Release

qm v0.1.16

Side chats — ask about any passage without derailing the conversation (#2730, #2784). Spend visibility — people see what their work costs; admins can set spend caps (#2594, #2886). Smoother app…

2026-11-04 by @yc-software · QM · Releases

Originally published on github.com →

Highlights

Side chats — ask about any passage without derailing the conversation (#2730, #2784).
Spend visibility — people see what their work costs; admins can set spend caps (#2594, #2886).
Smoother app connections — reconnect or disconnect apps, Zoom, and large tool catalogs (#2452, #2531, #2697).
A faster, livelier web UI (#2433, #2740, #2517, #2272).
Simpler admin — settings live in the web UI; one-step offboarding (#2766, #2808).
Render support for hosting and computers (#2704, #2833).
Security hardening across networking, logins and database connections (#2583, #2801, #2800, #2635).
Breaking: one agent harness (Claude via Pi), Postgres-only storage, and several legacy features and settings removed (#2768, #2769, #2500).

What's Changed

Deliver scheduled messages to teammates without recipient consent by @ReganBell in https://github.com/yc-software/qm/pull/2425
Declare each route's actor on the route instead of a parallel list by @ReganBell in https://github.com/yc-software/qm/pull/2352
Send git proxy credentials up front in sandbox commands by @ReganBell in https://github.com/yc-software/qm/pull/2426
Deploys: per-provider app size cap (AWS 100 MiB) and chunked MicroVM writes by @ReganBell in https://github.com/yc-software/qm/pull/2423
web-ui: show steers in the transcript as soon as they're sent by @ReganBell in https://github.com/yc-software/qm/pull/2422
AWS MicroVM: follow nextToken and filter by name when finding images by @ReganBell in https://github.com/yc-software/qm/pull/2434
Keep the sidebar off the chat-switch path by @ReganBell in https://github.com/yc-software/qm/pull/2435
Await config-store writes instead of reporting them saved early by @ReganBell in https://github.com/yc-software/qm/pull/2353
Live e2e: report what a failed provider execute returned by @ReganBell in https://github.com/yc-software/qm/pull/2439
Stop masking execute output with forced-egress git config values by @ReganBell in https://github.com/yc-software/qm/pull/2442
Stream reasoning summaries to the web as they arrive by @ReganBell in https://github.com/yc-software/qm/pull/2433
Derive web UI and admin emoji from emoji-datasource; one Slack mark by @ReganBell in https://github.com/yc-software/qm/pull/2437
Delete committed copies of the microvm agent, Fly templates, and shared helpers by @ReganBell in https://github.com/yc-software/qm/pull/2430
sandbox: classify Modal and process-session errors by type and state, not message text by @ReganBell in https://github.com/yc-software/qm/pull/2440
Branch on typed error codes instead of error text in core API paths by @ReganBell in https://github.com/yc-software/qm/pull/2441
Decide Docker, Fly, Porter and RDS-drill outcomes from state, not error text by @ReganBell in https://github.com/yc-software/qm/pull/2443
Read typed fields instead of matching text for web UI approval denials, cron titles and theme imports by @ReganBell in https://github.com/yc-software/qm/pull/2445
Use typed fields instead of string matching for turn resume, document truncation, self messages and live search by @ReganBell in https://github.com/yc-software/qm/pull/2438
Command policy: parse shell with tree-sitter-bash instead of regex rewrites by @ReganBell in https://github.com/yc-software/qm/pull/2355
Deploy the egress proxy as a regular qm service by @ReganBell in https://github.com/yc-software/qm/pull/2266
Give drifted lists one source of truth by @ReganBell in https://github.com/yc-software/qm/pull/2428
Broker: fixed non-secret headers on brokered credentials by @16francej in https://github.com/yc-software/qm/pull/2432
Skip dependency install scripts in the core and egress-proxy images by @ReganBell in https://github.com/yc-software/qm/pull/2457
History copy: items schema and resumable production backfill by @ReganBell in https://github.com/yc-software/qm/pull/2344
Items E: cut session history over to the items table (stacked on D #2344) by @ReganBell in https://github.com/yc-software/qm/pull/2258
Stage items storage promotion at the deployment handoff by @ReganBell in https://github.com/yc-software/qm/pull/2396
Let people reconnect or disconnect connected apps by @16francej in https://github.com/yc-software/qm/pull/2452
Let swarm parents give workers goals that keep them working by @16francej in https://github.com/yc-software/qm/pull/2429
Attribute spend to the cron that ran it by @ebakan in https://github.com/yc-software/qm/pull/2420
Add Server-Timing phase timing to transcript, approvals and session-list requests by @ReganBell in https://github.com/yc-software/qm/pull/2467
Slack: typed codes and fields instead of string matching (regex burndown: slack) by @ReganBell in https://github.com/yc-software/qm/pull/2446
Read goal spend, pack ownership, sync-task freshness and model provider from typed fields by @ReganBell in https://github.com/yc-software/qm/pull/2448
Revert Server-Timing phase timing (#2467) by @ReganBell in https://github.com/yc-software/qm/pull/2473
Silence poll fires only through finish_silently, not sentinel reply text by @ReganBell in https://github.com/yc-software/qm/pull/2450
Stream relayed core responses through the web UI server by @ReganBell in https://github.com/yc-software/qm/pull/2469
Prove a stopped AWS core cohort is not the background owner through the production route by @ReganBell in https://github.com/yc-software/qm/pull/2472
Keep sandbox failure evidence instead of discarding it by @ReganBell in https://github.com/yc-software/qm/pull/2351
Record reply-detection failures instead of discarding them by @ReganBell in https://github.com/yc-software/qm/pull/2475
Log discarded errors at 39 empty-catch sites by @ReganBell in https://github.com/yc-software/qm/pull/2474
