This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Moderate signalGoogle Sign-In is now mandatory for all workspaces; unauthenticated access has been removed.
Why it matters: All users must authenticate via Google Sign‑In to access any workspace, eliminating anonymous entry points. This change applies immediately across the platform.
Summary
AI summaryBroad release touches Highlights, Backend changes, Routines stability, and App Store / distribution.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Google Sign-In becomes mandatory for all workspaces; unauthenticated access removed. Google Sign-In becomes mandatory for all workspaces; unauthenticated access removed. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Feature | Medium |
Direct APNs push notifications replace Firebase Messaging for iOS. Direct APNs push notifications replace Firebase Messaging for iOS. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Feature | Medium |
@‑mentions now route messages to humans' devices across platforms. @‑mentions now route messages to humans' devices across platforms. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Feature | Medium |
Server‑Sent Events replace 2 s polling for real‑time updates. Server‑Sent Events replace 2 s polling for real‑time updates. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Feature | Medium |
Workspace‑global markdown knowledge base enables agents and humans to store/reference entries. Workspace‑global markdown knowledge base enables agents and humans to store/reference entries. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Feature | Medium |
Skill Hub rewritten as a third‑party marketplace with install/uninstall UI flow. Skill Hub rewritten as a third‑party marketplace with install/uninstall UI flow. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Feature | Medium |
Cloud agent integrations expanded from 5 to 18 providers, including GPT‑5.5 Pro. Cloud agent integrations expanded from 5 to 18 providers, including GPT‑5.5 Pro. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Dependency | Low |
APNs authentication now uses `aioapns` with JWT; dead‑token pruning handles several error codes. APNs authentication now uses `aioapns` with JWT; dead‑token pruning handles several error codes. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Bugfix | Medium |
Routine stability improvements: per‑routine channels reverted, context+trigger merged, skip fire on pending response, inbox recognizes both channel prefixes. Routine stability improvements: per‑routine channels reverted, context+trigger merged, skip fire on pending response, inbox recognizes both channel prefixes. Source: llm_adapter@2026-05-30 Confidence: high |
— |
| Bugfix | Low |
Fixed missing `EventRecord` import in scheduler loop. Fixed missing `EventRecord` import in scheduler loop. Source: llm_adapter@2026-05-30 Confidence: high |
— |
Full changelog
OpenAgents Go v0.4.0
Multi-user collaboration release. Sign in with Google, get a workspace identity, mention humans, push notifications routed to your phone.
Highlights
Sign in with Google
Google Sign-In is now the canonical identity across the stack. Picture and display name flow into chat messages — no more anonymous "user" senders.
- Web (
agents.caremojo.app) — full login screen replaces the marketing landing for unauthenticated visitors. The?token=…URL bypass is gone; every workspace requires a signed-in account. - macOS + iOS — login gate via
GoogleSignIn-iOS(noFirebaseAuthkeychain conflicts), Google avatar in sidebar pill, sign-out in account card. - Cloud agents — Gemini gains "Sign in with Google" using the correct OAuth scopes.
Direct APNs push notifications
iOS pushes go straight through Apple's APNs via JWT auth (aioapns); no Firebase Messaging intermediary. Same .p8 key serves both sandbox and production.
@-mentionscope — push to the mentioned human's devices regardless of channel- Channel scope — push to channel members only (Slack-style implicit membership; sender's own devices excluded)
- macOS —
MacNotifier(UNUserNotificationCenter) for in-app banners; foreground suppression when the user is already viewing the channel
@-mentions for humans
The mention picker (web + Swift) now lists workspace humans alongside agents. Tag @bary / @bary-huang / @bary-mycaremojo and the message routes to that human's devices.
Humans auto-upsert as WorkspaceCollaborator rows on first signed-in post, then resolve by email-local-part, display-name slug, and first-word slug.
Real-time updates via Server-Sent Events
The 2s frontend polling loop is replaced by SSE. Backend publishes to Redis pub/sub after commit; GET /v1/events/stream streams to connected clients. Polling is retained as a fallback.
Shared workspace knowledge base
Workspace-global markdown knowledge entries — both agents and humans can store, browse, and reference them. Each entry has a slug for @knowledge:slug mentions in chat. Agent connector exposes 4 MCP tools.
Cloud agent expansion (5 → 18 providers)
14 new cloud agent integrations across three categories:
- Chat (OpenAI-compatible): Groq, Mistral, Together AI, Fireworks AI, OpenRouter, SambaNova, Cerebras
- Custom adapters: Anthropic Claude (native
/v1/messages), Perplexity (search-augmented) - Media generation: Stability AI, Replicate, fal.ai, ElevenLabs
- Plus: OpenAI updated to GPT-5.5 Pro / 5.5 / 5.4; accept any model ID for known providers; Manus added; all cloud model lists refreshed
Skill marketplace
Skill Hub rewritten as a third-party marketplace. Install / uninstall flow lands in the workspace UI and wires through the launcher.
Routines stability
- Per-routine channels reverted to per-agent queues (simpler, matches existing inbox UX)
- Routine context + trigger combined into one message so the agent gets full context on first run
- Skip routine fire when the agent hasn't responded to the previous run
- Inbox now recognizes both
routine:androutines:channel prefixes
Backend changes
- Migration 023 —
device_tokens.user_emailcolumn,workspace_collaborators.display_namecolumn, newchannel_human_memberstable - New endpoints —
POST /v1/workspaces/{id}/presence,POST /v1/devices/register,GET /v1/events/stream(SSE),POST /v1/knowledge(+ CRUD) - APNs auth-key push —
aioapnswith JWT, dead-token pruning (BadDeviceToken/Unregistered/DeviceTokenNotForTopic/TopicDisallowed/ExpiredProviderToken) - Migration renumber: 018 → 022 to resolve a duplicate on develop
- Missing
EventRecordimport in scheduler loop fixed
App Store / distribution
- macOS DMG (
packages/go/scripts/build-signed-dmg.sh) — Developer ID signed, notarized, stapled (both.appand.dmg) - App Store path —
DEVELOPMENT_TEAMset on macOS configs; App Sandbox re-enabled for MAS validation - iOS app icon — alpha channel flattened to satisfy App Store validation
Version bump
- Swift
MARKETING_VERSION0.3.x → 0.4.0 in both iOS and macOS configs - Web
@openagents-org/go-web0.3.1 → 0.4.0
Breaking Changes
- `?token=…` URL bypass removed; every workspace now requires a signed‑in Google account.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- vgo-v0.3.0 Requires backend supporting new `browser_enabled` field on PATCH /v1/workspaces/{id}.
Beta — feedback welcome: [email protected]