Changelog

All notable Neural Labs changes are recorded here. Releases use Semantic Versioning and Git tags in the form vMAJOR.MINOR.PATCH.

[Unreleased]

Changed

• Model Provider's personal OpenAI card offers separate sign-ins (default) or the same Codex sign-in for Neura and new private workspace terminals. Sharing preserves independent terminal state and remains restricted to the owner; Team terminals stay separate. Additive migration 31 preserves existing accounts and defaults. Existing installations require an operator upgrade.

• Hardened control-plane request throttling and proxy trust, added a voice-start quota, constrained attachment URLs, removed mutable MiniPaint HTML sinks, and fixed editor regex backtracking. Email codes now use keyed hashing; Microsoft certificate assertions use PS256/SHA-256. Updated proxy-addr and source-map-js in the control plane and MCP server, source-map-js in both frontend lockfiles, and MCP's Hono dependency. See the security review.

• Updated the control-plane upload parser to Multer 2.4.0 and the console/desktop test dependency to Undici 8.11.2 to address published security advisories.

• Native automation policy validation now applies to create, edit, review, and execution. Unsupported saved policies produce a visible hold before a provider starts. Expanded generated-state isolation probes cover private skills, runtime paths, symlink and /proc traversal, and host control sockets.

• Added a global Twilio SMS/MMS plugin with encrypted administrator-managed credentials, read-only connection and webhook checks, in-product Twilio Console setup steps, and the official pinned OpenClaw SMS channel.

• Verified workspace phone numbers now form the inbound SMS allowlist and route to each member's private Alshival. Proactive agent SMS/MMS requires a per-member opt-in and the agent tool accepts only workspace identities.

• Added a personal Model Provider page, account-aware model/reasoning pickers, versioned follow-latest/pinned defaults, and independent Background AI, dedicated Team Alshival and Voice settings. Team activation is administrator confirmed; queued runs preserve accepted settings. Claude subscriptions remain explicitly release-gated. Workspace status distinguishes credentials from runtime/model readiness. Automations preserve reasoning off and strict pins.

• Alshival private and Team Chat composers now use Enter to send and Shift+Enter for a new line on every viewport. During an active private run Enter steers, while queueing remains an explicit Send options action. Enter also accepts the highlighted @ mention or $ skill suggestion.

• Team Chat now completes @Alshival and current channel-member @handle tags in a searchable composer popup. Alshival is summoned only through @Alshival; the misspelled $nerua and legacy $neura aliases no longer invoke the agent.

• Team Chat voice memos are now always hold-to-talk with no mode toggle. Private voice keeps a dedicated Open/Hold switch for continuous or press-to-transmit microphone behavior.

• Fresh desktops start empty instead of automatically opening Terminal. Returning sessions continue to restore their saved open and minimized windows.

• Alshival's phone layout now has searchable, collapsible conversation history, visible chat actions, a channel-terminal drawer, and a growing touch-friendly composer. Terminal adds named session navigation, mobile split-pane tabs, keyboard/Ctrl/Esc/Tab/arrow controls, and clipboard permission feedback. Both apps reserve space for the soft keyboard and floating dock.

• Files now uses one Explorer-style directory view with tabs, navigation history, personal synced sidebar pins, Recent, recursive filename search, multi-select, copy/move/rename, folder uploads, ZIP downloads, and a recoverable shared Trash with 90-day retention. File operations expose progress, cancellation, retry, and explicit conflict handling; replacements preserve the old item in Trash.

• A self-hosted, sandboxed miniPaint Image Editor opens workspace images and saves layered .minipaint.json projects or flattened PNG/JPEG/WebP through the authenticated Files API with stale-write protection.

• Alshival now has a durable OpenClaw-managed Chromium browser for QA. The workspace image includes browser fonts and Chromium, and private and Team agents receive OpenClaw's browser snapshots, screenshots, and interaction tool through the isolated openclaw profile.