Retire legacy session history storage (items phase F) by @ReganBell in https://github.com/yc-software/qm/pull/2478
Trace requests, runs and Postgres with Sentry; retire turn_metrics by @ReganBell in https://github.com/yc-software/qm/pull/2477
items F: drop the legacy session history tables by @ReganBell in https://github.com/yc-software/qm/pull/2486
Admin Sessions tab: one newest-first list, no live totals by @ReganBell in https://github.com/yc-software/qm/pull/2487
Override hono to 4.13.13 to clear GHSA-5r4p-p66f-jhc7 by @ReganBell in https://github.com/yc-software/qm/pull/2489
Hold the legacy history drop until copied tool-call ids are verified by @ReganBell in https://github.com/yc-software/qm/pull/2491
Add a Hand-managed infrastructure lens to the Wall of shame by @ReganBell in https://github.com/yc-software/qm/pull/2493
Desktop: expand native input, observations and background activation by @ReganBell in https://github.com/yc-software/qm/pull/2397
Make the enabled-models picker a typeahead by @16francej in https://github.com/yc-software/qm/pull/2451
Use the MCP SDK client for MCP connectors and memory providers by @ReganBell in https://github.com/yc-software/qm/pull/2479
Send mail through Nodemailer and one Resend client by @ReganBell in https://github.com/yc-software/qm/pull/2480
Let custom providers serve models QM already ships, under their own name by @16francej in https://github.com/yc-software/qm/pull/2427
web-ui: delete duplicate, dead and undefined-token rules from shell.css by @ReganBell in https://github.com/yc-software/qm/pull/2458
Let agents upload images for X posts through their own connection by @16francej in https://github.com/yc-software/qm/pull/2470
Keep unhoisted tool-call ids from the items copy, then drop the legacy history tables by @ReganBell in https://github.com/yc-software/qm/pull/2499
Share one Gmail REST client across sent mail, push, inbox refresh and send by @ReganBell in https://github.com/yc-software/qm/pull/2492
Import redactSecrets from plugins/chassis in the X media upload route by @ReganBell in https://github.com/yc-software/qm/pull/2504
Refuse in-memory stores, locks and leases in production instead of falling back silently by @ReganBell in https://github.com/yc-software/qm/pull/2453
Derive admin, strict-posture and catalog policy from route metadata by @ReganBell in https://github.com/yc-software/qm/pull/2481
Show per-user MCP tools only to people who connected that server by @ReganBell in https://github.com/yc-software/qm/pull/2507
Trim intent/locale and retrySafe boilerplate from tool schemas by @ReganBell in https://github.com/yc-software/qm/pull/2508
Drop the Hand-managed infrastructure lens from the Wall of shame by @ReganBell in https://github.com/yc-software/qm/pull/2510
Drop the retired turn_metrics table by @ReganBell in https://github.com/yc-software/qm/pull/2490
Allow the repo's own URL dependencies under npm 12 by @ReganBell in https://github.com/yc-software/qm/pull/2512
Keep proxy and non-interactive env through sudo in sandboxes by @ReganBell in https://github.com/yc-software/qm/pull/2511
Revert sudoers env_keep provisioning (#2511) and npm allow-remote config (#2512) by @ReganBell in https://github.com/yc-software/qm/pull/2518
Bound one-off ECS task waits by the rollout deadline instead of the CLI waiter's 10 minutes by @ReganBell in https://github.com/yc-software/qm/pull/2503
Trim the session list and stop rebuilding it for scope lookups by @ReganBell in https://github.com/yc-software/qm/pull/2495
Cut run-claim cost: plan the session check as a subplan, wake one idle worker per signal by @ReganBell in https://github.com/yc-software/qm/pull/2488
Keep long worker runs inside Sentry's transaction size limit by @ReganBell in https://github.com/yc-software/qm/pull/2498
Index items call ids by digest so long gateway call ids fit by @ReganBell in https://github.com/yc-software/qm/pull/2494
Bump follow-redirects from 1.16.0 to 1.16.1 by @dependabot[bot] in https://github.com/yc-software/qm/pull/2515
Bump @modelcontextprotocol/sdk from 1.31.0 to 1.32.1 by @dependabot[bot] in https://github.com/yc-software/qm/pull/2513
Bump vite from 7.3.6 to 7.3.7 in /plugins/web-ui by @dependabot[bot] in https://github.com/yc-software/qm/pull/2514
Typecheck with tsrs, pinned to an exact version by @ReganBell in https://github.com/yc-software/qm/pull/2519
Remove the flaky queued-run trace test in request-timing by @ReganBell in https://github.com/yc-software/qm/pull/2520
sessions: purge captured LLM prompts after 30 days; drop the legacy inline request column by @ReganBell in https://github.com/yc-software/qm/pull/2485
Measure claims per notification only after the startup resync settles by @ReganBell in https://github.com/yc-software/qm/pull/2523
Page the sidebar session list and load subagents on demand by @ReganBell in https://github.com/yc-software/qm/pull/2517
Count inline documents in the context budget and stub them when they no longer fit by @16francej in https://github.com/yc-software/qm/pull/2506
Move the mock harness out of production into test support (F565) by @ReganBell in https://github.com/yc-software/qm/pull/2471
Dropbox skill: distinguish a missing auth header from a bad token by @16francej in https://github.com/yc-software/qm/pull/2524
Skip the inline session claim while the awaited run is running by @ReganBell in https://github.com/yc-software/qm/pull/2525
Revert the wake-one-worker half of the run-claim change, keep OFFSET 0 by @ReganBell in https://github.com/yc-software/qm/pull/2526
Fix the admin OAuth app connector picker by @16francej in https://github.com/yc-software/qm/pull/2540
Fix the admin OAuth app connector picker by @jetzhou in https://github.com/yc-software/qm/pull/2530
Add a Zoom connector for scheduling meetings by @jetzhou in https://github.com/yc-software/qm/pull/2531
List every skill under a size budget, name connector token variables, remove pinned skills by @16francej in https://github.com/yc-software/qm/pull/2532
