lists real names and
per-connector caps force re-consent when an update widens the grant.
Unparseable (_raw) args now get a truthful error: cut-off-by-output-limit says
'smaller pieces', bad JSON says 're-send with declared parameters'. Raw junk is
shrunk before entering history so replays can't teach the model the _raw shape.
Anthropic default max_tokens 16k -> 32k so typical report files fit outright.
Fact strip: 'OpenWorker installs its own verified copy from <publisher>' replaces
supply-chain jargon. On decline the engine re-resolves — a copy the user installed
themselves is handed to the agent as theirs, not treated as a refusal.
Registry metadata (version, publisher, checksum) moves to a distinct fact strip.
Decline button renamed to say the run continues; reason capped to one sentence.
trivy 0.74.0 pinned with per-platform digests so request_tool can install it.
tfsec is deprecated upstream; the bundle now drives trivy config instead.
Sidecar inherits the login shell's env; toolchain resolves absolute paths with pinned
installs; request_tool replaces the 'tool missing -> STOP' instruction that hid a check.
collect_submodules only takes .py, so packaged builds had no builtin coworkers.
Caught by inspecting the DMG — dev installs read them from the source tree.
Bundle zip export + import (zip-slip guarded) through the picker's Import door; version+provenance with a replaces-note, re-consent only when capabilities grow.
Consent screen: trust warning first, capability summary with collapsed tool list, recommended connectors.
Bundle skills/ dir joins the persona's session menu (additive; user disables/mutes win); manifest skills: narrows the bundle; mcp: scopes raw servers.
Install snapshot now carries the skills folder — the sharing bundle shape.
Per-session coworker+folder chips replace the sidebar split-button picker; code family gets a send-time folder dialog with git-ready temp dirs and Save as project.
Builtins ship enabled; user-facing noun is Coworker; personas flag now defaults on.
requires-python declares >=3.10 and the README says "Python 3.10+", but
coworker/config.py imports tomllib at module top and tomllib only landed in
the 3.11 stdlib — on 3.10 the package cannot even be imported (every test
module fails collection through the coworker.config import chain), so the
advertised floor is broken in practice.
Fall back to the tomli package (the pre-stdlib implementation of the same API)
and declare it as a dependency only for python_version < '3.11', so 3.11+
installs are unchanged.
Verified on 3.10: importing coworker.config and load_config() parsing a
workspace config.toml both work through the fallback; the config suite still
passes on 3.12.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The GUI README tells contributors to run `npx tsc --noEmit` and `npm run build`
starts with `tsc`, but CI never runs either — a type error ships green today
and only surfaces when someone next builds a bundle locally. Add the check as
one step inside the existing gui-unit job so it reuses that job's npm ci and
costs no extra runner.
Verified locally: `npx tsc --noEmit` exits 0 on current main, and the vitest
suite (82 tests) still passes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The GUI README still described the pre-split monorepo layout: every command
cd'd into a platform/ directory that does not exist in this repository, so a
fresh contributor following it verbatim fails at the first step. The venv,
packaging scripts, and surfaces/gui all live at the repo root now — align the
commands and the server_bin() dev-fallback comment with the layout the root
README already documents.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
guard.get_checked previously resolved a name for the address check and then let
the client resolve it again to connect, so a ~0-TTL record could flip to
127.0.0.1 (or the metadata endpoint) between the two — the exact gap the module
docstring called out as "not covered".
Every hop now connects to the address that passed its check: the request URL
carries the vetted IP, Host keeps the original name (and explicit port) for
virtual hosting, and the sni_hostname extension keeps the TLS handshake — and
certificate verification — against the name. Literal-IP URLs are unchanged.
Redirect Locations are resolved against the logical URL, and the final logical
URL rides resp.extensions["logical_url"] so web_fetch reports the name, not the
pinned address.
Verified against a local TLS server whose cert carries only DNS:pinned.test:
the pinned request (URL=127.0.0.1, sni_hostname=pinned.test) verifies and the
server sees Host: pinned.test; the same request without the extension fails
with "IP address mismatch" — httpcore does verify certificates against
sni_hostname, not the URL host.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rohit C Prasad