• Alshival's website toolchain now includes FFmpeg/FFprobe, WebP and ImageMagick image utilities, and a working rsync installation. Team website skills make omitted creative choices automatically, require complete showcase builds to include a viewport-scale scroll-video or frame-sequence scene when compatible media is available, and prepare seek-friendly local video instead of falling back to a pointer reveal for convenience.

• Isolated Team Alshival runs may now use up to 30 minutes, allowing supervised website research, media preparation, browser QA, and deployment to finish as one bounded run instead of being cut off by the former 10-minute ceiling.

• Alshival now streams only the final answer in the main transcript while signed commentary, safe thinking status, plans, tools, commands, outputs, and file patches stay in the collapsed Work details below it. Expanded file steps show a bounded, credential-redacted patch for code review.

• Alshival private chats now have a wave control for a five-minute, live WebRTC voice conversation. Team Chat's wave control records a voice memo, stores a playable workspace attachment, transcribes it, and sends the transcript as an @Alshival turn so the agent receives the spoken context.

• Alshival opens on its new-chat screen when the newest conversation has been idle for at least three hours. Returning again without new activity does not keep resetting the user's selection, and an active run is always preserved.

• VS Code replaces the standalone Editor in the desktop dock and Files workflow. New files and text/code files open in the existing code-server window, every file has an Open in VS Code action, and folder context menus can open the selected directory in VS Code. Previously saved Editor windows migrate to VS Code when desktop state is restored.

• Team Chat now uses @Alshival for general agent turns while retaining $skill-name commands. Personal and Team Chat render image attachments inline and other files as download cards; Team Alshival can attach generated workspace artifacts.

• Alshival-generated static-site links now open the desktop Preview app. Website previews use short-lived, user-bound launch capabilities instead of reusable folder-encoded URLs, and the sandbox no longer permits remote assets or popups.

• Settings now presents agent extensions as Plugins, available to every active member and divided into private, user-owned plugins and global, administrator-managed workspace plugins. The former MCP screen is a locked global Neural Labs Tools system plugin with its live health and tool inventory intact.

• The add-plugin experience previews connection-only MCP plugins, including scope selection, authentication, discovery, and permission review, without accepting server URLs or credentials before the secure broker is built.

• Team Terminal input is now live for every connected participant. The former driver handoff, spectator mode, and Take control action have been removed; concurrent keystrokes reach the shared PTY in server arrival order.

• PTY resizing remains stable through an invisible layout leader that transfers automatically when its browser disconnects.

• Team Terminal WebRTC voice now prefers direct media and falls back to a self-hosted coturn relay over UDP or TCP.

Security and operations

• Browser automation remains headless inside the workspace container, never attaches to a developer's personal browser profile, and retains OpenClaw's private-network SSRF denial except for exact localhost and 127.0.0.1 grants needed to verify workspace-local preview servers.
• Voice provider credentials remain server-side. The new voice routes require an authenticated same-origin request, constrain SDP and audio sizes, and use a pseudonymous safety identifier; deployment must provide OPENAI_API_KEY.
• The VS Code open handoff accepts only authenticated, same-origin POSTs and resolves existing nonsymlink workspace paths before navigating the requesting developer's own embedded workbench. It cannot address paths outside the shared workspace and adds no listener or host mount.
• TURN uses authenticated one-hour HMAC credentials with pseudonymous user keys. The relay has allocation and bandwidth quotas, a narrow UDP range, no administrative CLI or database, and cannot relay to private, loopback, carrier-NAT, link-local, or multicast destinations.
• Deployment now requires public TCP/UDP forwarding for the TURN listener and UDP forwarding for the configured relay range. No database migration is required.

[0.3.2] - 2026-09-03

Changed

• Newly registered passkeys now appear immediately in Personalization and are reconciled against the authoritative no-cache account list without requiring a page refresh.
• Passkey creation and removal broadcast a browser-local account change so every open Personalization view in the current desktop refreshes together.
• Passkey rows now show the localized creation date and time. After the first credential is registered, the enrollment form clearly changes to Add another passkey.
• Alshival now presents an animated, centered readiness state while a new private conversation is created, subscribed over the live Gateway connection, and reconciled with its recent history.
• Explicit assistant commentary is now grouped with plans, commands, tools, and file activity inside the collapsed Work details timeline. Only the terminal answer remains as ordinary assistant text in the chat.