Collapse config-store settings into one table-driven helper by @ReganBell in https://github.com/yc-software/qm/pull/2456
Give custom Anthropic models the thinking binding of the known model they name by @16francej in https://github.com/yc-software/qm/pull/2528
Read current Slack reactions through the context API by @16francej in https://github.com/yc-software/qm/pull/2556
Treat a goal governor that cannot decide as no decision by @16francej in https://github.com/yc-software/qm/pull/2536
Take subagent counts from the server rollup for every row by @16francej in https://github.com/yc-software/qm/pull/2527
Expire idle uploads and make the upload quota recoverable by @16francej in https://github.com/yc-software/qm/pull/2468
Hand swarm messages to running worker goals and let workers wait by @16francej in https://github.com/yc-software/qm/pull/2533
Pad the inbox assistant panel and let people hide it by @ReganBell in https://github.com/yc-software/qm/pull/2555
Keep inbox items current from Gmail and Slack events by @16francej in https://github.com/yc-software/qm/pull/2374
Dismissible suggested activities with a reserve and debounced refresh by @ReganBell in https://github.com/yc-software/qm/pull/2558
Make the suggested-activity dismiss X hover and focus subtler by @ReganBell in https://github.com/yc-software/qm/pull/2563
browse: install the runner runtime on demand from one shared script by @16francej in https://github.com/yc-software/qm/pull/2557
Let a swarm worker wait on another agent without burning its goal by @16francej in https://github.com/yc-software/qm/pull/2543
Read goal evidence files by absolute path and say why one can't be read by @16francej in https://github.com/yc-software/qm/pull/2560
Re-adopt a suggestions cron whose task was reverted to the standard instructions by @ReganBell in https://github.com/yc-software/qm/pull/2564
Let any tool declare that each call needs approval by @ReganBell in https://github.com/yc-software/qm/pull/2561
Serve a large MCP tool catalog as one searchable tool by @ReganBell in https://github.com/yc-software/qm/pull/2562
Remove internal member overrides by @ReganBell in https://github.com/yc-software/qm/pull/2567
Drop the retired internal_member_overrides table by @ReganBell in https://github.com/yc-software/qm/pull/2568
Let agents list and abort their own unfinished uploads by @16francej in https://github.com/yc-software/qm/pull/2559
Bump fastify and ip-address to clear npm audit advisories by @ReganBell in https://github.com/yc-software/qm/pull/2571
Make reply and command parsers linear-time by @ReganBell in https://github.com/yc-software/qm/pull/2570
Screen loop item data like webhook payloads by @ReganBell in https://github.com/yc-software/qm/pull/2569
Use one canonical request path for routing and authorization by @ReganBell in https://github.com/yc-software/qm/pull/2579
Default sandbox network to private; clean up test fixture servers by @16francej in https://github.com/yc-software/qm/pull/2583
Let team members manage team-owned artifacts by @16francej in https://github.com/yc-software/qm/pull/2591
Leave swarm replies in the recipient's mailbox instead of waking it by @16francej in https://github.com/yc-software/qm/pull/2582
Let admin-reading crons work unattended, or say why at creation by @16francej in https://github.com/yc-software/qm/pull/2578
Show security flags and quarantines that fall outside the newest 200 audit events by @16francej in https://github.com/yc-software/qm/pull/2597
Keep temporary failures from quarantining loops by @16francej in https://github.com/yc-software/qm/pull/2590
Bump undici, zod, nodemailer, fast-uri and body-parser past new advisories by @ReganBell in https://github.com/yc-software/qm/pull/2606
Keep personal credentials from overriding the computer's own environment by @ReganBell in https://github.com/yc-software/qm/pull/2576
Let release qualification reach models through the model gateway by @ReganBell in https://github.com/yc-software/qm/pull/2609
Persist the active runtime on runtime get results by @ReganBell in https://github.com/yc-software/qm/pull/2613
Upgrade Node to 24.22.1 for CVE-2026-111497 (Broccoli2Shell) by @ReganBell in https://github.com/yc-software/qm/pull/2631
Give Arga Slack twins five minutes to become ready by @ReganBell in https://github.com/yc-software/qm/pull/2632
Remove web UI comments and ignore EPIPE on dev script stdin by @16francej in https://github.com/yc-software/qm/pull/2633
Test schema lock waits against index builds and wait for the webhook worklog message by @16francej in https://github.com/yc-software/qm/pull/2634
Desk: keep background input alive during user activity by @ReganBell in https://github.com/yc-software/qm/pull/2644
Release QM desktop 0.1.5 by @ReganBell in https://github.com/yc-software/qm/pull/2655
Reserve subagents for parallel work by @ReganBell in https://github.com/yc-software/qm/pull/2658
Resolve Slack approval cards immediately and show tool calls readably by @ReganBell in https://github.com/yc-software/qm/pull/2640
Let swarm workers with an open goal keep working by @16francej in https://github.com/yc-software/qm/pull/2646
Add an Arbitrary limits lens to the Wall of shame by @ReganBell in https://github.com/yc-software/qm/pull/2665
Remove six config switches every deployment already sets the same way by @ReganBell in https://github.com/yc-software/qm/pull/2500
Halve native tool descriptions by @ReganBell in https://github.com/yc-software/qm/pull/2509
Verify the Postgres server certificate when a CA is configured by @16francej in https://github.com/yc-software/qm/pull/2635
web-ui: keep cached runtime settings when a wake-up revalidation fails by @16francej in https://github.com/yc-software/qm/pull/2683
Discard a pooled connection when ROLLBACK fails by @16francej in https://github.com/yc-software/qm/pull/2636
Keep an app stopped when a request waits on its archive or reap by @16francej in https://github.com/yc-software/qm/pull/2637
