SAM Recent Changes

Detailed Changes Moved From CLAUDE.md

These entries were removed from root CLAUDE.md so startup instructions stay compact. Use this skill when recent implementation context is needed.

• Compact archive shards: opt-in PROJECT_DATA_ARCHIVE_COMPACT_ENABLED pins lossless r2-gzip-v1 raw history while keeping complete grouped text/search and metadata in SQL. PROJECT_DATA_ARCHIVE_DAILY_WRITE_BUDGET (250000), PROJECT_DATA_ARCHIVE_WRITE_ESTIMATE_FACTOR (32) and PROJECT_DATA_ARCHIVE_R2_TIMEOUT_MS (10000) bound admission/object I/O; see compact archive configuration for estimated versus measured costs and whole-session deletion limits. Legacy archives remain readable and unchanged.

Use the /changelog skill for structured queries.

• mcp-connection-custom-headers: Bring-your-own MCP servers can carry custom HTTP headers (Composio requires x-api-key / x-consumer-api-key). Headers are independent of authType; Authorization is accepted only with none. Names ^[A-Za-z0-9_-]{1,64}$ — exactly what the Amp bridge mcp-remote@0.1.38 parses and a TOML bare key — pinned TS↔Go by the headerNames block of mcp-server-name-contract.json; transport headers are reserved (headerNames.reserved pins that list on both sides). D1 0178 adds header_names (plaintext display projection) + encrypted_headers/headers_iv (one AES-GCM ciphertext of the [{name,value}] list, the only column injection reads). All rules and the storage format live in services/mcp-connection-headers.ts. PATCH headers is the full desired set and an entry without value keeps the stored value, so the UI edits without ever holding secrets. PATCH writes only if updated_at still matches the row it read (nextUpdatedAt keeps the column strictly increasing; a lost race is a 409): every derived field comes from that read, so without the guard a header-only edit racing a switch to bearer persisted an Authorization header beside a bearer token. Resolution re-validates decrypted headers, refuses that pair as a backstop, and skips a bad row. vm-agent: McpServerEntry.ValidateHeaders (charset, reserved names, case-insensitive duplicates including Authorization beside the bearer token — one repeated key makes the whole Codex/Vibe TOML unparseable, sam-mcp included) runs in normalizeMcpServers and again before any config file is written; headers are persisted (migrateV18; a row whose headers cannot be decoded is skipped on restore instead of dropping every server), converted by toPersistedMcpServers/fromPersistedMcpServers; ACP header list, Codex env_http_headers with SAM_MCP_<NAME>_HEADER_<i>_SECRET (the _SECRET suffix both classifies it for isSecretEnvVar and cannot collide with a bearer _TOKEN var), Vibe headers table, Amp --header name:${SAM_MCP_HEADER_<i>}. Wire shape pinned by packages/shared/src/fixtures/mcp-server-entry-wire.json (node-agent serializer + real Go handler). UI: McpServerForm (add + inline Edit), McpServerHeadersField. Limits MAX_MCP_CONNECTION_HEADERS (10), MCP_CONNECTION_HEADER_VALUE_MAX_BYTES (8192). Refactor in the same PR: MCP/Codex/Vibe code moved out of gateway.go/session_host.go/workspaces.go/store.go into acp/mcp_servers.go, acp/codex_config.go, acp/vibe_config.go, server/mcp_servers.go, persistence/session_mcp_servers.go.

