Expose plugins that declare the external settings section from the External Services settings page.
Wire the sidebar item, subsection mount, and settings DOX contract so plugin sections use matching tab IDs.
Ensure x-component loading awaits cached dynamic import promises before appending deferred markup, matching first-load behavior and preventing Alpine bindings from running before imported stores register.
Document the loader contract in the WebUI JS DOX notes.
Raise notification toasts and Bootstrap tooltips above normal and legacy modal overlays while keeping confirmation dialogs on top.
Remove the duplicate tooltip CSS block and add a focused regression for the layer ordering contract.
Load startup vendor scripts with defer and serve Bootstrap locally so the first WebUI mount no longer depends on a parser-blocking CDN request.
Add a focused regression that rejects undeferred classic startup scripts in index.html and documents the vendor/startup contract.
Accept shell-style local MCP command values from the manager before spawning stdio clients, so configs like uvx workspace-mcp resolve to the correct executable and args.
Split collapsed option/value argument lines in the MCP manager, document the input contract, and add a regression for the google_workspace MCP shape.
Render settings secrets as masked text inputs instead of browser password fields. Add a static regression test so settings password controls do not return during future refactors.
Remove composer blocking so sends always create or enter a chat and route missing-model messages through the in-thread gate.
Make Utility model selection explicit by removing same-as-main sync and defaulting to each provider's utility model when available.
Compact onboarding success channel cards and update static regressions for the new onboarding/gate behavior.
Replace the separate Cloud/Local illustrated path screen with a single provider step that switches between Cloud, Account, and Local choices.
Route the first-send gate account choice through onboarding, remove the old Cloud/Local card assets, and keep model setup in the existing onboarding flow.
Update static onboarding and welcome composer regressions for the merged provider step.
Stop auto-populating Main and Utility models when an OAuth account is already connected or newly connected.
Add a connected-account gate state that routes users to model configuration instead of choosing provider defaults silently.
Update OAuth notifications, chat gate copy, DOX contracts, and focused static regressions for the explicit model-selection flow.
Move missing-model setup out of the welcome screen and into an in-thread gate that preserves the pending prompt, survives refresh, and auto-dispatches after a usable model is configured.
Reuse existing onboarding, OAuth account settings, and advanced model configuration surfaces instead of duplicating provider forms. Connected OAuth accounts can now populate Main and Utility defaults when no chat model is configured.
Update model readiness checks, focused static regressions, and DOX contracts for the new deferred setup flow.
Mark message action button chrome as non-selectable so copy/paste captures message text without toolbar icon labels.
Add a static regression for the shared action-buttons stylesheet.
Render file action menus outside the scroll container with fixed positioning so dropdowns remain visible while file list scrolling stays intact.
Deduplicate component body assets during x-component loading and add regressions for the menu, opaque header, and duplicate scoped styles.
Switch the chat composer to a Markdown-backed contenteditable editor so typing a triple-backtick fence and pressing Enter creates a visual code block while pasted fenced Markdown stays plain text.
Serialize visual code blocks back to fenced Markdown for send/history, keep full-screen input in sync with the backing store, and update the focused composer regression plus DOX contract.
Treat full log snapshots as authoritative replays by clearing the message DOM when the snapshot starts at log no 0, then render logs in backend order. This prevents streamed responses from staying above earlier welcome/user messages after sync races while keeping incremental updates patch-based.
Suppress the chat progress ghost placeholder until a chat is selected so the welcome new-chat prompt remains the only visible composer hint. Add a focused static regression for the welcome composer idle-progress overlap case.
Route the Configure credentials banner link through the welcome banner action dispatcher so it opens Settings directly at External Services > Authentication.\n\nAdd coverage for the unsecured connection banner and document the structured banner action contract for future banner links.
Restore restorable surface modals through the initFw_end extension hook and keep right-canvas state in session storage for normal reloads.
Fix Desktop host visibility after modal cleanup so preserved iframes reattach to real modal or canvas hosts, and remove the duplicate file-browser path icon overlay.
Reintroduce the shared .text-button primitive in WebUI button CSS so model-config preset controls no longer depend on the chat composer being mounted first.
Document the shared compact text-action contract and add a focused regression covering Model Presets and Model Configuration text-button usage.
Route non-action canvas surfaces to their floating/modal forms while the welcome screen is active, and keep the canvas rail/shell hidden until a chat is selected.
Open the welcome Files quick action through the File Browser modal directly so the first screen remains composed.
Document the welcome/canvas boundary in the local DOX contracts and add focused regression assertions for the canvas guard and Files quick action.
Raise the shared modal stack above the mobile right-canvas rail so blocking modals remain authoritative on small screens. Compact the mobile rail below 420px to reduce intrusion on narrow phones, and document the stacking contract in the owning DOX files.
Verification: pytest tests/test_browser_agent_regressions.py -q; pytest tests/test_office_canvas_setup.py -q; git diff --check; headless Chrome smoke confirmed modal content wins at the rail overlap point.