Add GPT-6.1 Terra to the model registry by @ReganBell in https://github.com/yc-software/qm/pull/2684
Resume triggered turns in Slack threads with the thread's recorded Slack source by @ReganBell in https://github.com/yc-software/qm/pull/2685
Trim template whitespace from Slack message bubbles in the web UI by @ReganBell in https://github.com/yc-software/qm/pull/2686
Run private credentials in shared conversations on the turn's scratch computer by @ReganBell in https://github.com/yc-software/qm/pull/2623
Load each memory notebook once per turn; stop hashing every fact on recall by @ReganBell in https://github.com/yc-software/qm/pull/2691
Route sandbox model calls through the company gateway (generalised) by @ReganBell in https://github.com/yc-software/qm/pull/2688
Update production dependencies in the workspace packages by @16francej in https://github.com/yc-software/qm/pull/2638
Default OpenAI-only deployments to GPT-6.1 Sol by @16francej in https://github.com/yc-software/qm/pull/2699
Let a turn carry its surface as attributed reference data by @pcapriolo-yc in https://github.com/yc-software/qm/pull/2598
Forward clientTools and surfaceBriefing from the web chat proxy to core by @pcapriolo-yc in https://github.com/yc-software/qm/pull/2601
Trace web session switches from click to paint by @ReganBell in https://github.com/yc-software/qm/pull/2270
Hold a paused swarm worker's goal turn by @16francej in https://github.com/yc-software/qm/pull/2701
Stop drawing the agent's own Slack messages as user bubbles in the web UI by @ReganBell in https://github.com/yc-software/qm/pull/2702
Load MCP tools on demand through tool_search and mcp_call by @ReganBell in https://github.com/yc-software/qm/pull/2697
Mount revisited sessions from a client transcript cache by @ReganBell in https://github.com/yc-software/qm/pull/2272
Move per-turn environment inventories into the system block by @ReganBell in https://github.com/yc-software/qm/pull/2698
Desktop: Cmd+N opens a new session by @ReganBell in https://github.com/yc-software/qm/pull/2711
Keep catalog connector tools direct, list deferred tools by server and tool by @ReganBell in https://github.com/yc-software/qm/pull/2710
Add Render as a hosting target by @anurag in https://github.com/yc-software/qm/pull/2704
web-ui: show one step at a time while a turn runs by @ReganBell in https://github.com/yc-software/qm/pull/2718
web-ui: give a steer the sticky prompt treatment by @ReganBell in https://github.com/yc-software/qm/pull/2731
Revert "web-ui: show one step at a time while a turn runs" (#2718) by @ReganBell in https://github.com/yc-software/qm/pull/2739
Replace hand-rolled turn and step timing with Sentry spans by @ReganBell in https://github.com/yc-software/qm/pull/2733
Reuse verified document bytes across turns; skip per-step payload serialization under budget by @ReganBell in https://github.com/yc-software/qm/pull/2732
Cut per-tool-step database round trips by @ReganBell in https://github.com/yc-software/qm/pull/2738
web-ui: show one step at a time while a turn runs (re-land #2718 with fixes) by @ReganBell in https://github.com/yc-software/qm/pull/2740
execute: ask for an -ing verb in the purpose label by @ReganBell in https://github.com/yc-software/qm/pull/2743
Add passage-anchored side chats by @ReganBell in https://github.com/yc-software/qm/pull/2730
Cut per-turn setup reads before the first model request by @ReganBell in https://github.com/yc-software/qm/pull/2735
web-ui: only animate the live work-head step by @ReganBell in https://github.com/yc-software/qm/pull/2749
Show centiseconds in chat work timers by @evebouf in https://github.com/yc-software/qm/pull/2742
Keep the turn's swarm binding when a worker starts its computer mid-turn by @16francej in https://github.com/yc-software/qm/pull/2690
Desktop: back/forward buttons, real history entries, drop Home by @ReganBell in https://github.com/yc-software/qm/pull/2755
Rebuild saved spend days with cron ids by @ebakan in https://github.com/yc-software/qm/pull/2424
Record each turn-detection call's usage in the session's spend ledger by @ebakan in https://github.com/yc-software/qm/pull/2436
Desktop: keep pane strip controls out of the Mac window drag region by @16francej in https://github.com/yc-software/qm/pull/2758
README: link hosted-interest form for larger companies by @16francej in https://github.com/yc-software/qm/pull/2750
Polish split-view tabs, controls, and drag previews by @evebouf in https://github.com/yc-software/qm/pull/2759
Show whole seconds in chat work timers by @16francej in https://github.com/yc-software/qm/pull/2762
Price OpenAI calls at the tier the response says served them by @ebakan in https://github.com/yc-software/qm/pull/2431
Let published apps use their publisher's connected apps through the broker by @16francej in https://github.com/yc-software/qm/pull/2565
Mint the broker signing key in qm init by @anurag in https://github.com/yc-software/qm/pull/2707
Get main green: one-shot usage tier arg and @hono/node-server bump by @16francej in https://github.com/yc-software/qm/pull/2765
Let app owners share without notifying the grantee by @16francej in https://github.com/yc-software/qm/pull/2771
Reject subagent model overrides the deployment can't serve by @16francej in https://github.com/yc-software/qm/pull/2777
Keep slow web attachment uploads alive and hold sends whose files failed by @16francej in https://github.com/yc-software/qm/pull/2774
Keep scheduled runs going on the default model when theirs can't run, and say when a run stops by @16francej in https://github.com/yc-software/qm/pull/2778
Keep unattended cron grants with the owner's home, and let the owner choose the audience by @16francej in https://github.com/yc-software/qm/pull/2764
Tell agents which computers sit behind the egress proxy by @16francej in https://github.com/yc-software/qm/pull/2779