• project-chat-instant-switching: Switching between project chats renders the target chat at once. Transcripts (sessions/messages) now keep a 24 h gcTime (CHAT_TRANSCRIPT_CACHE_TTL_MS, from shared DEFAULT_CHAT_TRANSCRIPT_CACHE_TTL_MS, override VITE_CHAT_TRANSCRIPT_CACHE_TTL_MS); previously the TanStack 5-minute default dropped an unobserved transcript from memory and, on the next write, from IndexedDB. Restored queries get RESTORED_QUERY_GC_TIME_MS via hydrateOptions, the dehydrate filter stops writing a transcript older than the TTL, and opening a chat evicts the least recently updated unobserved transcripts beyond CHAT_TRANSCRIPT_CACHE_MAX_SESSIONS (20; evictStaleTranscripts in lib/query-options/chats.ts); on disk each transcript keeps only its newest CHAT_TRANSCRIPT_PERSIST_MAX_ROWS rows (default: the 500-row page; persistedQueryForDisk). ProjectMessageView is keyed per session (SessionMessageView), and the transcript is read straight from the query cache (useSessionTranscript), so a cached chat paints in the switching commit and an uncached one shows a spinner, never the previous chat. The cold load requests the newest page (fetchNewestPage, CHAT_SESSION_MESSAGE_LIMIT = 500) instead of the 50,000-row CHAT_SESSION_MESSAGE_MAX ceiling (now only the server clamp); older history pages in through Virtuoso startReached once the reader scrolls up — wheel, swipe, or ArrowUp/PageUp/Home, not the list position (a page of tool calls can fold into a few rows that fit on screen, and a chat can open away from the bottom when its newest message is taller than the screen; an ungated startReached then paged the whole history in on open) and through the existing "Load earlier" button. The #2159 forward-delta refresh moved into the query function unchanged. Jumps to a specific message page back until that message id is loaded (HistoryTarget in lib/message-paging.ts) and then confirm the row is on screen, re-scrolling past Virtuoso's prepend compensation (useConversationJump), and an unloaded comment anchor reads "on a message". Composer drafts are per chat (session-drafts.tsx), report-issue config is a cached query, and server session/state snapshots hydrate only when the server reports new ones, which fixes a streamed row resetting a working agent to idle. Auth gating is unchanged: no persisted transcript renders before the session check resolves.

• archive-sweep-affordability-ceiling-and-fallthrough: The production ProjectData archive sweep stopped reclaiming anything on 2026-09-08 and reported succeeded for 226 hourly runs while the root object climbed from 94% to 96.7% of its 10 GB ceiling. Two independently configured ceilings had to agree and drifted: a GitHub production Environment override lowered PROJECT_DATA_ARCHIVE_DAILY_WRITE_BUDGET to 100000 (affordability ceiling floor((100000-1000)/32) = 3093 write units) while PROJECT_DATA_ARCHIVE_SWEEP_MESSAGE_BUDGET stayed at the checked-in 5000, and selectCandidates orders message_count DESC ... LIMIT sweepProjects * sweepSessions (deployed 1x1). Every tick therefore picked the same 4994-message session, estimated ~160,808 writes, was refused by reserveArchiveWrites BEFORE it touched D1 (so the UTC budget window also froze at 2026-09-08T00:00:00Z), and continued out of a one-element list — no journal row, no location change, no error. The selection ceiling is now DERIVED from the allowance (archiveAffordableWriteUnits / archiveAffordableMessageCeiling in project-data-archive/write-budget.ts, used as the message_count <= ? bind), so the two can no longer disagree at any configuration; an explicit session-scoped operator canary still bypasses it. selectCandidates over-reads PROJECT_DATA_ARCHIVE_SWEEP_FALLTHROUGH_DEPTH (4) spare candidates and the journaling loop descends past a refusal instead of ending the tick, with both per-tick bounds (session slots and the cumulative message budget) moved INTO that loop so a refused candidate — which opens no migrating fence and moves no rows — consumes neither. reserveArchiveWrites returns a discriminated outcome separating exceeds_allowance (waiting cannot help) from window_exhausted (normal end-of-day backpressure), and PROJECT_DATA_ARCHIVE_BUDGET_STALL_ALERT_SWEEPS (3) consecutive ticks that migrate nothing and see only the former flip the cadence row to partial with an actionable last_error — counted and escalated inside one atomic UPDATE ... RETURNING (migration 0156 adds consecutive_budget_stalls) so a failed read cannot silently restart a streak. wrangler.toml now ships DAILY_WRITE_BUDGET=100000 (matching the production override, so staging and self-hosts derive the same ceiling), SWEEP_MESSAGE_BUDGET=2000, SWEEP_SESSIONS=2. Owner stubs are memoised per tick so the fall-through does not multiply ensureProjectId DO round trips. NOTE: within a 100000/day allowance the restored sweep reclaims on the order of 1-1.5 MB/day against ~66 MB/day of growth — it ends the deadlock but cannot reverse the storage curve; raising the budget is a spend decision.

