archon

v0.4.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 6d AI Coding Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai automation bun claude cli coding-assistant

+4 more

developer-tools typescript workflow-engine yaml

Affected surfaces

auth

Summary

AI summary

GitHub App authentication replaces shared PAT and adds per‑user attribution.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Medium	Hardens Marketplace `decide` node against non‑JSON AI review output to prevent crashes. Hardens Marketplace `decide` node against non‑JSON AI review output to prevent crashes. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Security	Medium	Resolves forge clone authentication via configured `_URL` env vars and supports non‑GitHub forges with appropriate tokens. Resolves forge clone authentication via configured `_URL` env vars and supports non‑GitHub forges with appropriate tokens. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Security	Medium	Passes user‑controlled variables via env vars instead of shell substitution to avoid quoting and injection issues in Bash nodes. Passes user‑controlled variables via env vars instead of shell substitution to avoid quoting and injection issues in Bash nodes. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Feature
Feature	Low	Adds GitHub App authentication for the bot, replacing shared PAT with per‑installation tokens. Adds GitHub App authentication for the bot, replacing shared PAT with per‑installation tokens. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Adds per‑user attribution, plumbing user_id through adapters into conversations and environments. Adds per‑user attribution, plumbing user_id through adapters into conversations and environments. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Upgrades Slack UX with interactive buttons, status reactions, and native slash commands. Upgrades Slack UX with interactive buttons, status reactions, and native slash commands. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Introduces experimental run‑centric console UI at /console as an isolated in‑repo spike. Introduces experimental run‑centric console UI at /console as an isolated in‑repo spike. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Adds `assistants.opencode` community provider with embedded runtime and MCP tool execution. Adds `assistants.opencode` community provider with embedded runtime and MCP tool execution. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Adds GitHub Copilot community provider as a non‑built‑in entry in the registry. Adds GitHub Copilot community provider as a non‑built‑in entry in the registry. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Adds Codex MCP node support via `loadMcpConfig` with runtime translation of MCP config. Adds Codex MCP node support via `loadMcpConfig` with runtime translation of MCP config. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Adds `always_run` opt‑out for resume caching on workflow nodes. Adds `always_run` opt‑out for resume caching on workflow nodes. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Implements deferred extension model resolution for Pi workflows referencing future models. Implements deferred extension model resolution for Pi workflows referencing future models. Source: llm_adapter@2026-05-28 Confidence: high	—
Feature	Low	Enables resuming interactive workflows on Slack and Telegram chat platforms. Enables resuming interactive workflows on Slack and Telegram chat platforms. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Performance	Low	Writes large node outputs to temp files instead of inlining, preventing argument‑list corruption. Writes large node outputs to temp files instead of inlining, preventing argument‑list corruption. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fixes `workflow approve/resume/reject` failures with "Workflow not found" when working path is a worktree or clone. Fixes `workflow approve/resume/reject` failures with "Workflow not found" when working path is a worktree or clone. Source: llm_adapter@2026-05-28 Confidence: low	—
Bugfix	Medium	Surfaces `condition_json_parse_failed` as a workflow error instead of silently skipping the conditional branch. Surfaces `condition_json_parse_failed` as a workflow error instead of silently skipping the conditional branch. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Surfaces CLI resume command in Web approve/reject responses for direct copying. Surfaces CLI resume command in Web approve/reject responses for direct copying. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Ensures `DEFAULT_AI_ASSISTANT` env var controls default assistant for newly registered codebases. Ensures `DEFAULT_AI_ASSISTANT` env var controls default assistant for newly registered codebases. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Expands MCP config env vars to support brace syntax `${VAR}` in addition to `$VAR`. Expands MCP config env vars to support brace syntax `${VAR}` in addition to `$VAR`. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Persists read‑only node outputs via bash bridges for downstream reference in `archon-refactor-safely`. Persists read‑only node outputs via bash bridges for downstream reference in `archon-refactor-safely`. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Injects `$ARGUMENTS` into generated YAML so user arguments reach the first workflow node. Injects `$ARGUMENTS` into generated YAML so user arguments reach the first workflow node. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Removes stale `attemptController.abort()` in Codex provider and uses fresh `AbortController` per retry attempt. Removes stale `attemptController.abort()` in Codex provider and uses fresh `AbortController` per retry attempt. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Rejects directory paths in `claudeBinaryPath` and expands npm platform‑package directories for Claude provider binaries. Rejects directory paths in `claudeBinaryPath` and expands npm platform‑package directories for Claude provider binaries. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Consults config + per‑folder detection on every codebase registration for default assistant resolution. Consults config + per‑folder detection on every codebase registration for default assistant resolution. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Preserves completed node state across multiple resume cycles in DAG multi‑resume scenarios. Preserves completed node state across multiple resume cycles in DAG multi‑resume scenarios. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—
Bugfix	Low	Uses line‑anchored regex for `ARCHON_STATE_JSON` marker extraction to prevent false positives in script output. Uses line‑anchored regex for `ARCHON_STATE_JSON` marker extraction to prevent false positives in script output. Source: granite4.1:30b@2026-05-28-audit Confidence: low	—

Full changelog

GitHub App auth for the bot, multi-user attribution, Slack UX overhaul, experimental /console, two new community providers (OpenCode and GitHub Copilot), Codex MCP support, and broad workflow/provider hardening.