Load saved custom providers when the admin onboarding page opens by @16francej in https://github.com/yc-software/qm/pull/2775
Fail Slack posts the recipient can never accept instead of retrying forever by @16francej in https://github.com/yc-software/qm/pull/2781
Store the session roster under its own key so older releases can still read history by @16francej in https://github.com/yc-software/qm/pull/2783
Make side chats responsive and carry exchanges into parent context by @ReganBell in https://github.com/yc-software/qm/pull/2784
One agent: remove the Claude harness and the harness concept; serve Claude subscriptions through Pi by @ReganBell in https://github.com/yc-software/qm/pull/2768
Delete dead ring-0 code and collapse no-behaviour duplicates by @ReganBell in https://github.com/yc-software/qm/pull/2787
Migrate saved model picks after harness removal by @ReganBell in https://github.com/yc-software/qm/pull/2796
Move provider settings and trigger, loop and surface-context types out of ring 0 by @ReganBell in https://github.com/yc-software/qm/pull/2792
Agent loop: one re-prompt, one recovery path, one payload shape walker; model transport into src/model by @ReganBell in https://github.com/yc-software/qm/pull/2793
Merge send_message and followup_task into one send_message that wakes by default by @16francej in https://github.com/yc-software/qm/pull/2789
Make multiview drop previews cheap to draw by @16francej in https://github.com/yc-software/qm/pull/2790
Split the model registry, collapse scope-membership and credential duplicates, one bounded body reader by @ReganBell in https://github.com/yc-software/qm/pull/2798
Simplify ring-0 persistence, util and ACL helpers by @ReganBell in https://github.com/yc-software/qm/pull/2799
Split agent tools into one module per tool family by @ReganBell in https://github.com/yc-software/qm/pull/2795
Consolidate the orchestrator's approval, screening and inbound-ingest code, and move off-path modules out of core by @ReganBell in https://github.com/yc-software/qm/pull/2794
One handle pool and one release routine for a turn's sandboxes by @ReganBell in https://github.com/yc-software/qm/pull/2791
Squash session and run store migrations into one base schema by @ReganBell in https://github.com/yc-software/qm/pull/2809
Bind ChatGPT device logins to the principal that started them by @ReganBell in https://github.com/yc-software/qm/pull/2800
Refuse private network addresses for MCP and OAuth endpoints by @ReganBell in https://github.com/yc-software/qm/pull/2801
Pin cross-user run and swarm isolation through the web proxy by @ReganBell in https://github.com/yc-software/qm/pull/2803
Require scope membership for source-authenticated SOUL reads by @ReganBell in https://github.com/yc-software/qm/pull/2811
Drop the connector dry-run that validated another scope's client by @ReganBell in https://github.com/yc-software/qm/pull/2813
Remove the unscoped surface read_file action and agent-supplied follow-up attachments by @ReganBell in https://github.com/yc-software/qm/pull/2812
Make connector token refresh atomic across processes by @ReganBell in https://github.com/yc-software/qm/pull/2804
Make Postgres the only store: delete in-memory store twins by @ReganBell in https://github.com/yc-software/qm/pull/2769
Clear new glob, minimatch and follow-redirects advisories by @16francej in https://github.com/yc-software/qm/pull/2827
Make provider memory recall safe: quoted recall, attested actor, recorded outcomes by @garrytan in https://github.com/yc-software/qm/pull/2837
web-ui: Slack avatars on messages and in the chat header by @evebouf in https://github.com/yc-software/qm/pull/2828
Remove hover tooltip on conversation pane by @evebouf in https://github.com/yc-software/qm/pull/2841
Fold the admin dashboard into web UI settings by @ReganBell in https://github.com/yc-software/qm/pull/2766
Save refreshed logins whenever their owner runs the command by @16francej in https://github.com/yc-software/qm/pull/2788
Shimmer the live work step label while it runs by @evebouf in https://github.com/yc-software/qm/pull/2846
Give the local provider qualification its own Postgres by @ReganBell in https://github.com/yc-software/qm/pull/2831
web-ui: use cog icon for background jobs in composer strip by @evebouf in https://github.com/yc-software/qm/pull/2849
Shrink the group DM icon in sidebar headers by @evebouf in https://github.com/yc-software/qm/pull/2854
web-ui: remove focus ring on queued message edit box by @evebouf in https://github.com/yc-software/qm/pull/2853
Show more for long projects in the sidebar by @evebouf in https://github.com/yc-software/qm/pull/2858
web-ui: round the corners of the conversation drag preview by @evebouf in https://github.com/yc-software/qm/pull/2866
web-ui: match header link/archive buttons to workspace tools by @evebouf in https://github.com/yc-software/qm/pull/2859
Restore self-API discovery in the core prompt by @garrytan in https://github.com/yc-software/qm/pull/2871
web-ui: fit tab titles in the split strip by @evebouf in https://github.com/yc-software/qm/pull/2865
Cap the split-pane composer to the conversation column on wide panes by @evebouf in https://github.com/yc-software/qm/pull/2864
web-ui: grey selected tab, no fill on others by @evebouf in https://github.com/yc-software/qm/pull/2863
Darken the sidebar border on resize hover instead of an accent bar by @evebouf in https://github.com/yc-software/qm/pull/2860
web-ui: render drafts as a copyable card by @evebouf in https://github.com/yc-software/qm/pull/2857
web-ui: GitHub mark before pull request links by @evebouf in https://github.com/yc-software/qm/pull/2856
web-ui: don't bold unread conversations; give the dot breathing room by @evebouf in https://github.com/yc-software/qm/pull/2852
web-ui: list/grid toggle with image thumbnails on Files page by @evebouf in https://github.com/yc-software/qm/pull/2847
Show Slack speaker photos in conversations outside projects by @evebouf in https://github.com/yc-software/qm/pull/2776
