Proliferate

Proliferate v0.3.4

Daily release train for July 3, 2026.

Release Metadata

| Field | Value |
| --- | --- |
| Version | proliferate-v0.3.4 |
| Train | release-2026-07-03 |
| Base | c435e0a |
| Head | b73d48d |
| Compare | c435e0a...b73d48d |
| Surfaces | server, workers, litellm, e2b, web, mobile, desktop, runtime |
| Workflow | Actions run |

Highlights

• #827 feat(cloud): runtime worker auth model + enrollment by @pablonyx (area:desktop, area:anyharness, area:sdk, area:server, area:cloud)
• #830 feat(cloud): integration definition/account/oauth models + provider access by @pablonyx (area:server, area:cloud)
• #832 feat(cloud): integration gateway MCP endpoint + virtual tools by @pablonyx (area:server, area:cloud)
• #835 feat(cloud): integration management APIs (authenticate, oauth, admin) by @pablonyx (area:sdk, area:server, area:cloud)
• #836 feat(cloud): integration health endpoint by @pablonyx (area:sdk, area:server, area:cloud)
• #844 feat(cloud): integrations settings UI by @pablonyx (area:desktop, area:cloud)

Features

• #827 feat(cloud): runtime worker auth model + enrollment by @pablonyx (area:desktop, area:anyharness, area:sdk, area:server, area:cloud)
• #830 feat(cloud): integration definition/account/oauth models + provider access by @pablonyx (area:server, area:cloud)
• #832 feat(cloud): integration gateway MCP endpoint + virtual tools by @pablonyx (area:server, area:cloud)
• #835 feat(cloud): integration management APIs (authenticate, oauth, admin) by @pablonyx (area:sdk, area:server, area:cloud)
• #836 feat(cloud): integration health endpoint by @pablonyx (area:sdk, area:server, area:cloud)
• #844 feat(cloud): integrations settings UI by @pablonyx (area:desktop, area:cloud)
• #858 feat(server): self-hosting v1 - single-org mode, first-run claim, invites, versions, deploy bundle by @pablonyx (area:server, area:release)
• #861 feat(server): real version reporting, /meta pins, desktop updater redirect by @pablonyx (area:server)
• #863 feat(server): first-run claim with setup token by @pablonyx (area:server)
• #865 feat(server): ADMIN_EMAILS floor + instance admin invariants by @pablonyx (area:server)
• #867 feat: invite-as-allowlist registration + desktop password sign-in by @pablonyx (area:desktop, area:server)
• #906 feat(gateway): real xAI upstream + LiteLLM in production compose by @pablonyx (area:server)
• #907 feat(agent-auth): titled-key vault + env-var selections, state.json v2, two-phase render, new auth UI by @pablonyx (area:product)
• #908 feat(agent-auth): runtime catalog — gateway probe-always, curation as data, render pins deleted by @pablonyx (area:product)

Fixes

• #872 fix(desktop): repo-shape conformance for streaming-UI leftovers by @pablonyx (area:desktop)
• #874 fix(desktop): prevent path traversal in support attachment staging by @pablonyx (area:desktop)
• #875 fix(cloud/agent-run-config): require org membership for org-scoped listing (IDOR) by @pablonyx (area:server, area:cloud)
• #876 fix(cloud/github-app): verify installation ownership in install callback (IDOR) by @pablonyx (area:server, area:cloud)
• #877 fix(auth): add token-generation revocation for logout and password change by @pablonyx (area:server)
• #887 fix(migrations): merge the three parallel alembic heads on main by @pablonyx (area:server)
• #911 fix(product-ui): repo-shape conformance for secrets dialog + icon barrel by @pablonyx (area:desktop)
• #912 fix(desktop): All-Models refresh for native routes uploads runtime-probed models by @pablonyx (area:desktop)

Performance

No performance changes.