Generalize the Editor storage/session path from Markdown-only to exact-text .md and .txt documents, including open, save, Save As, and rename refresh behavior.
Expose Open in Editor as a visible row action in the File Browser for Editor-owned text files, keep non-Editor surface opens in the overflow menu, and route Desktop text MIME handling through the Editor bridge.
Tests: node --check webui/components/modals/file-browser/file-browser-store.js; python -m py_compile plugins/_office/helpers/document_store.py plugins/_editor/helpers/markdown_sessions.py plugins/_editor/api/editor_session.py plugins/_editor/api/ws_editor.py plugins/_desktop/helpers/desktop_session.py plugins/_desktop/api/desktop_session.py plugins/_office/api/office_session.py plugins/_office/api/ws_office.py; pytest tests/test_office_document_store.py tests/test_file_browser_navigation.py tests/test_office_canvas_setup.py -q
Keep the File Browser path and search affordances on compact mobile rows, with create buttons sharing the search row and the Up control sharing the path row.
Give the Web Browser mobile toolbar a full-width address row by moving navigation controls above it, and add regression/DOX coverage for the layout contracts.
Keep the right-canvas rail visible at mobile widths while routing non-action surface affordances into floating modals instead of the side canvas shell. Hide mobile surface-modal header controls except the close button and Editor New action, and clamp floating surface modal geometry to narrow viewports.
Match the real chat composer to the welcome composer by using an 8px radius, centering the idle Waiting for input cue and fullscreen input control against the composer container, and switching the fullscreen input icon to the same fullscreen glyph used by modal surface Focus mode. Also remove the mobile-only #chat-input min-height under 640px so the composer can size naturally on narrow screens.
Update the Projects modal card layout so edit/delete and activation controls stay beside the project title on narrow viewports. Add truncation for long project titles and paths, collapse activate/deactivate labels on phones, and preserve desktop spacing while preventing horizontal overflow.
Adjust the welcome-screen composer so the shared chat input wraps cleanly on narrow phones. Reclaim hidden expand-button padding, suppress placeholder-only textarea scrollbars, and tune the iPhone-width placeholder sizing while preserving normal typed-message scrolling.
Route right-canvas rail clicks through the explicit canvas opener so Browser, Editor, Files, and Desktop open in the canvas even after a modal session. Preserve modal-header surface switches as floating modal entry points, and document/test the entry-point split.
Add Files to the universal canvas rail and sidebar flow, with a reusable floating surface modal chrome that matches Browser/Desktop behavior.
Make the File Browser modal draggable/resizable with Focus mode, keep Editor on the same draggable modal helper, and preserve dock/undock handoff state.
Harden File Browser startup so empty paths resolve to the default workdir, restyle the Up control, compact New file/New folder actions, and hide Modified before Name/Size in narrow containers.
Update DOX contracts and focused regression coverage for the new Files surface, modal chrome, default-path fallback, and compact layout behavior.
Fold the blocking onboarding state into the welcome composer, refresh the account and channel tiles, and keep system resources aligned with the renewed Welcome Screen layout.
Update model-config, OAuth, and welcome static tests to pin the new CTA, dismissal, copy, and layout contracts.
Rework the welcome screen around the shared new-chat composer, renewed quick actions, discovery cards, OAuth accounts, and dedicated system resources panel.
Restore static button colors and neutral surfaces, move microphone state feedback onto the icon, and keep Rubik/code-font composer behavior.
Add focused static regressions for the welcome composer, OAuth discovery panel, and speech button contract.
Remove agent profile scoping from the List Skills and Import Skills settings sections so skills are scoped only by project.
Move Scan Skills after Import Skills in both navigation metadata and rendered section order, and add an MCP-style search affordance to List Skills with filtered results and an empty search state.
Add a Settings > Skills scanner section and modal backed by Snyk Agent Scan-oriented checks and prompts. Wire uploaded skill zips from Import Skills into the scanner before import, and add a preparation API that extracts archives into temporary scan roots without installing or executing them.
Harden shared skill zip extraction against traversal, backslash paths, and symlink entries, and cover the new flow with focused scanner tests.
- add a parallel wrapper and runtime for concurrent background tool calls
- run parallel call_subordinate jobs as child chats with visible subagent steps that match normal subordinate args
- render parallel child tool steps with normal tool-call args while keeping job handles in wrapper results and prompt extras
- group parallel child chats in the sidebar with persistent accordion and caret behavior
- add prompt, extension, DOX, and regression coverage
Ensure native browser controls use the shared Rubik font token so Firefox no longer falls back to its UI font in form elements.\n\nImport Rubik on the login page and document the WebUI font contract, keeping mono aliases reserved for code and fixed-width data.
Use the shared inline confirmation helper for configured MCP server removal and keep the delete icon neutral until confirmation.\n\nApply confirmed removals immediately, refresh server status from the apply response, guard against stale/double actions, and document the new MCP manager behavior.