web-ui: float a jump-to-bottom arrow above the composer by @evebouf in https://github.com/yc-software/qm/pull/2867
web-ui: keep mid-turn assistant text outside the work fold by @ReganBell in https://github.com/yc-software/qm/pull/2874
Let /v1/reach edit a message in place by @ReganBell in https://github.com/yc-software/qm/pull/2880
Delete the admin runs listing by @ReganBell in https://github.com/yc-software/qm/pull/2881
web-ui: roll the step icon when the live step changes by @ReganBell in https://github.com/yc-software/qm/pull/2752
Let the test runner drop scratch databases for Postgres migration tests by @ReganBell in https://github.com/yc-software/qm/pull/2884
Search only your own chats, backed by a chat-message-only index by @ReganBell in https://github.com/yc-software/qm/pull/2876
Clarify forwarded credential approvals and handle missing-source clicks by @jetzhou in https://github.com/yc-software/qm/pull/2873
Start Render sandboxes from a snapshot of the QM sandbox base image by @anurag in https://github.com/yc-software/qm/pull/2833
web-ui: keep the live timer width steady as seconds tick by @ReganBell in https://github.com/yc-software/qm/pull/2901
pg-pool: run the per-query statement timeout in one round trip with pg pipeline mode by @ReganBell in https://github.com/yc-software/qm/pull/2888
Walk session descendants with per-parent index probes by @ReganBell in https://github.com/yc-software/qm/pull/2895
Mark spend days dirty with per-session index probes by @ReganBell in https://github.com/yc-software/qm/pull/2896
Keep held swarm notifications out of the outbox sweep by @ReganBell in https://github.com/yc-software/qm/pull/2894
Let scheduled jobs keep the credential handles their commands need by @16francej in https://github.com/yc-software/qm/pull/2909
Time subagent rows from the current run and show its latest purpose by @ReganBell in https://github.com/yc-software/qm/pull/2900
pg-pool: roll back aborted timeout writes and close aborted sockets by @ReganBell in https://github.com/yc-software/qm/pull/2911
Tell the model gateway which work each call serves by @ebakan in https://github.com/yc-software/qm/pull/2404
Hard-code per-process Postgres pool sizes by @ReganBell in https://github.com/yc-software/qm/pull/2921
Drive participant scope summaries and unscoped session pages from participant rows by @ReganBell in https://github.com/yc-software/qm/pull/2920
Default core's ECS stopTimeout to the shutdown drain plus 30 s by @ReganBell in https://github.com/yc-software/qm/pull/2883
web-ui: show one Stopping… state from Stop until the turn ends by @ReganBell in https://github.com/yc-software/qm/pull/2910
Honour Stop in every tool, not just the ones that take the abort signal by @ReganBell in https://github.com/yc-software/qm/pull/2889
Wake waiting tools when a steer arrives by @ReganBell in https://github.com/yc-software/qm/pull/2898
Show each person what their QM work costs in the web UI by @ebakan in https://github.com/yc-software/qm/pull/2594
Keep signed-in users on their last known identity when core is slow by @ReganBell in https://github.com/yc-software/qm/pull/2915
Refetch an open chat's subagent tree only for events in that tree by @ReganBell in https://github.com/yc-software/qm/pull/2904
Delete the one-time Inbox migration and the legacy single Inbox loop by @ReganBell in https://github.com/yc-software/qm/pull/2925
Find working subagent ancestors in one query by @ReganBell in https://github.com/yc-software/qm/pull/2916
Wait for the test database reply itself, not any wake-up by @ReganBell in https://github.com/yc-software/qm/pull/2934
Release the steering test's first step when the agent takes the steer by @ReganBell in https://github.com/yc-software/qm/pull/2933
Hand back shutdown turns that ignore cancellation instead of waiting for lease expiry by @ReganBell in https://github.com/yc-software/qm/pull/2882
Announce standing-guidance changes to other open sessions by @ReganBell in https://github.com/yc-software/qm/pull/2951
Tenants table and one-round-trip tenant binding by @ReganBell in https://github.com/yc-software/qm/pull/2843
Delete the per-principal rate limiter by @ReganBell in https://github.com/yc-software/qm/pull/2948
Delete reach computers by @ReganBell in https://github.com/yc-software/qm/pull/2946
Don't re-run a tool call whose interruption is already recorded by @ReganBell in https://github.com/yc-software/qm/pull/2922
AGENTS.md: triage Wall of shame lenses with the latest Haiku by @ReganBell in https://github.com/yc-software/qm/pull/2955
Run every turn's tail the same way: drop the background turn flag by @ReganBell in https://github.com/yc-software/qm/pull/2914
Delete the Inbox old-data fallbacks and write the sync prompt per source by @ReganBell in https://github.com/yc-software/qm/pull/2957
pg-pool: cancel aborted queries, keep connections after caught errors, pipeline every pool by @ReganBell in https://github.com/yc-software/qm/pull/2931
Store whole Slack messages in the mirror and flatten attachment and block content by @ReganBell in https://github.com/yc-software/qm/pull/2786
Label activity rows with gerunds, matching purpose labels by @ReganBell in https://github.com/yc-software/qm/pull/2947
Show a subagent as working only while its own run is active by @ReganBell in https://github.com/yc-software/qm/pull/2932
ring0 smell 3: no silent drops in mid-turn wake routing by @ReganBell in https://github.com/yc-software/qm/pull/2905
Check conversation write access in one place by @ReganBell in https://github.com/yc-software/qm/pull/2965
Drop session leases; the run claim is the only turn lock by @ReganBell in https://github.com/yc-software/qm/pull/2960
Let an org admin offboard a person in one call by @16francej in https://github.com/yc-software/qm/pull/2808
Let admins cap model spend per person and per scope by @16francej in https://github.com/yc-software/qm/pull/2886
Return items from the session store by @ReganBell in https://github.com/yc-software/qm/pull/2964
