Product updates

Changelog

A concise record of SourceWeft releases, written from Git tags so public updates stay tied to shipped code.

About SourceWeftView features
v0.3.0-rc.9a3e3e4b864af943d2e25c60888f372e95198c6b6October 14, 2026Release

Catalog reliability and production operations

This release makes public catalogs more reliable and easier to discover, strengthens browser and API security, and adds privacy-safe production activity logging. Signed desktop update packages remain on the existing Preview policy; stable/latest promotion is unchanged.

  • Public MCP and Skill sitemaps cover the full catalog, use content-based lastmod dates, and keep non-indexable React server component payloads out of the crawl.
  • Authors can add a safe Listed on SourceWeft badge to GitHub READMEs for catalog skills and MCP servers.
  • Large Skill repositories and GitHub rate limits are handled more reliably, with bounded chunked imports and refresh pauses until quota reset.
  • Dashboard workspace switches now show progress, recover from transient service errors, and report failures with a retry path.
  • Web and API responses receive security headers; public legal-page titles and Skill listing cursors are corrected.
  • Production logs now report privacy-safe chat, authentication, billing, and installation activity, including worker metrics.
v0.3.0-rc.8137dad0a9efe3b9177adb71607d5e9ad0a52a77dOctober 11, 2026Release

Recover interrupted desktop updates

Desktop updates now recover from temporary network interruptions with bounded retries and clearer local diagnostics. Update packages remain Tauri-signed; this release does not include Apple Developer ID signing, macOS notarization or Windows publisher signing.

  • Update checks retry temporary connection failures within a fixed time budget, while certificate, manifest and signature failures remain blocking errors.
  • Interrupted update downloads can retry once from fresh bytes, recheck the selected release and verify the package signature before installation becomes available. Cancellation remains responsive during requests and retry delays.
  • Local rotating update logs record sanitized cause chains, attempt counts, timing and recovery results without storing credentials or response contents.
  • Shared settings navigation is clearer, and the public footer includes a support email contact.
  • Release publication verifies draft assets by release ID and supports recovery of verified download alias publication.
v0.3.0-rc.7a43255afce26923890f6bd319414b9af204a0ee7October 10, 2026Release

Restore desktop updates with signed update packages

This release candidate embeds the desktop update verification key and publishes Tauri-signed update packages. It does not include Apple Developer ID signing, macOS notarization or Windows publisher signing; operating systems may warn or block installation. Clients missing the update key need one manual overwrite upgrade.

  • Added an explicit updater-signed publication mode that requires update keys and verifies every package signature without requiring Apple or Windows distribution certificates. Fully signed publication remains a separate strict mode.
  • Added a desktop-only manual recovery prompt, gated on verified published installers. Later, close and Escape suppress reminders for the local calendar day; Settings keeps the repair download available.
  • Repair downloads use a same-origin redirect compatible with historical native clients and stop redirecting when the publication configuration is withdrawn.
  • Desktop sign-in callbacks are deduplicated before one-time token redemption. Local computer execution remains available on macOS only.
v0.3.0-rc.58f4679d333248f510589dfa92a2a178a6ed37560October 8, 2026Release

Accurate PDF numbers and readable MCP activity

This release candidate preserves standalone numeric text in PDF sources and keeps MCP server and tool names readable through approvals, saved conversations and page refreshes. Desktop installers remain unsigned manual downloads; automatic application updates are not published for this version.

  • Preserved numeric PDF text that was previously mistaken for page numbers. Page-number text is retained to protect document data. Upload existing PDF sources again to regenerate their indexed text with the updated parser.
  • Kept readable MCP server and tool names through approvals, streamed activity, durable execution records and saved conversations. Older calls use their recorded display metadata when available.
  • Verified the maintained document parser on all seven supported native platforms and added an actual production-image regression for PDF data preservation.
v0.3.0-rc.63c13b71b5428cf1a6fb91fa7d64b5d71c947e5abOctober 8, 2026Release

Readable live MCP activity

This release candidate keeps MCP server and tool names readable while approved actions stream into a conversation, as well as after page refresh. Desktop installers remain unsigned manual downloads; automatic application updates are not published for this version.