Added

GitHub App authentication for the bot: replaces the shared GITHUB_TOKEN PAT with a GitHub App + multi-installation routing. Each repo resolves to the installation that owns it; tokens are minted on demand, cached per installation, refreshed before expiry, and never persisted. Includes a loopback-only /internal/git-credential endpoint (with a hard 127.0.0.1 bind check, opt-out via ARCHON_ALLOW_INTERNAL_ON_PUBLIC_BIND=1) so long-running workflow git operations can transparently refresh installation tokens via a git-credential-archon helper installed into the worktree's .git/config (#1788).
Per-user attribution: user_id is now plumbed from chat and forge adapters through the orchestrator into conversations, messages, workflow_runs, and isolation_environments. New users and user_identities tables map platform identities (Slack U-id, Telegram chat id, Discord snowflake, GitHub login) to an Archon-internal user, created lazily on first sight (#1783).
Slack UX upgrade: interactive buttons, status reactions, and native slash commands replace the previous text-only flow. Approval gates, run status, and errors are now surfaced through Slack's UI primitives (#1757).
Experimental run-centric console UI at /console, mounted as an isolated in-repo spike under packages/web/src/experiments/console/. Lint-guarded against importing production web modules so it can be dropped in or deleted cleanly (#1747).
assistants.opencode provider: community provider that runs OpenCode as an embedded runtime, with per-node agent materialization, multi-agent sessions, structured output, token usage, and multi-agent MCP tool execution (#1384).
GitHub Copilot community provider: registered as a builtIn: false provider in the registry (#1505).
Codex MCP nodes: MCP server support for Codex workflow nodes via the shared loadMcpConfig module — pass mcp: <path> on a Codex node and the config is translated to Codex's mcp_servers overrides at runtime. MCP client errors are surfaced to the workflow author as system chunks when MCP is explicitly configured for the node (#1459).
always_run node opt-out for resume caching: opt-out for nodes that must re-execute on every resume rather than being skipped as "already completed" (closes #1391, #1730).
Pi deferred extension model resolution so Pi workflows can reference models that are only available after extension loading (#1509).
Brand foundation page at https://archon.diy/brand/, sourced from packages/docs-web/src/content/docs/brand/ (#1745).
New marketplace workflows: piv-system-evolution and archon-comprehensive-mr-review.

Changed

Streaming chat continuity: typing indicators and message boundaries are more readable; rapid successive chunks no longer fragment visually (#1617).
Web chat bubbles wrap long unbreakable strings instead of overflowing (fixes #1738, #1742).
Web DAG builder recognizes loop and approval node types and renders them correctly (#1744).
Web execution graph surfaces workflow-definition fetch errors instead of silently rendering an empty graph (#1683, #1698).
Web copy-message button handles clipboard failures gracefully (#1564).
Telegramify-markdown bumped to 1.3.3 for correct blockquote escaping (#1340).
Webhook clones are placed in the workspace source/ subdirectory to match the standard workspace layout (#1554).
Global workflows are now editable through the Web UI builder (#1557).
safeSendMessage consolidated into executor-shared to remove duplication across executor variants (#1496).
Direction docs: community-providers policy section added (#1736).

Fixed

workflow approve/resume/reject no longer fail with "Workflow not found" when the run's working path is a worktree or workspace clone. Resume, approve, and reject now use codebase.default_cwd for workflow YAML discovery, falling back to working_path when no codebase record is found. Fixes #1663 (#1743).
Resume interactive workflows on chat platforms: previously failed because the resume code path assumed web; now works for Slack and Telegram (#1756).
Web approve/reject responses surface the CLI resume command so users can copy it directly instead of having to look it up (#1523).
DEFAULT_AI_ASSISTANT is now read in createCodebase so the env var actually controls the default assistant for newly registered codebases (fixes #1703, #1746).
Marketplace decide node hardened against non-JSON ai-review output so a prose-prefixed verdict doesn't crash the workflow.
MCP config env vars now expand ${VAR_NAME} brace syntax in addition to $VAR_NAME (#1728).
archon-refactor-safely persists read-only node outputs via bash bridges so downstream nodes can reference them (#1734).
Workflow builder injects $ARGUMENTS into generated YAMLs so user arguments reach the first node (#1733).
Codex provider: removed stale attemptController.abort() that crashed after SDK cleanup (#1735, #1739); fresh AbortController per retry attempt so a previously-aborted controller can't kill the new attempt (#1266, #1371).
Claude provider rejects directory paths in claudeBinaryPath and expands npm platform-package directories (e.g. @anthropic-ai/claude-code-darwin-arm64) to the bundled binary (#1723, #1737).
Default assistant resolution: now consults config + per-folder detection on every codebase registration, not just the first (#1729).
Large node outputs are written to a temp file and referenced rather than inlined into bash substitution, preventing argument-list corruption on big payloads (fixes #1717, #1718).
Forge clone auth resolves credentials via configured *_URL env vars rather than assuming github.com (fixes #1704, #1706); non-GitHub forge URLs authenticate via GITLAB_TOKEN / GITEA_TOKEN (fixes #1655, #1658).
DAG multi-resume: completed node state is now preserved across multiple resume cycles instead of being recomputed (#1530).
Bash node variables: user-controlled variables are passed via env vars, not shell substitution, to avoid quoting bugs and injection edge cases (#1651).
Scripts: ARCHON_STATE_JSON marker extraction uses line-anchored regex so embedded marker-like strings in script output don't confuse the parser (#1695).
Workflows: condition_json_parse_failed is now surfaced as a workflow error instead of silently skipping the conditional branch (#1673, #1694).

Breaking Changes

Replaces shared `GITHUB_TOKEN` PAT with per‑installation GitHub App tokens; legacy token usage no longer works.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track archon

Get notified when new releases ship.

About archon

The first open-source harness builder for AI coding. Make AI coding deterministic and repeatable.

All releases →