# v0.28.0 Release Notes

> v0.27.11 -> v0.28.0

## Summary

Adds a web-based co-work dashboard with multiplexed SSE log streaming, CORS-gated API access, and responsive multi-panel session monitoring. Introduces subagent planner routing with parallel task decomposition and idle session reuse. Hardens runtime lifecycle by decoupling execution context from HTTP connections and tightening temp session cleanup.

<details>
<summary>翻譯</summary>

新增 Web 版 Co-Work 儀表板，支援多工 SSE 串流、CORS 白名單 API 存取與響應式多面板 session 監控。引入 subagent planner 路由與並行任務分解及閒置 session 重用機制。強化 runtime 生命週期：將執行 context 與 HTTP 連線解耦，收緊臨時 session 清理。

</details>

## ⚠️ Breaking Changes

### Web mode removed and replaced by Cloudflare Workers deployment

The embedded `GET /` route serving `cowork.html` has been removed from the daemon. The co-work dashboard is now deployed as a separate Cloudflare Worker at `web.agenvoy.com` connecting to `localhost:17989` via CORS.

**Migration:** Access the dashboard at `web.agenvoy.com` instead of `localhost:17989/`. Ensure the daemon is rebuilt with CORS middleware for cross-origin access.

<details>
<summary>翻譯</summary>

Daemon 不再內嵌 `GET /` 頁面。Co-Work 儀表板改由 Cloudflare Worker 部署於 `web.agenvoy.com`，透過 CORS 連線 `localhost:17989`。需重新 build daemon 以啟用 CORS middleware。

</details>

### `temp-sub-` prefix unified to `temp-`

All subagent ephemeral sessions now use the `temp-` prefix instead of `temp-sub-`. Existing `temp-sub-*` session directories remain on disk but new sessions use the unified prefix.

**Migration:** No action required — old sessions expire naturally. Update any scripts that pattern-match `temp-sub-*`.

<details>
<summary>翻譯</summary>

子代理暫時 session 前綴從 `temp-sub-` 統一為 `temp-`。舊目錄自然過期，需更新任何比對 `temp-sub-*` 的腳本。

</details>

## Changes

### FEAT
- Add web co-work dashboard with responsive multi-panel session monitoring (@pardnchiu) [757493e]
- Add multiplexed SSE endpoint `GET /v1/log?sessions=` for single-connection multi-session streaming (@pardnchiu) [757493e]
- Add CORS middleware with origin whitelist for cross-origin API access (@pardnchiu) [757493e]
- Add subagent planner mode with parallel task decomposition in system prompt (@pardnchiu) [5402010]
- Add named delegation shortcut for `invoke_subagent` session resolution (@pardnchiu) [5402010]
- Add multi-source mandate for subagent data gathering (@pardnchiu) [5402010]
- Add idle temp session reuse with atomic claim mechanism (@pardnchiu) [5402010]
- Add `context.WithoutCancel` to decouple execution from HTTP request lifecycle (@pardnchiu) [757493e]
- Add responsive logo switching with `<picture>` for mobile viewports (@pardnchiu) [5402010]
- Add sidebar collapse with icon-only mode and tooltip on hover (@pardnchiu) [757493e]
- Add cookie persistence for pinned sessions (@pardnchiu) [757493e]
- Add auto-pin for online temp sessions and auto-unpin on idle/expire (@pardnchiu) [757493e]
- Add SSE-based streaming state detection for panel green-glow animation (@pardnchiu) [757493e]
- Add panel grid responsive breakpoints with dynamic row calculation (@pardnchiu) [757493e]
- Add gate overlay for endpoint detection with redirect to agenvoy.com (@pardnchiu) [757493e]
- Add sudo mode with 1h TTL and system-dir floor for TUI (@pardnchiu) [0723c44]
- Add static docs build system, split wiki into 23 focused pages (@pardnchiu) [9ffe0b9]
- Add Cloudflare Workers landing page and unify script URLs (@pardnchiu) [3f1e721]
- Add sensitive key/credential guard for `read_file` — always confirm regardless of sudo or allowlist

<details>
<summary>翻譯</summary>

- 新增 Web Co-Work 儀表板，支援響應式多面板 session 監控
- 新增多工 SSE 端點 `GET /v1/log?sessions=` 單連線串流多 session
- 新增 CORS middleware 與 origin 白名單
- 新增 subagent planner 模式與並行任務分解
- 新增 named delegation 快捷解析 `invoke_subagent` session
- 新增 multi-source mandate 規則
- 新增閒置 temp session 重用與原子 claim 機制
- 新增 `context.WithoutCancel` 解耦執行與 HTTP 連線
- 新增響應式 logo 切換（`<picture>` 行動版適配）
- 新增側邊欄收合（icon 模式 + tooltip）
- 新增 cookie 持久化 pin session
- 新增 auto-pin/unpin temp session
- 新增 SSE 事件驅動的 streaming 狀態偵測與綠色動畫
- 新增 panel grid 響應式斷點與動態列數計算
- 新增端點偵測 gate overlay
- 新增 sudo 模式（1h TTL + 系統目錄保護）
- 新增靜態文檔建構系統（23 頁 wiki）
- 新增 Cloudflare Workers 首頁
- 新增密鑰檔案讀取保護（`read_file` 對 SSH key / `.pem` / `.env` 等 always 詢問，sudo 也無法繞過）