  • Preserved recorded MCP display names when live tool events are first received or merged with later updates, including thin events that do not repeat display metadata.
  • Included MCP display names in the early tool events promoted from model messages. Execution aliases, approval behavior and model routing remain unchanged.
  • Added regressions for first, late and partial display events, including checks that metadata from different tool calls is not mixed.
v0.3.0-rc.414e9f83e43bfd381fe570175a70b31526388f893October 7, 2026Release

MCP overviews, skill installation and more reliable billing

This release candidate adds evidence-backed MCP overviews and README browsing, makes skills easier to install from third-party agents, and improves billing reversals, approvals and streamed reasoning. Desktop installers remain unsigned manual downloads; automatic application updates are not published for this version.

  • Added MCP server README browsing and AI overviews with classification and passage-level evidence. README ingestion uses batched GitHub queries, and overview backfill has configurable batch sizes and intervals while yielding to tenant work.
  • Added a platform-owned system model for catalog analysis and strict JSON-schema output when supported by the provider. System calls select reasoning behavior from model metadata.
  • Skill pages now offer installation paths for third-party agents, show whether a skill includes scripts, and explain review status as trust. Improved skill logos, detail-page layout and install-path end-to-end coverage.
  • Improved payment webhook authentication, atomic order writes and draining, and refund and dispute reversals for Stripe, Creem and Waffo. Billing uses observed model-call costs and records BYOK calls at zero cost; billing screens support English, Simplified Chinese and Traditional Chinese.
  • Approved connector actions are claimed atomically before provider execution. Streamed reasoning is persisted in bounded windows and merged by segment ID. Desktop sign-in returns through its deep link, and Gmail access supports per-user preview settings.
  • Restored a two-column desktop navigation menu and consistent public-page widths, fixed Umami analytics initialization, and refreshed self-hosting and runtime configuration guidance.
  • Fixed sandbox warm-pool sizing to honor its configured ceiling and patched dependency advisories, including Next.js, Axios, gRPC, js-yaml, undici, fast-uri, ip-address and brace-expansion.
  • Fixed Cloudflare sandbox commands with long execution budgets returning late after completion by releasing heartbeat output pipes promptly, while preserving heartbeat visibility and filtering.
  • Patched MCP compatibility, native and transitive dependencies for current security advisories, maintained the local braces stack with a cycle guard, and corrected an isolated subagent test fixture.
  • Made MCP tool activity summaries readable by presenting tool names instead of truncated internal identifiers.
  • Made Skill overview batch size configurable and exposed queued and running import capacity to pace backlog ingestion, while retaining the existing default and classification pipeline.
  • Updated native Rust TLS dependencies to compatible security-patched versions across both lockfiles.
  • Raised Skill batch import limits and made ingest concurrency configurable while retaining the default of two concurrent jobs.
  • Excluded the security oracle before copying pruned dependencies into the runtime image, so build-only oracle contents are absent from published image layers.
v0.3.0-rc.359d3dd7aSeptember 27, 2026Release

Gmail connector, dependable approvals and self-migrating deployments

This release candidate adds a Gmail connector, makes chat runs, approvals and sub-agents more dependable, and lets backend services migrate the database on start. Desktop installers remain unsigned manual downloads; automatic application updates are not published for this version.

