qm v0.1.10

QM 0.1.10 is a broad release: admin-managed models, grown-up sandboxes, and a web app polish pass.

• Admins can now manage models directly: add a model and its metadata gets looked up for you, each one is verified before it can be enabled, and tasks resume on whichever native runtime you pick.
• Sandboxes grew up. They're independent resources now, with sensible defaults, one set of tools, and native provider recovery. We qualify them by actually running code on each provider.
• Big files just work: uploads go straight to object storage and can resume if interrupted, and attachments stick around in completed chat history.
• Safer screening in Auto posture. We decide what counts as external from the egress proxy instead of trusting command text, only external tool results get screened, and anything we can't account for fails closed.
• The web app got a real polish pass across chat, inbox, settings, and the sidebar. Chat search is much faster, live thinking stays in the transcript, and long pinned prompts collapse.
• More control over sessions: choose isolated or open sharing, sign in by email on remembered browsers you can revoke, and portal sessions now default to 7 days rolling with a 30 day cap.
• For operators: the services consolidate into three workloads, PostgreSQL transaction pooling is supported, admin logs get a paginated Errors view, and Linear webhooks are verified.

What's Changed

• Bulk upstream of internal fork changes by @ReganBell in https://github.com/yc-software/qm/pull/963
• web-ui: elevate prompt and composer above the transcript by @16francej in https://github.com/yc-software/qm/pull/967
• fix: unify new chat placement across entry points by @16francej in https://github.com/yc-software/qm/pull/949
• feat: add admin-managed model definitions by @16francej in https://github.com/yc-software/qm/pull/966
• Fix sticky prompts, scrolling, and chat status placement by @16francej in https://github.com/yc-software/qm/pull/972
• Simplify admin model setup with metadata lookup by @16francej in https://github.com/yc-software/qm/pull/974
• Keep the system prompt stable across turns so prompt caching survives by @16francej in https://github.com/yc-software/qm/pull/971
• Use inline link icons for session sharing by @16francej in https://github.com/yc-software/qm/pull/975
• fix: clarify agent computer egress warning by @16francej in https://github.com/yc-software/qm/pull/973
• Screen only external tool results in Auto posture by @16francej in https://github.com/yc-software/qm/pull/970
• feat(inbox): move draft actions into composer suggestions by @16francej in https://github.com/yc-software/qm/pull/988
• web-ui: keep tooltips anchored through scrolling by @16francej in https://github.com/yc-software/qm/pull/991
• Make chat search fast and reliable using only its dedicated index by @ReganBell in https://github.com/yc-software/qm/pull/993
• Tape parity: limited-read comparison uses the snapshot window by @ReganBell in https://github.com/yc-software/qm/pull/994
• Update Hono to unblock production dependency audits by @ReganBell in https://github.com/yc-software/qm/pull/999
• Fix missing latest message in inbox conversation details by @ReganBell in https://github.com/yc-software/qm/pull/1003
• fix: keep tab widths stable on hover by @16francej in https://github.com/yc-software/qm/pull/985
• web-ui: a UI pass over the chat, inbox, settings, and sidebar surfaces by @evebouf in https://github.com/yc-software/qm/pull/976
• Port the factory loop from the factory-control-plane branch by @pcapriolo-yc in https://github.com/yc-software/qm/pull/1008
• Fix prompt expansion after resize and preserve pending inbox edits by @ReganBell in https://github.com/yc-software/qm/pull/1024
• fix: record metrics for ambient gate declines by @time-attack in https://github.com/yc-software/qm/pull/997
• fix: attribute shared-harness security calls as auxiliary by @time-attack in https://github.com/yc-software/qm/pull/996
• fix: list one authorized document per project across turns by @time-attack in https://github.com/yc-software/qm/pull/998
• Revert "Port the factory loop from the factory-control-plane branch (#1008)" by @pcapriolo-yc in https://github.com/yc-software/qm/pull/1026
• fix: anchor thinking above the composer by @16francej in https://github.com/yc-software/qm/pull/1004
• fix: add tabs instead of automatically splitting a fourth tile by @16francej in https://github.com/yc-software/qm/pull/984
• portal: default sessions to 7 days rolling, 30 days absolute by @ReganBell in https://github.com/yc-software/qm/pull/1025