• codex-astra-runtime-selection: Codex ACP is upgraded 1.8.0→1.10.0 and its Codex companion 0.153.2→0.153.4 across the canonical install manifest, VM-agent installer, and cf-container runtime image; the sandbox image's CLI-only pin is aligned to 0.153.4. VM-agent now validates both exact executable versions and supplies CODEX_PATH=codex, ensuring the adapter launches the explicitly pinned companion rather than a nested dependency resolved relative to itself. An explicit Codex profile model is applied through ACP session/set_config_option; rejection now fails session establishment with the requested model in the diagnostic instead of silently retaining the adapter default. A wire-level ACP regression test pins both the successful gpt-6-astra request and the fail-closed case. Process fix: .claude/rules/23-cross-boundary-contract-tests.md now treats adapter/companion resolution as one runtime contract.

• archive-drain-enable-unfence-and-throughput: (Cadence/budgets below superseded 2026-09-27 by the tripled 18-minute cadence and 2,400,000 daily write budget in PR #2161; the 2026-10-03 hourly billing firebreak, PR #2216, was reverted the same day. Current shipped values: PROJECT_DATA_ARCHIVE_GLOBAL_SWEEP_INTERVAL_MS=1080000, _SWEEP_SESSIONS=8, _SWEEP_MESSAGE_BUDGET=10000, _WALL_TIME_MS=10000; see the env-reference skill.) The production archive drain now runs on its own. Root cause of the never-running sweep: the GitHub production Environment variable PROJECT_DATA_ARCHIVE_GLOBAL_SWEEP_ENABLED=false (set 2026-09-04) replaced the "true" PR #2023 checked into wrangler.toml, so the deployed Worker kept false and every cron.completed reported projectDataArchiveShardingSkipReason: disabled; that Environment override is deleted as part of shipping this change (a deploy-time action, not a repo file: verify the deployed value per rule 70 before trusting it), and sync-wrangler-config.ts now prints every GitHub Environment override that differs from wrangler.toml (listEnvironmentVarOverrides). A pre-copy refusal no longer fences the session: the root object's archiveSourcePrepareIntent RPC RETURNS a typed ProjectDataArchiveSourcePrepareRefusal (prepareArchiveSourceIntentOrRefuse) for eligibility invariants that reject before any write, and the coordinator (refusePreCopyMigration) returns the D1 location to root in the same tick and freezes the journal as precopy_refused (no retry, no poison, no breaker) instead of leaving failed + migrating. selectCandidates/selectScopedCandidates skip a session with such a marker for PROJECT_DATA_ARCHIVE_PRECOPY_REFUSAL_RETRY_MS (default 7 days); an explicit session-scoped canary bypasses it. Stats gain refused; the problem-migrations list sorts self-healing precopy_refused rows after rows that need a human and the frozen-intent inspection skips them; failed journals wait PROJECT_DATA_ARCHIVE_FAILED_RETRY_DELAY_MS (default 1 h) before a sweep reclaims them so the 3-attempt poison budget spans hours at the shorter cadence; abandon, copy-back and the refusal unwind share one restoreSessionLocationToRootStatement; project_data_archive_candidate_migrated logs per-phase durations (prepare/copy/seal/manifest/finalize). Throughput was initially shipped at PROJECT_DATA_ARCHIVE_GLOBAL_SWEEP_INTERVAL_MS=900000 and PROJECT_DATA_ARCHIVE_WALL_TIME_MS=30000; after the 2026-09-08 billing firebreak, wrangler.toml ships a one-hour cadence, one session per pass, a 5,000-message budget, and a 10s wall budget while the code fallback stays daily / 5s.