Read items directly in core and agent paths by @ReganBell in https://github.com/yc-software/qm/pull/2970
Use items on the HTTP wire, web UI and memory; delete SessionEntry by @ReganBell in https://github.com/yc-software/qm/pull/2971
Look up single deployments by id or name instead of loading every deployment by @ReganBell in https://github.com/yc-software/qm/pull/2912
Reconcile only cron slots due within the repair window by @ReganBell in https://github.com/yc-software/qm/pull/2892
Remove workspace layer materialization by @ReganBell in https://github.com/yc-software/qm/pull/2963
Claim runs with one loop per process by @ReganBell in https://github.com/yc-software/qm/pull/2928
runs: wake run waiters from the queue notification instead of polling by @ReganBell in https://github.com/yc-software/qm/pull/2919
web-ui: anchor the pinned prompt's hover footer under its bubble by @ReganBell in https://github.com/yc-software/qm/pull/2975
Read ACL grants with scoped, indexed queries instead of a cached whole table by @ReganBell in https://github.com/yc-software/qm/pull/2944
Record a withheld mid-turn message in the session transcript by @ReganBell in https://github.com/yc-software/qm/pull/2973
Declare the per-session spend lookup index in the session schema by @ReganBell in https://github.com/yc-software/qm/pull/2977
Drop the unused rate_limit_windows table by @ReganBell in https://github.com/yc-software/qm/pull/2962
Reconcile an interrupted turn in one pass by @ReganBell in https://github.com/yc-software/qm/pull/2972
Run every turn through the queue workers instead of inline by @ReganBell in https://github.com/yc-software/qm/pull/2918
sessions: keep Slack binding, model label and origin on the conversation by @ReganBell in https://github.com/yc-software/qm/pull/2976
Retract and rewrite replies that fail a turn_end reply check by @ReganBell in https://github.com/yc-software/qm/pull/2745
Fix main's typecheck: read a failed turn's run through RunStore.list by @ReganBell in https://github.com/yc-software/qm/pull/2980
Park a background turn between steps when a person is waiting in its conversation by @ReganBell in https://github.com/yc-software/qm/pull/2929
Run mid-turn messages through the turn's intake by @ReganBell in https://github.com/yc-software/qm/pull/2906
Route every incoming message through one router by @ReganBell in https://github.com/yc-software/qm/pull/2907
WS8: Surface contract and registry with Slack adapter; neutral turn origin and destination account; capability-driven orchestrator; surface-keyed mirror by @ReganBell in https://github.com/yc-software/qm/pull/2845
Say "this scope's Files" in the skill registry docs by @garrytan in https://github.com/yc-software/qm/pull/2879
Frame every request body the portal relays, so DELETE bodies arrive by @garrytan in https://github.com/yc-software/qm/pull/2968
Lock the skill name while saving or promoting a skill by @garrytan in https://github.com/yc-software/qm/pull/2940
Add the gbrain memory recipe and meet gbrain's QM provider contract by @garrytan in https://github.com/yc-software/qm/pull/2838
Resolve every model call through one session, utility or fallback route by @16francej in https://github.com/yc-software/qm/pull/2825
desktop: drag the window by pane strips only in single-pane mode by @16francej in https://github.com/yc-software/qm/pull/2982
Start the queue workers in harnesses that run synchronous turns by @ReganBell in https://github.com/yc-software/qm/pull/2984
Let the agent save and edit skills through its skills tool by @garrytan in https://github.com/yc-software/qm/pull/2899
web-ui: Slack avatars on group DM sidebar sections by @evebouf in https://github.com/yc-software/qm/pull/2848
Let a cron's script handle routine fires and escalate the rest to the agent by @ReganBell in https://github.com/yc-software/qm/pull/2974
web-ui: put Projects and Apps at the top level of the sidebar by @ReganBell in https://github.com/yc-software/qm/pull/2990
web-ui: emoji project icons with a Notion-style picker by @ReganBell in https://github.com/yc-software/qm/pull/2989
Keep recurring reports posting on quiet scheduled fires by @ReganBell in https://github.com/yc-software/qm/pull/2985
Skip runs jsonb cannot read in the session facts copy by @ReganBell in https://github.com/yc-software/qm/pull/2997
Remove the subagent tree run cap by @ReganBell in https://github.com/yc-software/qm/pull/3002
Bound the local provider qualification probe to eight minutes by @ReganBell in https://github.com/yc-software/qm/pull/3000
Gmail drafting notes for the app connector skill by @16francej in https://github.com/yc-software/qm/pull/3004
Let mid-turn model switches use gateway-served providers by @16francej in https://github.com/yc-software/qm/pull/2897
Run CI in the merge queue and reuse its run on main by @ReganBell in https://github.com/yc-software/qm/pull/3003
Deliver bound conversation updates through durable signed webhooks by @duhaime in https://github.com/yc-software/qm/pull/2717
Boot QM through one startQm function shared by core and its live harnesses by @ReganBell in https://github.com/yc-software/qm/pull/3009
web-ui: keep hover action room on unread sidebar rows by @16francej in https://github.com/yc-software/qm/pull/3006
AGENTS.md: drop the separate fresh-context adversarial review rule by @ReganBell in https://github.com/yc-software/qm/pull/3015
Add a partner-chat surface adapter by @ReganBell in https://github.com/yc-software/qm/pull/2887
send/github-gitlab skills: defer to the repo's required reviews by @ReganBell in https://github.com/yc-software/qm/pull/3018
Docs: call session history the item log, not the tape by @ReganBell in https://github.com/yc-software/qm/pull/3020
Read the email voice profile from Files and scan the Inbox from the last successful pass by @ReganBell in https://github.com/yc-software/qm/pull/3013
Make scratch an ephemeral pooled handle: one open path, one release path by @ReganBell in https://github.com/yc-software/qm/pull/3026