• Combine AWS task restarts with candidate deployment by @ReganBell in https://github.com/yc-software/qm/pull/1027
• Remember email sign-in browsers with revocable broker sessions by @ReganBell in https://github.com/yc-software/qm/pull/1030
• Activate background work without redeploying the candidate by @ReganBell in https://github.com/yc-software/qm/pull/1029
• Build AWS candidate images with bounded concurrency by @ReganBell in https://github.com/yc-software/qm/pull/1031
• feat(webhooks): add linear verification scheme by @kai-jmi in https://github.com/yc-software/qm/pull/947
• Fix Codex JSON-RPC framing for Unicode line separators by @16francej in https://github.com/yc-software/qm/pull/1034
• Release dev slots after 24 hours of inactivity by @ReganBell in https://github.com/yc-software/qm/pull/1039
• fix: tighten tab action overlay around icons by @16francej in https://github.com/yc-software/qm/pull/1037
• Preserve sandbox working state with native provider recovery by @ReganBell in https://github.com/yc-software/qm/pull/1038
• fix: count usable security replay samples before limiting by @16francej in https://github.com/yc-software/qm/pull/1033
• Publish large Files directly to object storage with resumable uploads by @ReganBell in https://github.com/yc-software/qm/pull/1041
• Make sandboxes independent resources with explicit defaults and unified tools by @ReganBell in https://github.com/yc-software/qm/pull/1044
• Add a paginated Errors view to admin logs by @ReganBell in https://github.com/yc-software/qm/pull/1047
• Fix compact Fast mode toggle layout by @16francej in https://github.com/yc-software/qm/pull/1045
• fix(portal): ask the identity provider for the account chooser and hint the tenant domain by @ramybarsoum in https://github.com/yc-software/qm/pull/962
• Omit AI authorship attribution from contributions by @ReganBell in https://github.com/yc-software/qm/pull/1046
• Add native runtime selection and resume tasks on the selected model by @ReganBell in https://github.com/yc-software/qm/pull/1052
• fix(admin): restore Auto quarantine prompt controls by @16francej in https://github.com/yc-software/qm/pull/1063
• web-ui: collapse long pinned prompts by @16francej in https://github.com/yc-software/qm/pull/983
• Consolidate web/admin and portal/auth into three application workloads by @ReganBell in https://github.com/yc-software/qm/pull/1051
• Preserve gateway and verified CloudFront deployment prerequisites by @ReganBell in https://github.com/yc-software/qm/pull/1073
• Accept retained AWS coordinates for bundled service hosts by @ReganBell in https://github.com/yc-software/qm/pull/1075
• Support PostgreSQL transaction pooling with dedicated session connections by @ReganBell in https://github.com/yc-software/qm/pull/1072
• Preserve optional fields in unified sandbox tool schemas by @ReganBell in https://github.com/yc-software/qm/pull/1076
• fix: attach live activity to the floating composer by @16francej in https://github.com/yc-software/qm/pull/1074
• Fix dev idle retirement and slot cleanup by @ReganBell in https://github.com/yc-software/qm/pull/1079
• Add isolated and open sharing settings by @16francej in https://github.com/yc-software/qm/pull/1048
• Exercise runtime discovery and correct dev socket diagnostics by @ReganBell in https://github.com/yc-software/qm/pull/1084
• fix: preserve attachments in completed chat history by @16francej in https://github.com/yc-software/qm/pull/1068
• Fix chat formatting guidance and delivery surface labels by @ReganBell in https://github.com/yc-software/qm/pull/1088
• test(live-slack): send a signed portal identity on admin API calls by @ReganBell in https://github.com/yc-software/qm/pull/1092
• Require real execution across selected sandbox providers by @ReganBell in https://github.com/yc-software/qm/pull/1090
• Verify durable runtime handoff results in release qualification by @ReganBell in https://github.com/yc-software/qm/pull/1095
• Verify projected sandbox results in cloud qualification by @ReganBell in https://github.com/yc-software/qm/pull/1099
• Keep confirmed post replies visible across chat turns by @16francej in https://github.com/yc-software/qm/pull/1115
• fix: unify composer status font sizes by @16francej in https://github.com/yc-software/qm/pull/1119

New Contributors

• @evebouf made their first contribution in https://github.com/yc-software/qm/pull/976
• @ramybarsoum made their first contribution in https://github.com/yc-software/qm/pull/962

Full Changelog: https://github.com/yc-software/qm/compare/v0.1.9...v0.1.10