  • Added a Gmail connector with live tools, mailbox indexing and approval-gated sending that shows the exact message before it is sent. The connection mode is chosen before OAuth, and approved connector and MCP actions now report in their result that the user approved them.
  • Connector syncs pause when the ingestion quota runs out instead of failing, and resume when quota and a real page need return. The connector catalog lists only implemented connectors.
  • Chat runs end cleanly when a worker shuts down, stale runs are swept, and cancellation monitoring stops once the worker records its own terminal state. A live run is no longer finished from its snapshot, and ending on a waiting question ends the turn on the server.
  • Approvals are steadier: sub-agent approvals stay to one pause in one child thread, a resumed turn keeps its earlier reasoning and tool cards, the model's tool-calling message stays intact after a mixed approval, and "Needs approval" clears once an approval resolves. Sandbox approval now gates only command execution.
  • Runs of tool calls collapse into one summary row, the prompt stays pinned while streaming, and sub-agent headers are no longer clipped. MCP cards no longer overlap their status and actions, and the dashboard's MCP deep link opens the server's details.
  • Backend images migrate the database in the entrypoint before any service starts and report why a migration failed. The worker and scheduler expose health checks, and the model gateway keeps serving its active configuration when the catalog is unreachable at startup. Catalog display names are configurable.
  • Added an optional, pluggable web analytics layer with Google Tag Manager and Umami destinations that load only when configured, plus sign-in and core product events. Refined Taiwan wording in zh-TW and added a command-line guide to the documentation site.
v0.3.0-rc.251e07c72September 24, 2026Release

Durable connector sync and steadier workspace workflows

This release candidate adds recoverable connector scheduling and incremental-sync groundwork, improves chat and sign-in reliability, and refreshes the workspace experience. Desktop installers remain unsigned manual downloads; automatic application updates are not published for this version.

  • Made opt-in connector indexing schedules durable across scheduler restarts and queue failures. Missed intervals coalesce, retries are visible, and concurrent syncs for the same connector are serialized.
  • Added a replay-safe provider checkpoint contract with scoped progress, expired-cursor recovery, and deletion reconciliation. Existing Notion sync keeps its full-discovery behavior; new connectors can use durable incremental pages.
  • Improved chat streaming state, version selection, generated-file previews, and recovery after interrupted requests. Cross-origin authentication now accepts the locale header used by the client.
  • Fixed sign-in code email links to use the configured public web URL and added regression coverage for per-message URL overrides.
  • Protected market admin pages with server-side access checks and restored scrolling in the market review interface.
  • Refreshed the public AI workspace landing page, client download navigation, and translation fallbacks. System skill imports no longer depend on tenant workspaces.
  • Adjusted release infrastructure to validate full Docker images on tags, build published images on native architecture runners, and keep pull-request checks focused on lint, types, and tests.
v0.3.0-rc.16b31d0bfSeptember 22, 2026Release

Multilingual workspaces, a community skill marketplace, and desktop improvements

SourceWeft now supports English, Simplified Chinese, and Traditional Chinese across the application and public pages. This release adds a community skill marketplace and richer sub-agent conversations. Desktop installers are unsigned manual downloads; automatic updates are not published for this version.

  • Added English, Simplified Chinese, and Traditional Chinese interfaces across authentication, workspaces, settings, skill discovery, sharing, and downloads. Language choices follow your account across devices and update the desktop tray.
  • Introduced public and in-app community skill discovery with search, categories, collections, version history, installation instructions, and author claims. Repository owners can request removal of their skills from the marketplace.
  • Added skill ratings, reviews, reports, and sandbox run statistics, with moderation controls and an audit trail. AI-generated skill overviews are available in three languages when analysis has been configured.
  • Improved community skill imports with asynchronous processing, source provenance checks, workspace-scoped installation, and confirmation when an update requests broader capabilities. Skills installed by an agent can be used during the same conversation turn.
  • Added dedicated sub-agent conversations, workspace personas, and a side panel for following delegated work. Selected skills remain available per conversation without being treated as explicit invocations.
  • Added Linux x64 AppImage packaging alongside macOS and Windows installers. This release provides unsigned installers without macOS notarization; use manual installation. The localized download page provides installation guidance.
  • Updated authentication screens and invitation flows. Self-hosted installations require email verification only when a delivery provider is configured, and read that setting through the internal API.
  • Expanded public MCP pages and improved localized navigation, sharing metadata, and search indexing. Skill pages and sitemap entries advertise only languages with visible AI overviews.
  • Improved mobile sign-in and chat layout, local folder browsing before a first message, sandbox connection recovery, and resilience when tool calls fail.
v0.2.0-rc.241b2396September 17, 2026Release

Desktop packaging and deployment fixes

This release candidate fixes desktop bundle packaging, finalizes isolated desktop download publication, and reorganizes the deployment documentation.

