Every release,
in plain terms.

Added

• Session-based dashboard access — the launcher opens the page with a one-time token in the URL; the page trades it for a session cookie, the token is wiped from the address bar, and the WebSocket handshake carries a 60-second single-use ticket instead of a process-lifetime password.
• A sandbox per room — chosen when the room is created and editable from the room itself. A room’s agents are confined to that folder.
• A command classifier for rooms — a model reads the intent a room’s agent declared next to the command it wants to run, and refuses the command when the two do not line up. Trust mode, broad-access mode and the result-review setting cannot exempt it. The switch lives in Settings → Permissions and is on by default.
• Per-command intents — run_command requires a description; process requires one when it starts a command.

Changed

• Sensitive-path reads, file listings, model listings and avatar uploads now require the dashboard session, as the other endpoints already did.
• A room turn no longer inherits security.always_allow_paths, trust mode, power_user_mode, or the automatic result review.
• Inside a room, a tool rated MEDIUM or above asks for confirmation even when the path is inside the sandbox.
• A sandbox escape approved from inside a room is granted once; “always allow” is neither offered nor honoured there.

Fixed

• A failed dashboard handshake no longer writes the credential it was given into the log.
• /api/scheduler/* answered without any authentication; it now requires the session like everything else.

Not included

• The classifier covers command tools only; file reads and edits inside a room are still governed by the sandbox and the risk thresholds.
• It applies to rooms only. Ordinary conversations, scheduled jobs and the terminal client keep the gates they already had.
• API keys remain in plain text on this machine, and the dashboard still hands the whole configuration to its own page.

Notes