Fixed

• Fixed successful passkey enrollment leaving the UI on My passkey and Create passkey until Settings or the browser was manually refreshed.
• Preserved the successful registration response optimistically if the follow-up list request fails, while later successful synchronization remains authoritative.
• Removed the synthetic starting model / Alshival is working through the request / Done step produced by routine Gateway status frames. Status still drives the live run and queue controls without being presented as work.
• Fixed durable commentary appearing as separate assistant chat bubbles after a live event or history reload. Legacy unphased pre-tool updates are folded once later same-turn activity proves they were not the terminal answer.
• Fixed refreshes during an active run mistaking the latest durable progress update for the final answer. The unfinished tail now stays in collapsed Work details, and unphased live stream commits follow the same rule.

Security and operations

• The synchronization carries only the existing public passkey metadata. It does not expose WebAuthn private keys, credential material, challenges, or transaction tokens and adds no network listener or trust-boundary change.
• Alshival's progress projection uses OpenClaw's explicit commentary phase and same-turn supersession; raw model reasoning remains excluded and credential-shaped command output remains redacted.
• Rebuild and recreate the workspace service to deploy the updated desktop. No database migration is required.
• Implementation, test, upgrade, rollback, and security details are recorded in the v0.3.2 release record.

[0.3.1] - 2026-09-03

Changed

• Renamed the canonical Skills desktop window to Skills & Automations so its title reflects both dock entry points and the combined workflow surface.
• The desktop now provisions and verifies the signed-in user's personal agent through the authenticated account endpoint before starting the shared Alshival Gateway client. Transient bootstrap failures retry when the page is visible, online, or the retry timer expires.
• A disconnected or paused personal account now produces a long-lived, actionable desktop toast. Selecting it opens or focuses Settings directly on Personalization, including for administrators whose Settings window was previously showing another section.

Fixed

• Fixed personal agent provisioning failing on OpenClaw 2026.8.2 because the configuration command used the unsupported --json-strict option. Neural Labs now uses OpenClaw's supported --strict-json option.
• Fixed unknown agent id races by waiting until the live Gateway reports the provisioned personal agent before returning account bootstrap state.
• Fixed first-time ChatGPT connection requiring a Gateway browser profile to exist before the device-code flow could start. Role assignment now happens immediately for an existing authenticated account or after successful login; unauthenticated users can request their first device code without circular setup steps.
• Removed the Alshival client's implicit main agent default. Socket startup and agent-scoped requests now fail closed until the verified personal agent ID is available, so interactive work cannot race onto the workspace automation identity.

Security and operations

• No credential, device code, provider token, tenant state, host address, or new public listener is introduced. The browser still receives only safe personal-account status and its own stable non-secret agent ID.
• The existing exact per-user agent allowlist, sessions.others = none, loopback Gateway administration, and no-fallback automation boundary remain unchanged.
• Rebuild and recreate the workspace container after upgrading. Existing personal OAuth state, shared files, skill drafts, terminals' persistent metadata, and code-server data remain in their existing volumes.
• Diagnosis, compatibility notes, validation coverage, upgrade steps, and rollback guidance are recorded in the v0.3.1 release record.

[0.3.0] - 2026-09-03

Added

• Added Microsoft-bootstrapped passkey enrollment in Personalization and discoverable, user-verifying passkey login for existing approved accounts.
• Added a full-window graphical Skill Builder with synchronized metadata and canonical source views for SKILL.md, agents/openai.yaml, references, scripts, assets, invocation policy, icons, and MCP dependencies.
• Added durable server-side drafts with Yjs character-level collaboration, presence, owner-selected collaborators, administrator oversight, validation, explicit publication, and shared unpublished Alshival tests.
• Added a graphical automation draft flow, including a first-class Run a skill action that emits the canonical $skill-name invocation.
• Added a Personalization card where every user connects, monitors, pauses, and resumes their own ChatGPT device-code session for interactive Alshival.
• Added one isolated OpenClaw agent/auth directory and one exact Gateway agent role per Neural Labs user, provisioned from the immutable user ID.
• Added durable, redacted Team Chat work timelines for plans, commands, file operations, tool actions, and results.

