Release Notes — Week of October 5 to October 12, 2026

Seven releases shipped this week — v1.164.0 through v1.169.0 — across 168 merged commits. The swarm got safer to trust and easier to adopt: secrets can no longer leak through any write path, workflows compose, scripts run lighter, and a single command stands up a self-hosted swarm. A note on scope: 19 commits landed on main after the v1.169.0 tag and are in no release yet; each is marked "on main, ships in the next release" below.

Highlights

Secrets are scrubbed everywhere they could land

A credential that reaches an agent never lands in a log, event, memory, task, workflow step or outbound message. A central secret registry learns every credential the API knows, survives restarts, and catches encoded copies of known values (#1918). A vendored gitleaks rule set — pinned to v8.30.1 and verified by sha256, replacing 19 hand-written token shapes — covers vendor credentials (#1922). Write-time scrubbing now covers event payloads, script runs, workflow runs and steps, memory, messages, approvals, schedules and task text (#1924, #1925, #1926, #1927), plus HTTP error bodies, telemetry and Slack/WhatsApp egress (#1911, #1914, #1919). db-query refuses credential tables outright (#1915), gitleaks runs in merge-gate (#1910), and a versioned retro-sweep scrubbed existing rows (#1917).

Two mechanisms keep it true: a canary sweep plants three shape-less canaries — one per way the API learns a secret — and verifies none survive in any table or stdout (#1928), and the merge gate fails when a TEXT column is not classified scrubbed, exempt or pending (#1923).

Workflows now compose

A sub-workflow node lets a parent workflow start a child with explicit inputs, wait for it, and branch on its outcome (#2030). Re-executed steps reconnect to the existing child instead of spawning a second one.

QuickJS script executor (opt-in)

SCRIPT_EXECUTOR=quickjs runs scripts in a WASM worker pool instead of a subprocess per run (#1951). The pool size is configurable (#2037) and the executor is selectable from the dashboard (#2004). Opt-in: the default subprocess executor is unchanged.

Eight more ways to run agents

Native Cursor and Amp harnesses landed in v1.164.0 (#1882, #1883), plus a Grok CLI harness that runs on an API key (#1959). ACP targets for GitHub Copilot CLI (#1957) and Gemini CLI (#1956) are live now; Qwen, Kiro and Goose presets are on main and ship in the next release (#2067) — Kiro needs a paid KIRO_API_KEY.

One command to self-host

A curl | bash installer checks Docker and Compose, installs Bun, onboards you, waits for /health and prints the /setup link; --tunnel is optional (#2064, on main, ships in the next release). Workers wait for credentials instead of failing when none are present yet. The dashboard also ships as a standalone nginx image (#1943).

Improvements

• Workflows and automation — OpenAI and Cloudflare providers for system-one-decision nodes (#1945). An optional heartbeat gate script can skip quiet checklist ticks, in shadow mode by default (#2033), and the Lead boot-triage task is skipped on a clean boot (#1973). Scheduled script runs get a script_runs row (#2021); script connections can be hard-deleted (#2020); a script can send a task to its own agent (#2019); a slack-reply-gate extension ships as a catalog template (#2023). Extensions bridge approval, budget, email, Kapso and code-host events as post.* events (#1878), and approvals take their responder from the credential and enforce the approvers policy (#1854).
• Access and MCP — One-click Connect to ChatGPT via single-use connector codes: 10-minute validity, hash-only storage (#1903). SWARM_ENABLED_TOOLS sets an exact per-agent tool allowlist; unset keeps today's surface (#1989). The /connect confirm step is inline instead of a dialog (#1944), OpenRouter requests are attributed to Agent Swarm (#1995, #1996), and tool results get a per-channel budget, spill shape summaries and paged kv-get views (#1949).
• Slack, pages and dashboard — Durable Slack inbound receipts with explicit dispatch outcomes (#1606). An in-page feedback overlay sends element comments to the lead (#2039). The task detail page got a full overhaul on desktop and mobile (#1881), and page sessions get a guest principal (#1955). Skill usage and adoption surface in the dashboard (#2068, on main, ships in the next release).
• Evals and quality — Nightly and weekly eval schedules with regression checks and a Slack summary (#1768), a read-only publish-bundle endpoint for the weekly benchmark publish (#2046), and nightly canary caps sized from measured cost (#2041). CI is faster and stricter: tsgo typechecks and a lighter merge-gate (#1920), test durations and flakes tracked per run (#1986), faster slow tests (#2065), vendored anti-slop Oxlint rules in CI (#2038), and a show-me PR template with review map, risk and swarm provenance (#1937).

Bug Fixes

• Model pins survive resumes — Resumes and reboot retries keep the parent's model pin (#2052), and a resume keeps an explicit model alias that had fallen back next to a tier (#2053); both are on main and ship in the next release. Dated Claude model ids are accepted in harness family checks (#2002).
• Codex and Claude auth — Codex OAuth separates auth refresh from expiry timestamps (#1983); the legacy codex_oauth row counts as pool slot 0 (#1902); pool rows stay out of worker env (#1897); Codex reports the latest request as context, not the turn total (#1988). Claude seeds workspace trust for every session (#1899); pi accepts GEMINI_API_KEY (#1892) and honors presence-only credentials (#1960).
• ACP — Target configuration is validated before claiming tasks (#1981); the OpenRouter gateway is honored in the opencode target (#1992); the USD cost a target reports is recorded (#1896).
• Heartbeat and tasks — A Claude session stays live while it waits on background tasks (#2017); terminal statuses are excluded from heartbeat deduplication (#1909); worker output schemas stay off Lead follow-ups and Slack continuations (#1904); user MCP tasks route through the Lead (#1964); injected memories show outcome and date, and legacy auto-memories expire (#1963).
• Pricing and cost — Claude Haiku 5.5 rates are seeded (#1993); amp's dated snapshot ids collapse before the refresh insert (#1994); x402 concurrent payments can no longer overshoot the daily limit (#1885).
• Integrations and telemetry — Linear puts the session-opening comment in the task body (#1898); the Jira and Linear skills use OAuth bindings (#1929); background runs call back through the internal base URL (#1935); integration *_DISABLE flags parse with the shared env-flag parser (#1948); skill.invoke is recorded for every harness (#1894); self-hosted support links show correctly (#1936).

Migration Notes

• db-query now denies credential tables (#1915). Scripts that read them must use connections or credential bindings instead.
• With the new installer (on main, next release), onboard --yes no longer fails without a model credential — workers park in credential-wait until /setup supplies one.
• The QuickJS executor and SWARM_ENABLED_TOOLS are opt-in; defaults are unchanged.