Search: open a chat hit at the matched message by @ReganBell in https://github.com/yc-software/qm/pull/3023
Retire the turn-origin takeover rewrite and the retired-field guards by @ReganBell in https://github.com/yc-software/qm/pull/3024
Check a turn's model choice in one function by @ReganBell in https://github.com/yc-software/qm/pull/3027
Make conversation participation membership-only: late joiners see full history by @ReganBell in https://github.com/yc-software/qm/pull/3031
Write shared org state only from a core that runs background work by @ReganBell in https://github.com/yc-software/qm/pull/3019
Delete the browse-model and unfulfilled-insights settings, which nothing reads by @ReganBell in https://github.com/yc-software/qm/pull/3035
Squash the directory store migrations into one base schema by @ReganBell in https://github.com/yc-software/qm/pull/3036
Remove dead turn-path hooks by @ReganBell in https://github.com/yc-software/qm/pull/3038
Drop the retired key-value tables in one migration, adding nine unused ones by @ReganBell in https://github.com/yc-software/qm/pull/3037
Delete the session store's unscoped scanAll, which only tests called by @ReganBell in https://github.com/yc-software/qm/pull/3041
Minimal multitenancy: tenant_id + RLS, host routing, per-tenant background work and caches by @ReganBell in https://github.com/yc-software/qm/pull/2994
Remove dead and duplicated turn sandbox plumbing by @ReganBell in https://github.com/yc-software/qm/pull/3044
App shell: animate the bar away on dismiss; keep the docked chat on the desktop layout by @ReganBell in https://github.com/yc-software/qm/pull/3030
Default subagent runtime to the parent's chosen runtime by @ReganBell in https://github.com/yc-software/qm/pull/3011
Move session spend rollups out of the session store factory into their own module by @ReganBell in https://github.com/yc-software/qm/pull/3042
Call the org scope getter in the subagent default-model resolver (fixes main typecheck) by @ReganBell in https://github.com/yc-software/qm/pull/3047
Delete agent tool actions with no production use by @ReganBell in https://github.com/yc-software/qm/pull/3043
Move admin-only session reads out of the session store factory into their own module by @ReganBell in https://github.com/yc-software/qm/pull/3048
Delete dead pi hook typings and test-only turn helpers by @ReganBell in https://github.com/yc-software/qm/pull/3045
Move session participant reads and writes out of the session store factory into their own module by @ReganBell in https://github.com/yc-software/qm/pull/3050
Make new panes open faster while other panes stream by @16francej in https://github.com/yc-software/qm/pull/3010
Move the session item log out of the session store factory into its own module by @ReganBell in https://github.com/yc-software/qm/pull/3052
Subagents in ring 0: delegation contract, scoped interrupts, child wakes its top-level parent by @ReganBell in https://github.com/yc-software/qm/pull/3001
Stop each test's app when that test ends instead of at the end of the file by @ReganBell in https://github.com/yc-software/qm/pull/3049
Count CLI manifest services from the list the release resolves by @16francej in https://github.com/yc-software/qm/pull/3051
Move LLM request capture out of the session store factory into its own module by @ReganBell in https://github.com/yc-software/qm/pull/3054
Move session search out of the session store factory into its own module by @ReganBell in https://github.com/yc-software/qm/pull/3055
Make the deploy drain the only gate for background work by @ReganBell in https://github.com/yc-software/qm/pull/2978
Force every proxy-capable sandbox provider through one egress proxy setting by @16francej in https://github.com/yc-software/qm/pull/2782
Use the home backup bucket instead of checkpoints for Managed Agents computers by @16francej in https://github.com/yc-software/qm/pull/3053
Report stopped and errored subagents to the parent with their partial output by @ReganBell in https://github.com/yc-software/qm/pull/3014
Move the directory's Slack sync writers out of the directory store factory by @ReganBell in https://github.com/yc-software/qm/pull/3056
Use the shared likeContains helper for session title search by @ReganBell in https://github.com/yc-software/qm/pull/3057
Drain web-ui, portal and auth on SIGTERM instead of waiting for SIGKILL by @ReganBell in https://github.com/yc-software/qm/pull/3046
Set the shared egress proxy in the per-tenant sandbox test fixture by @ReganBell in https://github.com/yc-software/qm/pull/3058
Wake subagent parents when their children finish; report in_progress while descendants still run by @ReganBell in https://github.com/yc-software/qm/pull/3016
Let AWS image builds reuse a registry build cache by @ReganBell in https://github.com/yc-software/qm/pull/2986
Return from inactive AWS deploys once only new tasks can serve by @ReganBell in https://github.com/yc-software/qm/pull/3028
Stop web UI tests closing Vite mid dependency scan, and bound every CI/CD job by @ReganBell in https://github.com/yc-software/qm/pull/3059
Let a conversation's Stop spare its subagents, with an explicit stop-everything by @ReganBell in https://github.com/yc-software/qm/pull/3017
Give subagents their own directory or sandbox on request by @ReganBell in https://github.com/yc-software/qm/pull/3022
Run setup-terraform on Node 24 instead of the deprecated Node 20 build by @ReganBell in https://github.com/yc-software/qm/pull/3060
Report subagent liveness from the latest tool step and re-show live children after compaction by @ReganBell in https://github.com/yc-software/qm/pull/3021

New Contributors

@jetzhou made their first contribution in https://github.com/yc-software/qm/pull/2530
@duhaime made their first contribution in https://github.com/yc-software/qm/pull/2717

Full Changelog: https://github.com/yc-software/qm/compare/v0.1.15...v0.1.16