Avibe

Highlights

• Avibe Vaults is now a real secret-management layer for agents. You can store local encrypted secrets, create protected passkey-backed secrets and signing keys, approve agent access from the Workbench, and keep the model handling secret names instead of raw values, reducing leaks into stdout, transcripts, or IM history.
• The Workbench now feels much closer to an Agent OS desktop. You can use windowed Files, Editor, Terminal, and Preview apps with a Dock, Monaco editing, file search, upload, drag-move, context menus, rich previews, terminal search, and “Open Terminal Here”.
• Running agent work is easier to inspect and stop. The new Running agents view shows live Claude/Codex/OpenCode instances with Open Chat and End controls, while agent-initiated background turns now deliver output and can be stopped instead of wedging sessions.
• This upgrade hardens day-to-day reliability. Error boundaries prevent one UI crash from white-screening the Workbench, remote access and install pairing paths are clearer, IM integrations have safer defaults, and UI/API hot paths are faster.

Changes

Added

• Added local encrypted Vaults with the managed avault installer and standard-tier secret custody (#631, #660, #663, #686).
• Added protected-tier Vaults with browser-side sealing, passkey-backed unlock, protected approvals, resident-agent delivery, and protocol v2 contexts (#673, #677, #694, #699, #711, #712, #827, #849, #850).
• Added Vault request and approval flows for agents, including request specs, chat timeline cards, floating approval bars, IM fallback links, and auto-resume after approval (#702, #748, #783, #784, #785, #786).
• Added Vault signing-key support, public signing metadata, address-based signing keys, headless standard-tier signing, and always-ask signing controls (#701, #768, #807, #809).
• Added Vault management UI for grouped lists, active grants with countdown and revoke, metadata editing, tag/skill-tag delivery, and safer delete confirmations (#678, #685, #806, #810, #814, #753, #755).
• Added the Workbench Apps layer with Files, Editor, Terminal, Preview, windowing, Dock, persisted layouts, Monaco editing, recent files/folders, and mobile editor entry (#659, #679, #691, #705, #737, #799, #800, #836).
• Added richer Files and Preview workflows: upload, recursive name search, right-click actions, drag-to-move, unified previews for images/SVG/HTML/PDF/Office/Markdown/JSON/CSV/code, delete staging, and undo (#801, #808, #728, #734, #737, #839, #843).
• Added Editor and Terminal productivity features including cross-file search/replace, save-conflict resolution, terminal scrollback search, clickable links, and “Open Terminal Here” (#713, #837, #838, #840).
• Added the Workbench Running agents tab with live snapshots, Open Chat, and unified End controls across Claude, Codex, and OpenCode (#649).
• Added a best-effort Linux/cgroup v2 resource-governance MVP for aggregate agent backend work (#742).
• Added per-platform group defaults for Require @mention and Bound only, plus improved Feishu/Lark group controls and status behavior (#741, #788, #793, #794).

Changed

• Changed protected Vault setup toward passkey-only protected vaults and refreshed Vault tier naming/copy for clearer Standard vs Protected language (#821, #822, #812).
• Changed Vault grants and delivery around grant IDs, tags, skill tags, and unified run delivery (#752, #753, #756).
• Changed first-party CLI and Harness commands to inherit caller session/run/cwd context when safe, while keeping explicit targets authoritative (#676, #695, #696, #717).
• Changed vibe agent run scope semantics so private/background sessions are the default and existing-session sends are explicit (#717).
• Changed Workbench rendering and data flow to use SSE-driven updates, gzip/static caching, memoized context values, bounded transcript retention, faster storage paths, and faster inbox/session queries (#765, #762, #757, #778, #775, #773, #761).
• Changed Slack/Discord progress display to default to Off unless explicitly configured (#743).
• Changed session title guidance to be shorter and more actionable, and materialized effective model/effort on first-turn bind so session headers keep showing the actual route (#744, #747, #745).
• Changed model handling with a searchable route-picker model column, refreshed Claude Sonnet 5 catalog data, and centralized backend model catalogs (#652, #805, #856).