Changed

• Refreshed the sign-in, signup, pending-access, setup, and administrator surfaces with one responsive light paper-and-spectrum account experience.
• Skills is now the canonical reusable-workflow app. The Automations dock icon focuses its Automations section rather than opening a second app instance.
• Regular users can inspect redacted operational automation state and history; unredacted configuration and all scheduler mutations remain administrator-only.
• Skill shortcuts now use one lowercase, hyphenated $skill-name form, and a published slug is immutable.
• Skill details now fetch and render the live OpenClaw SKILL.md instruction body in a bounded document viewer. Installed OpenClaw skills have a dedicated detail pane, and automation prompts use the same scrollable Markdown treatment.
• Private Alshival now uses the signed-in user's personal OpenClaw agent instead of the shared main agent. Missing or paused personal auth fails closed.
• Team Chat $Alshival turns use the message author's personal OpenAI account and receive prior shared work details alongside the bounded channel transcript.
• The workspace main OpenAI connection is now explicitly reserved for automations, heartbeats, and other background/system work.

Fixed

• Fixed desktop restoration forcing Terminal open even when the browser's saved per-user window state had Terminal closed or minimized.
• Fixed installed Skills remaining on “Loading” because the UI requested OpenClaw's optional skill-card.md instead of the actual SKILL.md. Static instructions now use an authenticated, allowlisted read while live skill status continues over the Gateway WebSocket.
• Fixed interactive Alshival usage being attributed to the administrator's shared workspace OpenAI account.
• Fixed periodic personal-access reconciliation reapplying the unlinked role and disconnecting an already restricted Alshival browser every 30 seconds.

Security

• Passkey ceremonies bind to the configured public origin and hostname, consume five-minute challenges once, require authenticator user verification, rate limit anonymous attempts, and store public credential material only.
• Builder HTTP and WebSocket operations derive identity from authenticated ingress, require the configured origin for mutations, authorize each draft, constrain package paths and sizes, and reject common credential shapes.
• The builder adds no public port and does not widen the ordinary Alshival Gateway scopes.
• Personal OAuth tokens stay in per-agent OpenClaw auth storage and are never returned to the browser or stored in PostgreSQL. The default Gateway role has an empty agent allowlist, and personal roles allow exactly one agent with no access to other users' sessions.
• A runtime-generated, rotating Gateway password is limited to the Gateway and workspace loopback role-management client, is not persisted in configuration or inherited by agent runs, and adds no new listener or host port.
• Team Chat activity persistence applies size limits, credential-pattern redaction, and generic reasoning labels rather than exposing raw reasoning.
• Team Chat passes its bounded transcript through a private, short-lived file instead of exposing it in process arguments; trusted-proxy loopback identity spoofing remains disabled.

Operations and compatibility

• Database migration 5 adds a bounded JSON activity projection to Team Chat agent-run records; it adds no credential column or table.
• Database migration 6 adds passkey public-key metadata and expiring one-time ceremony challenges; authenticator private keys remain on user devices.
• The first upgraded workspace start removes legacy main-agent neura-private sessions. This development migration is intentionally not reversible from application state; restore a pre-upgrade volume backup if that history is required.
• Rebuild and recreate the control-plane and workspace containers after upgrading. Existing workspace files, system automation auth, personal OpenAI auth, skill drafts, and code-server data remain in their persistent volumes.
• Full design, trust-boundary, validation, upgrade, and rollback details are in the v0.3.0 release record.

[0.2.0] - 2026-09-02

Highlights

• Reworked Terminal into a social coding surface that opens on a focused New Terminal launch page with discoverable Team sessions.
• Added authenticated, same-origin VS Code as a first-class desktop app backed by the shared workspace filesystem.
• Added pop-out and pop-in controls to every integrated desktop app window. Live app surfaces move between the desktop and a separate browser window without creating a duplicate app instance.
• Made Alshival steering reliable during active work and added a visible FIFO follow-up queue that advances automatically after each run.