• archive-sharding-streaming-hash-abandon-size-budget: Archive sharding can now drain a large root ProjectData object without resetting it. The terminal-version hash (computeTerminalVersion → tableAggregateSha256 in durable-objects/project-data/archive-sharding.ts) used to toArray() every row of a session per table and digest one string; a 100,000-message session and a tool-heavy 9,906-message session both reset the SAM root object with Durable Object's isolate exceeded its memory limit. It now streams pages of PROJECT_DATA_ARCHIVE_HASH_PAGE_ROWS (default 500) through createCanonicalRowsHasher (node:crypto incremental SHA-256), which is byte-identical to the one-shot definition so every recorded proof stays valid; finalizeSourceDelete and rebuildTargetFts page grouped rows the same way. New superadmin POST …/archive-sharding/migrations/:migrationId/abandon (abandonProjectDataArchiveMigration) recovers pre-copy migrations that copy-back cannot: it verifies on the root object that the source was never deleted, drops the partial shard copy (abandonArchiveTargetSession, which refuses sealed targets without that proof) and the source intent (abandonArchiveSourceIntent), freezes the journal as operator_abandoned without opening the project breaker, and returns the D1 location to root. Abandon reserves the journal lease first (reserveAbandonLease, epoch bump) and removes the source intent under the root transcript lock BEFORE dropping the shard copy, so a sweep finalizing concurrently cannot leave zero copies; the fence and the ordering are each pinned by a mutation-verified test. Candidate selection is largest-first (session_summaries.message_count DESC) under a new per-tick PROJECT_DATA_ARCHIVE_SWEEP_MESSAGE_BUDGET (default 20,000; a single oversize session is still selected alone); PROJECT_DATA_ARCHIVE_SWEEP_SESSIONS becomes the hard ceiling (default raised 1 → 10); the sweep now journals (fences) each candidate only immediately before processing it (processArchiveMigrationBatch pending), so a tick that runs out of wall time never leaves unreached sessions fenced migrating until the next cadence-gated sweep. forEachGroupedRowPaged seeks on the indexed (created_at, id) order (a rowid seek planned as a per-page sort of the whole session). Process fix: rule 69 gains the memory-ceiling case of harness-ceiling divergence.

• agent-client-version-refresh: Codex, Claude Code, and OpenCode client stacks brought current across every synchronized pin location (agent-install-manifest.json, gateway.go install constants, Dockerfile.vm-agent-container, gateway tests, e2e mock): @agentclientprotocol/claude-agent-acp 0.58.1→0.73.0 (bundles claude-agent-sdk 0.3.257; emitRawSDKMessages/_claude/sdkMessage harness-lifecycle contract verified unchanged), @anthropic-ai/claude-code 2.1.258→2.1.260, @agentclientprotocol/codex-acp 1.1.2→1.8.0 (CODEX_CONFIG env + INITIAL_AGENT_MODE=agent-full-access channels verified still supported; still no CLI -c parsing; depends on @openai/codex@^0.152.0), @openai/codex 0.144.6→0.153.2, opencode-ai 1.17.18→1.18.27 (opencode acp + OPENCODE_CONFIG_CONTENT verified). The implied adapter/companion compatibility was later invalidated: zero-major caret semantics mean ^0.152.0 excludes 0.153.x, so the adapter retained a nested 0.152.x runtime; see codex-astra-runtime-selection above. claudeCodeMinVersion floor stays 2.1.251. Also caught and fixed silent drift in Dockerfile.sandbox (the SandboxDO guided credential-setup image): it pinned claude-code 2.1.258 + codex 0.142.5 and installed the deprecated unpinned @zed-industries/claude-agent-acp that no sandbox surface execs — CLIs aligned to the manifest companions, dead adapter removed, and the contract test now pins sandbox codex alignment and bans the Zed adapter's return. check-agent-install-manifest.ts matching is boundary-aware (a stale pkg@1.18.270 can no longer satisfy a pkg@1.18.27 pin by substring). Existing live containers keep old binaries until restart/new session; cf-container images pick the new versions up at next deploy.