Docs / Website

• #891 docs(specs): integrations + worker-auth primitive, current-state architecture by @pablonyx (area:cloud)

Internal / Release

• #823 refactor(cloud): delete parked cloud domains and dead consumers by @pablonyx (area:desktop, area:sdk, area:server, area:cloud, area:website)
• #837 refactor(anyharness): gut runtime_config, inject gateway MCP from dotfile by @pablonyx (area:anyharness)
• #859 ci(self-host): production compose smoke, phase 1 by @pablonyx (area:server)
• #862 feat(server): membership policy seam + SINGLE_ORG_MODE by @pablonyx (area:server)
• #868 release(server): publish self-host deploy bundle by @pablonyx (area:server)
• #888 ci: fail PRs that fork the alembic migration history by @pablonyx (area:server)
• #896 chore(harness): remove the gemini harness (upstream went enterprise-only) by @pablonyx (area:product)

Other Changes

• #860 feat(desktop): codex-family popover convergence + header chip restore + new tab look by @pablonyx
• #869 feat: workspace git/PR statuses — sidebar, workspaces page, and anyharness hosting endpoint by @pablonyx
• #871 feat(desktop): streaming UI overhaul — interaction cards, plan flow, shimmer, todo tracker by @pablonyx
• #873 feat(desktop): environments + repo-scope settings (picker, Cloud|Local, Configure/Actions/Environment, unified add-repo modal) by @pablonyx

Artifacts

| Lane | Tag |
| --- | --- |
| Desktop | desktop-v0.3.4 |
| Runtime | runtime-v0.3.4 |
| Server | server-v0.3.4 |