Added

• A scrollable Team session rail with compact session icons, live connection state, participant badges on hover or keyboard focus, and controller status.
• An inline + Team flow for naming and starting a collaborative terminal; the previous team-selection dropdown is no longer part of the launch flow.
• Resume actions for recent personal terminals and join actions for running Team terminals.
• A VS Code dock icon, desktop window, load status, reload action, and an optional open-in-tab action.
• A managed local code-server child process with readiness reporting and persistent user settings and extensions.
• A same-origin authenticated HTTP and WebSocket proxy for the embedded VS Code surface.
• Per-window Pop out and Pop back into desktop controls for Alshival, Files, Editor, Preview, VS Code, Terminal, Automations, Skills, and Settings.
• Dock actions to focus an external app window or bring one or more pop-outs back into the desktop.
• Automatic recovery when a pop-out is closed with browser chrome, plus clear guidance when a browser blocks the requested window.
• A compact Alshival run-state banner and scrollable queued-message panel with queue positions, attachment counts, and per-message removal.
• Compact, expandable Alshival work timelines for thinking status, plans, commands, file operations, tool actions, command output, and durable history.
• A Copy path action for Files context menus that copies the selected file or folder's ~/workspace/... path and reports clipboard permission failures.

Changed

• Terminal is the active app on desktop startup. The terminal emulator is created only after the user starts, resumes, or joins a session.
• Terminal launch controls, text scaling, empty states, and responsive layouts were simplified to keep the coding surface primary.
• Minimized Alshival, Terminal, and VS Code surfaces remain mounted to preserve their live browser-side state.
• Desktop window titles now reserve space for four controls and truncate long preview titles cleanly.
• Alshival now treats Enter as immediate steering for the complete lifetime of an active run. Ctrl/Cmd+Enter admits a Gateway-owned follow-up instead of relying on a browser-side timer.
• Alshival keeps its transcript mounted during Gateway reconnects and reconciles durable history without replacing stable message nodes.

Fixed

• Fixed the Terminal status and text-size row expanding into the content area and covering the terminal when no emulator was mounted.
• Fixed startup behavior that could restore an unrelated app above Terminal.
• Fixed small-screen window-control targeting so adding the pop-out action does not hide the close control.
• Fixed persisted assistant updates and follow-up admission acknowledgements incorrectly marking Alshival idle while the original agent run was still active.
• Fixed sessions that were already running when Alshival opened not exposing the steer, queue, and stop controls until another streaming event arrived.
• Fixed Alshival clearing and rebuilding its transcript during a Gateway WebSocket reconnect, which could reset the reader to the top of a long chat.
• Fixed transcript updates either stealing the reader's position or failing to follow new messages. Bottom-follow now pauses after an intentional upward scroll and resumes through a visible Latest action.
• Fixed dock clicks minimizing an app that was open behind another window. Clicking a background app now raises its most recent window; clicking the already-frontmost app still minimizes it.

Security

• code-server listens only inside the workspace container and is not published as a host port.
• VS Code requests continue through existing authenticated workspace ingress. The proxy requires trusted identity, enforces same-origin mutation and WebSocket requests, and strips inbound credential and identity headers before forwarding.
• Embedded VS Code framing is limited to the same origin. The broader desktop remains non-embeddable.
• Pop-outs use a blank same-origin browser document and never place app state, credentials, or session material in a URL.
• Downloaded code-server archives are verified against architecture-specific checksums during the image build.

Operations and compatibility

• No database migration is required.
• Existing per-device desktop state remains compatible. A pop-out is restored as an ordinary desktop window after a desktop reload.
• Deploying this release requires rebuilding and recreating the workspace container. Persistent files, settings, extensions, and server-side terminal metadata remain in their existing volumes; running terminal processes end during container replacement.
• Full release details, validation evidence, upgrade notes, and rollback steps are in the v0.2.0 release record.