• knowledge-injection-relevance-ranking: Session-start knowledge injection (get_instructions) is ranked instead of alphabetical. getAllHighConfidenceKnowledge previously used ORDER BY e.name ... LIMIT 50, so the cap filtered on entity spelling: in production all 50 slots went to AccountMap..AgentReliability, 46 of them to the one AgentBehavior grab-bag, while ContentStyle/CodeQuality/User/Architecture/BusinessStrategy — entities the same payload tells agents to consult — had never been injected once, with no hint they existed. Now scored by the EXISTING formula (computeRelevanceScore: confidence × 1/(1 + age/30d) on last_confirmed_at, so confirm_knowledge restores rank), mirrored into SQL and pinned by a parity test; per-entity cap via ROW_NUMBER() OVER (PARTITION BY entity_id); now bound as a parameter and ties broken to a total order (score DESC, last_confirmed_at DESC, id ASC) so output is reproducible. New getKnowledgeEntityIndex appends a compact Name (type, N) index to knowledgeDirectives disclosing what was NOT injected and naming search_knowledge/get_relevant_knowledge as the retrieval path; it returns {entries, totalEntities} (total via COUNT(*) OVER ()) so a truncated index can never be labelled "full". The three DO reads run as an isolated Promise.allSettled fan-out — a failed ranked read still leaves the index. Limits are clamped at the DO boundary (clampRowLimit): a negative perEntityLimit would otherwise make entity_rank <= ? unsatisfiable and inject nothing project-wide, and LIMIT -1 means unbounded in SQLite. New env vars KNOWLEDGE_AUTO_RETRIEVE_PER_ENTITY_LIMIT (8), KNOWLEDGE_ENTITY_INDEX_LIMIT (200). Process fix: .claude/rules/65-capped-selection-must-rank-and-disclose.md.

• byo-mcp-servers: Bring-your-own MCP endpoints. Users store {name, url, authType, token, enabled} at personal (/api/mcp-connections) or project (/api/projects/:projectId/mcp-connections) scope; SAM injects them into every agent session alongside sam-mcp. Both URL and token are AES-256-GCM encrypted and never returned by a read path (several providers issue pre-signed URLs with the credential in the URL, so the URL is a secret; url_host is the display value). Migration 0120_mcp_connections. buildSessionMcpServers is the single composition point, called by agent-session-bootstrap.ts (covers VM + cf-container, rule 61) and the manual workspace agent-session route; the anonymous trial path is deliberately pinned to sam-mcp only. Resolution skips-and-warns per row so one bad connection cannot brick session start (rules 41/50). vm-agent: McpServerEntry.Name (additive, rule 54) plus ResolveMcpServerNames as the single naming source of truth — it replaced three drifted copies, one of which named a lone server sam-mcp-0 for Vibe and sam-mcp everywhere else; persistence migrateV12. Codex's startup precondition, which required a bearer token for EVERY injected server, is now scoped to the reserved sam-mcp entry so a no-auth connection cannot break all Codex sessions. UI: Settings → MCP Servers (personal) and Project Settings → Runtime (project), one shared McpServersManager. v1 was bearer/none auth and personal/project scope only; custom headers shipped later (see mcp-connection-custom-headers), profile/skill attachment is tracked in idea 01M0QDASJCK3YWVX1GETZTSFWZ. Limits: MAX_MCP_CONNECTIONS_PER_SCOPE, MCP_CONNECTION_URL_MAX_BYTES, MCP_CONNECTION_TOKEN_MAX_BYTES.