Fixed

• Fixed remote-access OAuth errors to explain stale pairing or clock-sync problems, and fixed one-step install from avibe.bot so pairing runs through the verified vibe binary and starts Avibe afterward (#657, #661).
• Fixed Running-tab End regressions that could cancel the wrong in-flight turn or wedge a private vibe agent run queue (#664, #665).
• Fixed agent-initiated Claude turns from background tasks or ScheduleWakeup so their output is delivered, registered in the turn FSM, and stoppable from the Workbench (#687, #689).
• Fixed CLI cancellation of live agent runs and refreshed Codex caller environment for reused shells (#754, #725).
• Fixed Agent Session workdir snapshots so existing sessions use their stored workdir and new scoped sessions snapshot the selected scope/default workdir (#740).
• Fixed chat UX issues with desktop pinch-zoom composer positioning, multi-line IME/dictation inserts, wide Markdown tables, code-block copy, image lightbox zoom/pan, and one-page-at-a-time history loading (#653, #675, #680, #681, #683, #684).
• Fixed Workbench crashes from taking down the whole app by adding React error boundaries around windows, panels, and routes (#719).
• Fixed Files/Editor edge cases including extensionless text files opening in the editor, hardened search parsing, hidden files shown by default in the explorer, and terminal PTY resizing to fill the window (#724, #858, #710).
• Fixed deleted/stale Discord, Slack, and Lark channels showing in Group Settings, and added manual review/remove flows (#726).
• Fixed IM output behavior by suppressing Discord URL auto-embeds, suppressing WeChat toolcall delivery, and making concise Slack/Discord status bubbles render tool steps correctly (#735, #746, #750).
• Fixed Vault keypair handling so signing keys are sign-only and cannot be fetched or delivered as ordinary secret values (#703, #704).
• Fixed Vault always-ask access grants so per-use approvals are enforced and consumed after delivery (#722).
• Fixed protected Vault approval, passkey, sandbox, and signing edge cases including PRF output stability, iOS passkey handling, sandbox visibility, single-ceremony approvals, canonical JSON signing, public-only sign payloads, and protected-record envelope alignment (#727, #797, #841, #855, #845, #851, #798, #790).
• Fixed Vault TTL/cache handling, mixed-case secret names, empty run selector errors, protected request hydration, and request/grant lifecycle invariants (#857, #772, #766, #708, #707).
• Fixed runtime maintenance issues by reaping orphaned runtime servers, pruning stale managed installs, bounding local logs/state backups, and making diagnostics faster by default (#815, #852, #854, #848).
• Fixed UI polish issues across sidebar layout, inbox hover popovers, Vault forms, terminal accessory keys, public proxy origins, instance naming, and browser tab titles (#729, #730, #723, #787, #796, #795, #834, #782).

Security

• Hardened remote access trust boundaries and bind-code authentication (#781, #780).
• Redacted OAuth diagnostics so token-endpoint rejection details and quoted code payloads are not exposed in logs or copyable support details (#658).
• Removed Vault plaintext create surfaces, rejected plaintext value payloads, and removed value-derived preview metadata from storage/API/UI (#736, #670).
• Closed a protected-delete HTTP authorization hole and refused CLI deletion of protected secrets to avoid bypassing the Web approval path (#824, #816).
• Routed protected Vault crypto through a sandbox iframe and added sandbox locale/theme support while iterating on integrity enforcement (#827, #846, #832).

Breaking

• Removed vibe vault set; Vault creation now requires browser-side sealing/blind boxes instead of plaintext secret values (#736).
• Replaced vibe vault request --skill with value-free JSON request specs via --spec / --spec-json (#748).
• Changed vibe agent run --session-id to mean “send to this existing Session”; agent/model/cwd/scope mutation flags are rejected on that path (#717).
• Removed the protected Vault password factor path in favor of passkey-only protected vault setup/unlock (#821, #822).