Revamp the global and project MCP manager surfaces with list-first layout, clearer examples, a dedicated scanner modal, manager/raw toolbar parity, and local-command-first server creation.\n\nAdd server and tool search, plugin-style enable toggles, per-tool disabled_tools handling in the MCP backend, internal A0 MCP tool search, regression coverage, and updated DOX contracts.
Add project-scoped MCP server configuration with global/project merge semantics, a richer settings UI, and chat composer access. Introduce MCP config scanning plus project-aware status/detail/log/apply APIs while preserving the raw JSON editor. Strengthen MCP runtime handling for dotted tool names, timeouts, status accuracy, and project-aware tool execution, with focused regression coverage.
Add settings sidebar search with filtered section results and clear affordance. Decouple sidebar accordion expansion from the active section so groups can be opened or collapsed manually. Keep the settings menu/search column fixed while the content pane scrolls, and promote Backup & Restore to its own section under Self Update.
Add comprehensive file-level DOX documentation across the repo and update directory AGENTS.md indexes. Many new `*.py.dox.md` files were added under api, helpers, tools, plugins, extensions, webui, and other dirs to document endpoint purpose, ownership, runtime contracts, work guidance, and verification. Several AGENTS.md files were created or updated (agents profiles, api, docker, extensions, helpers, plugins, skills, webui components, etc.) to list child DOX files and clarify documentation/work guidance. Also add example and bundled profile DOX files (agent0, default, developer, hacker, researcher) and minor updates to helpers/dirty_json.py and its tests. These changes improve on-disk documentation coverage and establish the convention that each direct runtime file should have a matching `*.dox.md` describing its contracts and verification steps.
Add direct directory navigation to the file browser path bar and preserve the current listing when typed paths fail.
Add a default-enabled setting to remember the last successful file browser directory, while keeping explicit open paths deterministic.
Return users to their original requested page after login, with robust same-origin validation to prevent open redirects.
Co-Author Agent Hero <agent-hero@neurocis.ai>
Flatten dropped or selected folders into ordinary file attachments while preserving basename display and existing multi-file upload behavior.
Make the composer attachment menu actions open their hidden file inputs directly, and label them as Attach files and Attach folder.
Add support for including a top-level AGENTS.md in a project's system instructions while keeping backwards-compatible defaults. Introduces include_agents_md project metadata (defaults to true), normalization and save logic, and helper functions to discover and format AGENTS.md and other instruction files into the system prompt. Updates build_system_prompt_vars to assemble instruction parts, adds UI checkbox in project edit form, normalizes defaults in the projects store, and adds tests for the new behavior. Also documents the compatibility rule in AGENTS.md and adds a small prompt rule reminder.
Introduce DOX (AGENTS.md) contracts across the repository to formalize ownership and local work contracts: adds .github/AGENTS.md plus AGENTS.md files for agents, api, conf, docker, docs, extensions, helpers, knowledge, lib, plugins, prompts, scripts, skills, tests, tools, usr, webui (and several subfolders). Update root AGENTS.md (content and last-updated date) to include DOX framework guidance and a child DOX index. Update .gitignore to allow usr/ and usr/plugins AGENTS.md files. Remove legacy deep-dive files under docs/agents (banners, components, modals, plugins) and migrate frontend/plugin references to webui/ and plugins/ DOX locations. Also adjust plugins/README.md and several skills/*/SKILL.md files to align with the new DOX layout.
Start Tailscale Remote Control through Funnel on HTTPS port 443, verify the prepared client supports the funnel command, and give the Funnel startup path a longer approval window.
Forward Tailscale approval/login URLs through the shared tunnel notification stream so the UI renders an actionable browser link like Microsoft Dev Tunnels, with clearer basic-user copy around approval and public Funnel URLs.
Keep ngrok removed from the Remote Control surface and extend regression coverage for Funnel command wiring, unsupported clients, and approval-link handling.
Rename the Remote Link UI and user-facing messages to Remote Control.
Refactor tunnel startup into provider helpers, remove ngrok support, and keep Cloudflare Tunnel, Microsoft Dev Tunnels, Serveo, and Tailscale wired through the Remote Control selector.
Add provider-time binary preparation, Tailscale userspace tailscaled startup, Tailscale login URL display, Microsoft Dev Tunnel progress feedback, and focused regression coverage for the Remote Control provider flows.
Let users hide skills from the model-facing available catalog through the chat Skills selector while keeping pinned skill injection as a separate mode.
Hidden skills are filtered from skill listing, search, loading, relevant recall, and loaded-skill prompt injection, with chat-level show/hide overrides and persistent default hidden-skill config support.
Let File Browser-sourced Editor opens register existing Markdown files under the Agent Zero runtime root while preserving the stricter document artifact sandbox for ordinary document operations. Pass the file-browser source through the Editor store and cover the /a0/AGENTS.md-style path with regression tests.