• policy-lifecycle-controls: Project policies gain a shelf life so one-shot workflow policies stop being injected into every session forever. Additive DO migration 034-policy-lifecycle-controls adds expires_at INTEGER (nullable — NULL means never expires, preserving every existing policy's behaviour) and scope TEXT NOT NULL DEFAULT 'always' ('always' | 'task'). getActivePolicies filters at READ time (active = 1 AND (expires_at IS NULL OR expires_at > ?)) — no sweep, no cron; the row is retained and stays active so get_policy / list_policies / the Policies tab still show a human why a policy stopped applying, and the per-project cap COUNT excludes expired rows. A scope: 'task' policy MUST carry an expiresAt, enforced by one shared validatePolicyLifecycle at all three write boundaries (MCP policy-tools.ts, REST routes/policies.ts, sam-session tools/add-policy.ts) plus a DO-level choke point. add_policy / update_policy accept scope + expiresAt; expiresAt: null on update clears an expiry. Expiring policies render an inline (task-scoped, expires YYYY-MM-DD) annotation in policyDirectives, and the capture instruction now tells agents to scope dated work. New limit POLICY_MAX_EXPIRY_MS (default 365 days). Also hardened scripts/quality/check-do-migration-safety.ts, which extracted only backtick and single-quoted SQL — a sql.exec("DROP TABLE ...") in double quotes was invisible to the gate and reported PASS.

• claude-fable-51-model-catalog: Claude Fable 5.1 (claude-fable-5-1, released 2026-09-01, $10/$50 per MTok, native 1M context) added to both canonical model lists — CLAUDE_MODELS dropdown catalog and PLATFORM_AI_MODELS proxy allowlist/pricing. Claude Code CLI pinned to @anthropic-ai/claude-code@2.1.258 because Fable 5.1 requires Claude Code 2.1.251 or newer; the VM-agent installer now validates the underlying claude binary instead of treating claude-agent-acp alone as sufficient. Focused tests pin dropdown presence, platform metadata, and the no-[1m] selector rule for native 1M Claude 5-family models.

• report-issue-idea-flow: Hosted "Report an Issue" flow that groups reports into private feedback incidents and creates/updates a linked draft Idea in the effective private feedback project (Admin → Integrations runtime setting, falling back to PLATFORM_FEEDBACK_PROJECT_ID). Two entry points: the session tool rail's Report action and ErrorBoundary crash screen. Users explicitly consent before technical refs (sessionId, taskId, nodeId) are attached. Server-side cross-tenant ref authorization validates project membership before storing references. User text sanitized with secret/PII redaction and fenced with provenance markers. Feature auto-hidden when no effective feedback project exists or it does not reference an existing project in the current deployment database. Configurable limits: REPORT_ISSUE_TITLE_MAX_LENGTH, REPORT_ISSUE_DESCRIPTION_MAX_LENGTH, REPORT_ISSUE_CONTENT_MAX_LENGTH.

• claude-opus-5-model-catalog: Claude Opus 5 (claude-opus-5, released 2026-07-24, $5/$25 per MTok, native 1M context) added to both canonical model lists — CLAUDE_MODELS dropdown catalog and PLATFORM_AI_MODELS proxy allowlist/pricing. Retired claude-sonnet-4-20250514 pruned; stale defaults bumped to claude-sonnet-5 (DEFAULT_SAM_MODEL — was pointing at the retired model, DEFAULT_AI_PROXY_ANTHROPIC_MODEL, DEFAULT_TRIAL_MODEL_PRODUCTION). New regression tests pin retired-Anthropic-model exclusion and default↔catalog registration; process rule .claude/rules/52-model-catalog-lifecycle.md.