  • Encoded the mobile Tauri bundle icons as RGBA so desktop packaging succeeds.
  • Finalized isolated desktop download publication in the release pipeline.
  • Applied deployment and workspace fixes while preparing 0.2.0-rc.2.
  • Reorganized the README and extracted the sandbox execution guides.
v0.2.0-rc.3f8130a5September 17, 2026Release

Show the running version and keep changelog notes with the release

This release candidate adds an About panel that reports the version you are actually running, and moves changelog notes into the repository so a release cannot ship without them.

  • Added an About panel in Settings on web, desktop, and mobile. The desktop client reports its native app version; the web client reports the commit it was built from.
  • Injected the build commit into the container image and exposed the same value on the backend health endpoint, so a deployment can be traced back to its source.
  • Moved changelog entries out of page code into per-release files in the repository, and made a release tag without notes fail the release pipeline.
  • Backfilled the changelog entries for 0.2.0-test.3, 0.2.0-rc.1, and 0.2.0-rc.2, which had never been published to the changelog page.
  • Opened the changelog from the desktop client in the system browser, and added the application copyright and publisher to the desktop bundle metadata.
v0.2.0-rc.16b6df08September 15, 2026Release

First release candidate: desktop client, skills registry, and model gateway

This release candidate covers four months of work. It adds the macOS desktop client, reworks the skills registry around provenance and approvals, and unifies the model gateway behind a normalized catalog.

  • Added the macOS desktop client: a local workspace foundation, local execution bound to authorized hosts, a detachable Hub window, native centered file previews, and unified desktop chrome.
  • Reworked the skills registry: preserved registry versions, surfaced publisher attribution and license terms, stored skill bundles instead of pointers, and made enabling a registry skill an explicit approval rather than an automatic one.
  • Unified the model gateway behind a normalized model catalog with per-image pricing, provider-scoped price resolution, separated provider activation from credentials, and added OrcaRouter as a standalone provider.
  • Made commercial billing an optional module and added the shared subscription lifecycle across Stripe and Waffo.
  • Added tenant envelope encryption for team-owned secrets.
  • Integrated AnyDoc with explicit OCR routing and added direct-to-store upload from the browser.
  • Added versioned HTML artifact delivery, persisted committed artifact outputs, and grouped each sub-agent's tool calls under an Agent card in chat.
  • Unified the sandbox provider base images and made skill staging unconditional.
v0.2.0-test.317b8821May 26, 2026Release

Add the MCP market and approval-backed agent tools

This test release introduces the MCP market with an approval resume flow, expands connector management, and publishes the shared market contracts package.

  • Added the MCP market and the approval resume flow, backed by an MCP runtime whose agent tools run behind approvals.
  • Expanded connector source management, OAuth handling, and chat startup behavior, and added a connector catalog with public content pages.
  • Added Notion webhooks and Notion agent tools, then removed the unused Notion connector surfaces.
  • Published the market contracts package from its own package directory and hardened connector config and market runtime builds.
  • Added the SourceWeft Postgres image and simplified backend test discovery.
v0.2.0-test.1da3bcd8May 18, 2026Release

Expand model catalog discovery and dashboard performance

This test release expands model catalog discovery for global gateways and BYOK credentials, then improves dashboard and chat rendering paths.

  • Added dynamic model catalog discovery for global gateways and BYOK credentials, including LiteLLM capability matching and BYOK model candidate APIs.
  • Moved model catalog sync configuration into `model-gateway.global.json` and documented the gateway-level behavior.
  • Split chat thread streaming logic into focused parser, request body, render buffer, runner control, and event handler modules.
  • Improved dashboard rendering performance with richer route skeletons, memoized and virtualized chat/source UI paths, observability layout updates, and cached skills catalog loading.
v0.1.0-test.14f21442May 17, 2026Release

Skip startup pricing sync

This test release changes startup behavior so pricing synchronization is skipped during normal API and worker boot.

  • Updated backend API startup to avoid running pricing sync as part of service initialization.
  • Updated worker startup with the same pricing sync skip behavior.
  • Adjusted model gateway config sync handling for the new startup path.