Raw Commits

• 5022a59 spec(self-hosting): v1 end-to-end design (D1-D14, B1-B10)
• 15fef21 spec(self-hosting): amendments - default expression, desktop password auth, verification bar
• 72c844e refactor(cloud): delete parked cloud domains and dead consumers (#823)
• ddb1f92 feat: workspace git/PR statuses — sidebar, workspaces page, and anyharness hosting endpoint (#869)
• 035de5e feat(desktop): codex-family popover convergence + header chip restore + new tab look (#860)
• 8112c21 feat(cloud): runtime worker auth model + enrollment (#827)
• 9ea7b5a feat(server): membership policy seam + SINGLE_ORG_MODE (#862)
• 1a1b724 feat(server): first-run claim with setup token (#863)
• 3d7cfcb feat(server): ADMIN_EMAILS floor + instance admin invariants (#865)
• 0885aee feat(desktop): streaming UI overhaul — interaction cards, plan flow, shimmer, todo tracker (#871)
• ea26221 feat: invite-as-allowlist registration + desktop password sign-in (#867)
• 0f16c59 ci(self-host): add production compose smoke (phase 1) (#859)
• 7ec64db feat(server): version /meta endpoint, updater 302, real /health version (C1) (#861)
• 51c5a96 release(server): publish server/deploy as a versioned deploy bundle asset (#868)
• 8ea24da feat(cloud): integration definition/account/oauth models + provider access (#830)
• f41fbc3 fix(server): fall back to flat updater manifest when the pinned version is unpublished
• d4c6b1f ci(self-host): make smoke required-check safe via in-run change detection
• 9a4d9f5 ci(server): archive self-hosted release tarballs as root:root
• 5687399 ci(desktop): never overwrite the immutable versioned updater manifest
• d13537f docs(deploy): fix bundle checksum verification to use --ignore-missing
• 4fd894d fix(desktop): repo-shape conformance for streaming-UI leftovers (#872)
• c8bf8c0 fix(server): stop GET /v1/organizations minting a personal org in single-org mode
• 42617e0 ci(self-host): full-journey smoke + SITE_ADDRESS scheme normalization + standalone health gate
• 035e1d4 fix(self-host-aws): sync embedded deploy assets with server/deploy, surface setup token
• bb12271 feat(cloud): integration gateway MCP endpoint + virtual tools (#832)
• a015abd feat(desktop): environments + repo-scope settings (picker, Cloud|Local, Configure/Actions/Environment, unified add-repo modal) (#873)
• d37f8f1 fix(server): single-org membership policy honors roles and never reactivates removed members
• 166e9ec fix(server): registration requires the invitation token and honors the password kill switch
• 01cf5b0 fix(setup): cap claim email at the column limit and add an optional organization name
• e0fa7e8 chore(dev): pin SINGLE_ORG_MODE=false in local dev environments
• 6d3c969 ci(self-host): smoke registers with the invitation id as the token; sync AWS env warning
• 022f2fa fix(server): single-org invite emails link to the /register page
• 1b8616d feat(cloud): integration management APIs (authenticate, oauth, admin) (#835)
• 042749f refactor(anyharness): gut runtime_config, inject gateway MCP from dotfile (#837)
• 887865a fix(self-host-aws): E2B settings are optional, enforced only as a pair
• b79bb40 feat(server): server-rendered /register page for invited teammates
• 1aecfe9 feat(desktop): copy invite link action on pending invitations
• b7223b4 feat(cloud): integration health endpoint (#836)
• f8b549f merge main into self-hosting/v1 (integrations stack, streaming UI, releases)
• ae36831 fix(migrations): re-parent instance-marker chain onto integration_models head
• a7c6ec0 feat(cloud): integrations settings UI (#844)
• 0527a2d refactor(server): split oversized self-hosting modules to satisfy repo shape
• f0f8403 refactor(agent-auth): tear down Bifrost gateway stack (#814)
• 7d93b6e feat(agent-auth): add LiteLLM gateway service and admin client (#818)
• 2e57dae refactor(server): satisfy server boundary checks for setup and meta
• 92a8c8f feat(agent-auth): add LiteLLM schema and eager enrollment (#819)
• 64c572f ci: retrigger checks (Actions skipped fan-out on previous push)
• 30812c0 refactor(desktop): split password auth transport and flow into their own modules
• 3455591 feat(agent-auth): add gateway auth APIs and SDK surface (#820)
• 6a86bed feat(agent-auth): materialize agent auth into cloud sandboxes (#828)
• 4d086dd feat(agent-auth): render harness auth profiles from cloud state (#826)
• 9718138 feat(agent-auth): gateway model catalog with refresh and overrides (#834)
• d41046e merge main into self-hosting/v1 (agent-auth LiteLLM stack, integrations UI)
• 82677b1 fix(migrations): re-parent instance-marker chain onto the agent-auth head
• c9ea39b feat(agent-auth): import LiteLLM usage and enforce LLM credits (#821)
• 4d047f2 feat(agent-auth): LLM credit limits and auto top-up (#831)
• 9d94cb8 feat(agent-auth): agents settings UI for key pool and route selection (#824)
• e8ff565 feat(agent-auth): org agent policy with violation flagging (#833)
• d0bbbce Merge pull request #858 from proliferate-ai/self-hosting/v1
• 724e999 feat(agent-auth): first-run auth adoption and onboarding defaults (#829)
• f819fce feat(agent-auth): opencode slot composition, provider registry, key picker (#838)
• d6c18c7 feat(agent-auth): local surface state writer (desktop → runtime) (#843)
• 741b0b9 feat(agent-auth): agents-scope settings UI — overview, per-harness pages, api keys (#845)
• dd7f20b chore(agent-auth): clear post-merge repo-shape red (dupe providers file, raw label, oversized SettingsScreen) (#880)
• c2b029e fix(migrations): merge the three parallel alembic heads on main (#887)
• e9e776a ci: fail PRs that fork the alembic migration history (#888)
• 0754ebe release: prepare hotfix-2026-07-02-21
• c04adfe fix(agent-auth): fall back to native for un-configured harnesses instead of fail-closing (#889)
• 237d71b fix(desktop): prevent path traversal in support attachment staging (#874)
• 54e229a fix(cloud/agent-run-config): require org membership for org-scoped listing (IDOR) (#875)
• 3eb7b4a fix(cloud/github-app): verify installation ownership in install callback (IDOR) (#876)
• f3238fb release: prepare hotfix-2026-07-02-23
• d723c35 docs(specs): integrations + worker-auth primitive, current-state architecture (#891)
• 1e9d742 fix(auth): add token-generation revocation for logout and password change (#877)
• 21e7eaa chore(harness): remove the gemini harness (upstream went enterprise-only) (#896)
• 69a8325 feat(gateway): real xAI upstream + LiteLLM in production compose (#906)
• 6ed4961 feat(agent-auth)!: titled-key vault + env-var selections, state.json v2, two-phase render, new auth UI (#907)
• 998ebd1 feat(agent-auth): runtime catalog — gateway probe-always, curation as data, render pins deleted (#908)
• adbcc83 ui: consolidated UI cleanup pass (sidebar icons, thinking gleam, message-body sizing, settings/secrets polish, GitHub-app gating)
• 8ac8ed7 fix(settings): agent-policy conflicts table reads violation.sourceKind (was .route, type error); sync playground thinking-timing default to 2.4s
• cd7d363 fix(product-ui): repo-shape conformance — SecretEditorDialog primitives + icon barrel allowlist (#911)
• 2dc518a fix(desktop): All-Models refresh for native/api_key routes uploads the runtime-probed model list (#912)
• b73d48d release: prepare release-2026-07-03