Full Changelog: https://github.com/avibe-bot/avibe/compare/v3.0.4...v3.0.5

亮点

• Avibe Vaults 现在是可用的本地机密管理层。 你可以把机密加密保存在本机，创建受 Passkey 保护的机密和签名密钥，在 Workbench 里审批 Agent 访问；模型只处理机密名，不接触原始值，减少泄露到 stdout、聊天记录或 IM 历史里的风险。
• Workbench 更像一个 Agent OS 桌面了。 Files、Editor、Terminal、Preview 都进入窗口化 Apps 体系，支持 Dock、Monaco 编辑、文件搜索、上传、拖拽移动、右键菜单、丰富预览、终端搜索和 “Open Terminal Here”。
• 正在运行的 Agent 更好看、也更好停。 Running 视图可以查看 Claude/Codex/OpenCode 的实时实例，并直接 Open Chat 或 End；后台任务和 ScheduleWakeup 触发的 Agent 输出也能正常送达并被停止。
• 日常使用更稳更快。 UI 渲染崩溃不会再让整个 Workbench 白屏，远程访问和安装配对错误更容易定位，IM 集成默认更安全，UI/API 热路径也做了性能优化。

变更

新增

• 新增本地加密 Vaults，以及托管 avault 安装器和标准档机密托管能力 (#631, #660, #663, #686)。
• 新增保护档 Vaults，包含浏览器侧封装、Passkey 解锁、保护档审批、resident agent 投递和 protocol v2 上下文 (#673, #677, #694, #699, #711, #712, #827, #849, #850)。
• 新增 Agent 的 Vault 请求与审批流程，包含 request spec、聊天时间线卡片、浮动审批栏、IM 降级链接和审批后自动恢复会话 (#702, #748, #783, #784, #785, #786)。
• 新增 Vault 签名密钥、公开签名元数据、地址型签名密钥、标准档无头签名和 always-ask 签名控制 (#701, #768, #807, #809)。
• 新增 Vault 管理界面的分组列表、实时授权倒计时与撤销、元数据编辑、tag/skill-tag 投递和更安全的删除确认 (#678, #685, #806, #810, #814, #753, #755)。
• 新增 Workbench Apps 层，包含 Files、Editor、Terminal、Preview、窗口管理、Dock、布局持久化、Monaco、最近文件/文件夹和移动端 Editor 入口 (#659, #679, #691, #705, #737, #799, #800, #836)。
• 新增 Files/Preview 工作流：上传、递归名称搜索、右键操作、拖拽移动、图片/SVG/HTML/PDF/Office/Markdown/JSON/CSV/代码统一预览、删除暂存和撤销 (#801, #808, #728, #734, #737, #839, #843)。
• 新增 Editor 和 Terminal 效率功能，包括跨文件搜索/替换、保存冲突处理、终端回滚搜索、可点击链接和 “Open Terminal Here” (#713, #837, #838, #840)。
• 新增 Workbench Running agents 页签，可查看 Claude、Codex、OpenCode 的实时状态，并支持 Open Chat 和统一 End (#649)。
• 新增 Linux/cgroup v2 下的 Agent 资源治理 MVP，在支持的运行环境里尽量约束后端 Agent 工作负载 (#742)。
• 新增各平台的群组默认设置，包括 Require @mention、Bound only，以及 Feishu/Lark 群组控制和状态展示改进 (#741, #788, #793, #794)。

调整

• 调整保护档 Vault 方向为 Passkey-only，并刷新 Vault 标准档/保护档命名和文案 (#821, #822, #812)。
• 调整 Vault 授权和投递模型，围绕 grant id、tag、skill tag 和统一 run 投递重构 (#752, #753, #756)。
• 调整一部分 CLI 与 Harness 命令，在安全时默认继承调用方的 session/run/cwd，上层显式参数仍然优先 (#676, #695, #696, #717)。
• 调整 vibe agent run 作用域语义，默认创建私有/后台 Session，向已有 Session 发送消息需要显式指定 (#717)。
• 调整 Workbench 渲染和数据流，使用 SSE 更新、gzip/静态缓存、Context memo、受限 transcript 保留窗口、更快的存储路径和 inbox/session 查询 (#765, #762, #757, #778, #775, #773, #761)。
• 调整 Slack/Discord 进度显示默认值，未配置或配置无效时默认关闭 (#743)。
• 调整 Web 会话标题提示，使其更短也更明确；首次 turn bind 时会落地实际使用的 model/effort，让会话头继续显示真实路由 (#744, #747, #745)。
• 调整模型相关体验，路由选择器的 Model 列可读可搜，刷新 Claude Sonnet 5 目录，并集中维护后端模型目录 (#652, #805, #856)。

