Accurate update status for busy sessions

Busy sessions waiting to finish their current turn before updating now report that wait accurately, instead of reporting a false update failure.

Fixed

• lop sessions and session info now show that a healthy busy session is waiting to switch to the build on disk at its next idle point. This corrects reporting only: sessions already continued working, and genuine update errors are still reported as errors.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.73.0...v0.73.1

Agent memory and CLI sign-in sharing

Agents gain bounded memory across compaction and paired devices. Memory capture and trusted-peer sync are on by default after upgrade, including sharing captured references with existing paired receiver-admin peers without per-item prompts; controls are below.

Keep secrets and sensitive identifiers in lop secret, not memory. Pattern filtering cannot prevent every unlabelled secret from being stored, journaled or synchronized.

New

• Local SQLite FTS5 keyword search supports on-demand recall, not semantic/ML-backed recall or exhaustive conversation history. Best-effort, model-free compaction capture saves references. Personal memory lasts across sessions; work memory can explicitly use session, team, agent or global scopes. Inspect and correct it with lop memory or /memory; no new native desktop panel is included.
• Captured URLs, email addresses, repository paths, thread references and short commit identifiers can synchronize to existing paired receiver-admin peers supporting memory-sync-v1. This uses existing trust, not a new grant or per-item approval.
• Set these in your settings: memory.enabled: false disables all memory behavior; memory.capture: false disables automatic capture; memory.suggest: false disables hints; network.memory.enabled: false disables sync only. Scope/device filters further limit synchronization.
• A CLI approval path lets you authorize future sign-ins of the same native OAuth account until you revoke it, with no automatic expiry. Account, recipient and duration are shown before approval. Existing broker_credential grants are required on both devices' member rows; approval does not grant them. Revoke with lop network credential revoke <provider> --from <device> --network <network>. Recording permission does not copy a login or prove delivery: short-lived access arrives only on the next eligible owner-relay tick.

Memory sync was validated in isolated setups, not a live multi-device network. Credential approval was validated with a software signer and CLI, not Touch ID, hardware signers, a live profile or a second physical host. No cloud-backed memory or universal account access is promised.

Improved

• Retry and model-change notices preserve literal brackets in provider/model names. Normal English exec status wording is unchanged; these labels remain English-only.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.72.2...v0.73.0

Clearer browser recovery diagnostics

Browser recovery refusals can now show clearer explanations when the connected browser host supplies diagnostic information. This release also includes internal test-reliability maintenance.

Improved

• Browser recovery refusals can distinguish a session mismatch from missing recovery history without exposing session identifiers.
• Internal test reliability when reading newly appended session transcripts; session transcript writing is unchanged.

Extension-side diagnostics require updating and reloading the browser extension separately. Older hosts and the companion desktop app may still return a generic refusal. This update does not repair missing recovery history or change recovery permissions.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.72.1...v0.72.2

Safer shared updates

Hub subscriptions now follow policy changes made while Local Operator is running, and shared updates better preserve local edits.

Fixed

• Turning a hub subscription off now stops automatic updates without a restart. If the configuration cannot be read, the last live policy is retained; with no readable policy yet, syncing stays off.
• Hub pulls retain their original merge baseline, keeping unintegrated local edits out of that baseline so later updates do not silently discard them.
• Removing an organization-scoped agent uses its organization route and validates the tenant and agent IDs before sending a request.

Improved

• Improves internal testing reliability without changing production behavior.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.72.0...v0.72.1

Clearer results and connected workflows

Highlights are more reliable after approvals, and can collect exact operational counts into a small labelled table. This version also improves screenshot-heavy conversations, usage visibility and already-authorized peer access.

New

• Adds the optional Team Bridge client foundations for human-required requests and decisions. Team Bridge remains disabled by default; this release does not enable it for you.

Fixed

• Highlights now recognize work resumed after you answer an approval question, retain linked deliverables, and find reports, ledgers and checksum manifests produced by shell commands.
• Screenshot-heavy conversations make more room when compacting, avoiding repeated compaction of an almost-full conversation.
• Running peers can receive native provider logins covered by an existing signed approval when both devices support the feature. This does not create approvals or grant sharing permission automatically.