</details>

### FIX
- Handle consumed pending tasks and clean up summary and TUI fallback (@pardnchiu) [dfd4855]
- Fix consecutive fetch failure threshold to prevent false offline status (@pardnchiu) [757493e]

<details>
<summary>翻譯</summary>

- 處理已消費的 pending task 並清理 summary 與 TUI fallback
- 修正連續 fetch 失敗閾值，防止誤判離線

</details>

### SECURITY
- Bind HTTP server to `127.0.0.1` only — LAN clients can no longer reach the daemon
- Add `Access-Control-Allow-Private-Network` header for Chrome PNA compliance
- Add sensitive file guard: `read_file` always requires confirmation for SSH keys, `.pem`, `.key`, `.env` regardless of sudo or allowlist

<details>
<summary>翻譯</summary>

- HTTP server 綁定 `127.0.0.1` — LAN 無法連線 daemon
- 加入 `Access-Control-Allow-Private-Network` header 通過 Chrome PNA 關卡
- 密鑰檔案保護：`read_file` 對 SSH key / `.pem` / `.key` / `.env` 無論 sudo 或 allowlist 都 always 詢問

</details>

### UPDATE
- Update temp session cleanup cron from daily to every 30 minutes (@pardnchiu) [757493e]
- Reduce temp session TTL from 1 hour to 30 minutes (@pardnchiu) [757493e]
- Unify logo to `logo-text.svg` at 30px across home, docs, and co-work (@pardnchiu) [5402010]
- Align header heights to 56px across all pages (@pardnchiu) [5402010]

<details>
<summary>翻譯</summary>

- 調整 temp session 清理 cron 從每日改為每 30 分鐘
- 縮短 temp session TTL 從 1 小時至 30 分鐘
- 統一 logo 為 `logo-text.svg` 30px
- 統一 header 高度為 56px

</details>

### REFACTOR
- Remove unused functions `getAllowList`, `mergeHits`, `skippedMessage` (@pardnchiu) [0be280d]
- Simplify table parsing with `TrimPrefix`/`TrimSuffix` in TUI (@pardnchiu) [0be280d]
- Unify duplicate import alias in Telegram runtime (@pardnchiu) [0be280d]
- Unify action log `ParseLine` between session/log and TUI (@pardnchiu) [757493e]
- Remove embedded `cowork.html` and `WebPublicDir` from daemon (@pardnchiu) [757493e]
- Replace go-sqlite with go-sqlkit and remove Builder indirection (@pardnchiu) [8211d3d]

<details>
<summary>翻譯</summary>

- 移除未使用函式 `getAllowList`、`mergeHits`、`skippedMessage`
- 簡化 TUI table parsing（`TrimPrefix`/`TrimSuffix`）
- 統一 Telegram runtime 的重複 import alias
- 統一 action log `ParseLine`（session/log 與 TUI 共用）
- 移除 daemon 內嵌 `cowork.html` 與 `WebPublicDir`
- 以 go-sqlkit 取代 go-sqlite

</details>

### REMOVE
- Remove embedded dashboard route and static assets from daemon (@pardnchiu) [757493e]
- Remove toast notification system from co-work page (@pardnchiu) [757493e]
- Remove unused `skipped.md` embed file (@pardnchiu) [0be280d]

<details>
<summary>翻譯</summary>

- 移除 daemon 內嵌儀表板路由與靜態資源
- 移除 co-work 頁面的 toast 通知
- 移除未使用的 `skipped.md` embed 檔案

</details>

## Scope

- `internal/runtime/routes/` — FEAT, SECURITY, REFACTOR (`new.go`, `handler/multilog.go`, `handler/log.go`, `handler/send.go`, `handler/sessions.go`, `handler/pending.go`)
- `internal/session/` — FEAT, UPDATE, REFACTOR (`concurrent.go`, `clean.go`, `session.go`, `log/replay.go`)
- `internal/agents/exec/` — FEAT, SECURITY, REFACTOR (`execWithSubagent.go`, `toolCall.go`)
- `internal/tools/file/` — SECURITY (`readFile.go`)
- `cmd/app/` — SECURITY, UPDATE (`cmdDeamon.go`)
- `internal/tools/agent/subagent/` — UPDATE (`invokeSubagent.go`)
- `internal/runtime/tui/` — REFACTOR (`viewRender.go`, `handlerLogMode.go`)
- `internal/runtime/telegram/` — REFACTOR (`new.go`, `run.go`)
- `internal/runtime/discord/` — REFACTOR (`run.go`)
- `internal/tools/fetchPage/` — REMOVE (`skipped.go`, `embed/`)
- `internal/tools/` — REFACTOR (`searchConversationHistory.go`)
- `internal/filesystem/` — REMOVE (`path.go`)
- `configs/prompts/` — FEAT (`system_prompt.md`)
- `worker/` — UPDATE (`build.js`, `public/index.html`)
- `worker-web/` — FEAT, ADD (`wrangler.toml`, `package.json`, `public/index.html`)
- `cmd/app/` — UPDATE (`cmdDeamon.go`)

***

Generated by [SKILL](https://github.com/pardnchiu/skill-version-generate)