• dispatch-task-runtime-routing: MCP dispatch_task now honors explicit and skill/profile runtime selection. Explicit cf-container decisions launch task-mode Instant sessions asynchronously without VM credential/quota gates or duplicate chat persistence; the Instant branch re-verifies repository owner access (requireRepositoryOwnerAccess) before launching, matching the VM branch; async Instant launch failures mark the task failed via the shared queued-guarded transition (markQueuedTaskFailed) instead of stalling queued until the stuck-task cron; VM-only arguments conflict with container runtime instead of silently downgrading; responses expose the effective runtime and decision reason, and get_task_details returns the task's chat sessionId once the async session exists.

• origin-tag-injected-messages: SAM-injected prompt text (e.g. the get_instructions reminder) is no longer concatenated into the visible user prompt. It is passed separately as injectedInstructions on the vm-agent create-session HTTP body (startAgentSessionOnNode → buildInitialPromptParams), emitted as a second ACP prompt block tagged _meta["sam.origin"]="system". The vm-agent honors that marker ONLY from a trusted control-plane prompt (HandlePrompt(..., trustedSource)) — browser viewer prompts have it stripped so a user cannot hide their own content. Origin propagates through the messagereport outbox (new origin column), the ProjectData DO chat_messages table (additive migration 024-chat-message-origin, NULL/absent = user), ChatMessageResponse, and the live session/update broadcast. The web collapses origin=system user messages behind a <details> "Show system context" disclosure (AcpConversationItemView). origin=system content is excluded from user-content dedup, LIKE/FTS search (materialization filters it out of chat_messages_grouped), topic auto-capture, and attention resolution.

• chat-full-load-timeline-jump: (Initial full load superseded 2026-09-27 by project-chat-instant-switching, which loads the newest page first.) Project chat loads the FULL conversation on open (getSessionMessageLimit split into a small default page size CHAT_SESSION_MESSAGE_LIMIT for the 3s poll/load-more and a large CHAT_SESSION_MESSAGE_MAX ceiling the initial load requests; new DEFAULT_CHAT_SESSION_MESSAGE_MAX). The 30 MiB RPC size guard + hasMore "Load earlier" remain the fallback for oversized sessions. Timeline jump-to-message now anchors by messageId+timestamp with a loadUntil fallback (no more dead clicks), every entry kind (user message, status update, activity) is clickable, and the jumped-to message flashes (.sam-message-highlight). Removed the now-dead messageIndex/messageIndexMap from the timeline.

• skills-profile-override-layer: Skills as a first-class profile-override layer (skill → profile → project → platform); additive migration 0063_skills.sql adds skills, skill_runtime_env_vars, skill_runtime_files and tasks.skill_id/tasks.skill_hint/triggers.skill_id; shared mappers in profile-fields.ts/profile-runtime-assets.ts; CRUD + runtime routes under /api/projects/:projectId/skills; resolution wired through task/trigger/MCP/dispatch + workspace runtime asset injection; Skills UI + chat/task skill selectors in apps/web

• explicit-sam-provider-selection: Require explicit opt-in to SAM as AI provider via providerMode: 'sam'; three-mode agent auth (user-api-key, oauth, sam); AI proxy auth gate on all endpoints including /models

• compact-mode-lazy-load-tool-content: Chat compact mode strips tool content from RPC payload (80-90% reduction); lazy-loads on expand

• harness-track-d-integration-design: SAM-native harness architecture doc; Gemma 4 26B as default Workers AI model

• ai-proxy-universal-tracking: URL-path-based passthrough proxy for usage tracking without consuming auth headers

• user-ai-budget-controls: User-facing daily token budgets + monthly cost cap with 3-tier resolution

• anthropic-proxy-endpoint: Native Anthropic Messages API proxy through AI Gateway with Unified Billing

• user-ai-usage-dashboard: Per-user LLM usage dashboard from AI Gateway logs (by model, by day)

• cost-monitoring-dashboard: Admin cost dashboard aggregating LLM + compute costs with projections

• sam-observability-context-tools: SAM tools for searching task messages and browsing project codebases

• sam-agent-phase-a-tools: SAM orchestration tools (dispatch_task, create_mission, get_task_details)

• policy-propagation-phase4: Project policies with MCP tools + propagation to child tasks

For the latest changes, also check git log --oneline -20.