Improved

• Graphics are enabled by default, with evidence-driven decisions and per-job cost limits. Exact labelled operational-count tables have a distinct recall threshold; charts retain their stricter confidence threshold. Disable graphics with supplements.graphics=false if you prefer file callouts only. Companion apps render graphics according to their separately installed versions; the terminal still shows file callouts only.
• Session usage includes classification decision requests and keeps unavailable charge amounts marked unknown rather than reporting them as free.
• Scoped developer type checks receive consistent memory headroom.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.71.5...v0.72.0

Phone-access setup support for desktop clients

The backend now lets compatible desktop clients plan or explicitly enable phone access through the existing account-bound setup flow. Companion desktop interface updates ship separately.

Improved

• Check phone-access setup and explicitly enable it through the same account-bound flow already used by the command line and terminal interface. Existing sign-in, consent and installation approvals remain in place.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.71.4...v0.71.5

Steadier browser handoffs and runtime checks

A resumed session can now switch browser hosts when you name one explicitly, and a runtime check that could stall under load now respects its time budget.

Fixed

• A resumed session that still owes one browser host a cleanup can now open on the other host when you name the backend explicitly, instead of being refused as stale. If unresolved evidence from the earlier host or a pending approval would make the switch unsafe, it is still refused before anything is opened.
• Runtime port checks now count the time spent starting their probes against their overall time limit, so a slow or busy machine no longer lets them run well past the limit they were given.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.71.3...v0.71.4

More control over shared agents, teams and skills

Choose how each linked hub item stays synchronized, including bundled skills. The backend also gains a session file index for generated media, highlighted files and subagent outputs.

New

• Manage subscription and opt-in auto-push policies per linked agent, team or skill from the CLI and terminal hub panel. Skill bundles use the existing hub synchronization engine. Outbound auto-push requires compatible server support and an eligible link; it is not enabled by default. The companion desktop interface updates separately.
• A backend session file API now indexes generated images and videos alongside highlighted files and subagent outputs, with lazy indexing of existing journals. This is backend support, not a new desktop Files interface. Generated media whose identifying data was already pruned cannot be recovered by this index.

Fixed

• Kept Hub Links usable after read or save failures, and prevented overlapping policy writes while the served revision refreshes.
• Explicit mobile setup now checks local prerequisites before cloud writes, resumes interrupted setup and preserves completed receipts. Planning remains read-only; signup, consent and installation approvals remain unchanged. Desktop setup updates separately.
• A legitimately resumed session can explicitly open the extension browser lane after using the desktop-app lane without a stale-owner-generation refusal. Recovery remains bounded and fail-closed, and existing ownership checks still apply. No browser-extension changes are included.
• Kept multi-character identifiers valid across native action schema decoders.

Improved

• Paired devices exchange scoped credential-login freshness metadata and remain restrictive when observations are stale or unavailable. This does not change who may borrow credentials, automatically repair sign-ins, or heal MCP or existing remote sessions.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.71.2...v0.71.3

Reliable network pairing

A completed network pairing now keeps its result when the pairing process exits during confirmation.

Fixed

• Prevented a completed network pairing from being reported as failed when its process exits during the final confirmation step.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.71.1...v0.71.2

Safer published tool results

Short known secrets are now masked inside one complete escaped JSON string-value layer in supported published tool-result copies. Internal maintenance also improves runtime-test reliability.

Fixed

• Mask short known secrets in supported published tool-result copies containing complete escaped JSON string values. Nested JSON-string documents and raw execution streams remain outside this added protection; secret names identical to a registered secret value remain masked.

Improved

• Keep runtime tests aligned with the source under test, prevent leaked heartbeat state, correct Python 3.13 attachment-loop hints, and synchronize boot, acknowledgement and cache tests.

Install or upgrade

Install or upgrade using your usual Local Operator installation method. Restart running sessions when you are ready to use the updated version.

Full changelog: v0.71.0...v0.71.1