修复

• 修复远程访问 OAuth 错误提示，能区分配对失效和时钟同步问题；修复 avibe.bot 一步安装配对后未正确启动的问题 (#657, #661)。
• 修复 Running 页签 End 可能取消错误 turn，或让私有 vibe agent run 队列卡住的问题 (#664, #665)。
• 修复 Claude 后台任务和 ScheduleWakeup 触发的 Agent 输出无法送达的问题，并把这类 turn 接入 FSM，使其可在 Workbench 停止 (#687, #689)。
• 修复 CLI 取消实时 Agent run，以及 Codex 复用 shell 时 caller 环境不刷新的问题 (#754, #725)。
• 修复 Agent Session workdir 快照逻辑，已有 Session 使用自身存储的 workdir，新建 scoped Session 会快照所选 scope 或默认 workdir (#740)。
• 修复聊天体验问题，包括桌面 pinch-zoom 下输入框位置、多行 IME/语音输入、宽 Markdown 表格、代码块复制、图片灯箱缩放/平移和历史记录一次加载多页 (#653, #675, #680, #681, #683, #684)。
• 修复 UI 渲染异常导致整个 Workbench 白屏的问题，为窗口、面板和路由增加 Error Boundary (#719)。
• 修复 Files/Editor 边界问题，包括无扩展名文本文件可编辑、搜索响应解析更稳、资源管理器默认显示隐藏文件，以及 Terminal PTY 缩放后填满窗口 (#724, #858, #710)。
• 修复 Discord、Slack、Lark 已删除或失效频道仍出现在 Group Settings 的问题，并加入手动查看/移除流程 (#726)。
• 修复 IM 输出行为，包括 Discord URL 自动展开、WeChat 工具调用外发，以及 Slack/Discord concise 状态气泡不显示工具步骤 (#735, #746, #750)。
• 修复 Vault keypair 处理，签名密钥只能用于签名，不能被当作普通机密 fetch 或投递 (#703, #704)。
• 修复 Vault always-ask 授权，逐次审批会被强制执行，并在成功投递后消费掉 (#722)。
• 修复保护档 Vault 的审批、Passkey、sandbox 和签名细节，包括 PRF 输出稳定性、iOS Passkey、sandbox 可见性、一次 ceremony 审批、规范 JSON 签名、签名 payload 只含公开数据，以及 protected record envelope 对齐 (#727, #797, #841, #855, #845, #851, #798, #790)。
• 修复 Vault TTL/cache、大小写机密名、空 run selector 报错、保护档请求 hydration，以及 request/grant 生命周期不一致的问题 (#857, #772, #766, #708, #707)。
• 修复运行时维护问题，包括回收孤儿 runtime server、清理过期托管安装、限制本地日志和状态备份大小，以及让诊断默认更快 (#815, #852, #854, #848)。
• 修复多处 UI 细节，包括侧边栏布局、Inbox 悬浮层、Vault 表单、Terminal 触控辅助键、公开代理 origin、实例名和浏览器标签标题 (#729, #730, #723, #787, #796, #795, #834, #782)。

安全

• 加固远程访问信任边界和 bind code 认证 (#781, #780)。
• 脱敏 OAuth 诊断信息，避免 token endpoint 拒绝详情和带引号的 code payload 出现在日志或可复制的支持信息里 (#658)。
• 移除 Vault 明文创建入口，拒绝 plaintext value payload，并从存储/API/UI 中移除由值派生的 preview 元数据 (#736, #670)。
• 修复保护档删除 HTTP 授权漏洞，并拒绝通过 CLI 删除保护档机密，避免绕过 Web 审批路径 (#824, #816)。
• 将保护档 Vault 加密流程路由到 sandbox iframe，并为 sandbox 增加 locale/theme 支持，同时迭代完整性校验开关 (#827, #846, #832)。

破坏性变更

• 移除 vibe vault set；Vault 创建现在必须使用浏览器侧 sealing/blind box，不再接收明文机密值 (#736)。
• 将 vibe vault request --skill 替换为通过 --spec / --spec-json 传入的无值 JSON request spec (#748)。
• vibe agent run --session-id 现在表示“发送到这个已有 Session”；该路径会拒绝 agent/model/cwd/scope 修改参数 (#717)。
• 移除保护档 Vault 的 password factor 路径，改为 Passkey-only 的保护档 setup/unlock (#821, #822)。

Full Changelog: https://github.com/avibe-bot/avibe/compare/v3.0.4...v3.0.5