• durable-project-eventing: Operational same-chat event delivery, persisted one-off schedules and bounded standing watches, agent channels with atomic history/follow, and member project/session Events controls. Canonical source outbox covers configured lifecycle/GitHub CI/review/authenticated-webhook facts; credential-limit events use actual server-selected attribution. Shared mailbox/recovery guards preserve cancellation and membership authority. Retention uses incremental accounting and bounded durable orphan-scan progress. Delivery receipts and schedule admission remain separate from agent action.
• session-visibility: VM Agent enriches session responses with live hostStatus and viewerCount; shared AgentHostStatus type; new listAgentSessionsLive() browser API; enhanced status colors in workspace UI
• devcontainer-runtime-user-consistency: VM Agent resolves effective devcontainer execution user when CONTAINER_USER is unset; detection order: devcontainer read-configuration > devcontainer.metadata label > docker exec id -un fallback; per-workspace ContainerUser stored in runtime
• workspace-runtime-identity: VM Agent derives host workspace identity from canonical workspaceId; strict workspace label matching prevents cross-workspace routing
• sam-workspace-env: SAM platform metadata injected as env vars into devcontainers during bootstrap (SAM_WORKSPACE_ID, SAM_NODE_ID, SAM_WORKSPACE_URL, SAM_API_URL, SAM_REPOSITORY, SAM_BRANCH)
• worktree-context: Deep git worktree integration across VM agent, API, shared types, terminal, and workspace UI; worktree-aware terminal/chat session creation; WorktreeSelector UI
• node-system-info: VM Agent sysinfo package collects metrics from Linux procfs and Docker CLI; two-tier collection (quick for heartbeat, full for /system-info endpoint); Node detail page redesigned with composed section components
• devcontainer-named-volumes: Replaced bind-mount storage with named Docker volumes (sam-ws-<workspaceId>); eliminated permission normalization
• command-palette-search: Enhanced command palette with fuzzy file search and tab switching; camelCase-aware fuzzy matching
• tab-reorder-rename: Unified tab ordering, rename, and drag-and-drop reordering; useTabOrder hook with localStorage persistence
• persistent-agent-sessions: Agent processes survive browser disconnects; SessionHost owns agent lifecycle independently; fan-out message broadcasting; bounded message ring buffer for late-join replay
• workspace-keyboard-shortcuts: VS Code-style keyboard shortcuts; centralized shortcut registry with platform-aware matching
• agent-settings-acp-protocol: Wire agent settings through ACP protocol; all 5 permission modes exposed
• comprehensive-lifecycle-logging: End-to-end ACP/WebSocket lifecycle observability via CF Workers
• vm-agent-error-reporting: Go errorreport package with batching and periodic flushing
• client-error-reporting: Client-side error reporting pipeline with batched sends
• agent-file-ops: ACP ReadTextFile and WriteTextFile handlers via docker exec
• file-browser: File browser with directory listing and syntax-highlighted file viewer
• git-changes-viewer: GitHub PR-style git changes viewer with unified diff
• voice-to-text: Voice input with Workers AI Whisper transcription
• 014-multi-workspace-nodes: First-class Nodes with multi-workspace hosting, async provisioning, workspace recovery
• 013-agent-oauth-support: Dual credential support for Claude Code (API key + OAuth token)
• 012-pty-session-persistence: PTY sessions survive page refresh with ring buffer replay