Public tools: ten multifunction tools (workspace_plan is registered only outside Auto permission mode), with command, Git/GitHub, web and browser capabilities controlled by settings
Result protocol: agentic-workspace/v1
Pairs with: rootmonster/context-compressor 0.7.0+ (the approvals-aware protocol ships in the compressor release that accompanies this one)
Implemented
Verification
npm run check and npm run check:offline, natively on Windows: 290 tests, 286 passed, 0 failed, 4 skipped (the skips are POSIX-only cases). Live model runs and what they did or did not cover are recorded in RELEASE_VALIDATION.md; per-scenario tables are committed under live/results/.
Still unverified
Authenticated GitHub CLI mutation.
Launching a real browser through the optional module.
End-to-end compaction with a context compressor in one live chat.
macOS and Linux hosts.
Installation from the Hub (never published before this release).
Known boundaries
Process execution and browser automation are not operating-system sandboxes.
Multi-file commits use verified compensating restoration, not kernel-level atomicity.
Edit operations are UTF-8 text only; binary patching is not implemented.
Code discovery is ranked lexical chunk search — not embeddings, a vector database, AST analysis or an LSP.
Browser screenshots, upload/download management, reusable authenticated profiles and recordings are not implemented.
PDF/DOCX parsing, database query tooling, clipboard and notification tools, MCP bridging, and a custom side-by-side editor panel are outside this release.
No automatic retention or garbage-collection policy exists for artifacts.
Current status
Release
Version: 0.3.1
Stage: first public release
Public tools: ten multifunction tools (workspace_plan is registered only outside Auto permission mode), with command, Git/GitHub, web and browser capabilities controlled by settings
Result protocol: agentic-workspace/v1
Pairs with: rootmonster/context-compressor 0.7.0+ (the approvals-aware protocol ships in the compressor release that accompanies this one)
Implemented
Verification
npm run check and npm run check:offline, natively on Windows: 290 tests, 286 passed, 0 failed, 4 skipped (the skips are POSIX-only cases). Live model runs and what they did or did not cover are recorded in RELEASE_VALIDATION.md; per-scenario tables are committed under live/results/.
Still unverified
Authenticated GitHub CLI mutation.
Launching a real browser through the optional module.
End-to-end compaction with a context compressor in one live chat.
macOS and Linux hosts.
Installation from the Hub (never published before this release).
Known boundaries
Process execution and browser automation are not operating-system sandboxes.
Multi-file commits use verified compensating restoration, not kernel-level atomicity.
Edit operations are UTF-8 text only; binary patching is not implemented.
Code discovery is ranked lexical chunk search — not embeddings, a vector database, AST analysis or an LSP.
Browser screenshots, upload/download management, reusable authenticated profiles and recordings are not implemented.
PDF/DOCX parsing, database query tooling, clipboard and notification tools, MCP bridging, and a custom side-by-side editor panel are outside this release.
No automatic retention or garbage-collection policy exists for artifacts.
Permission modes (Manual / Plan / Auto) over every mutating action, with /accept and /deny in chat, durable approval records, and workspace_plan proposals.
Symlink-aware workspace containment, canonical-path protected globs (including Windows 8.3 short-name and NTFS alternate-data-stream aliases), and securely resolved .agentic/ storage.
Bounded tree listing, ranged reads, stat, literal/regex search, filename discovery and ranked lexical code discovery.
Multi-file transactional create, rewrite, exact replace, line splice, copy, move, delete and mkdir operations.
Scratchpad notes and a persistent .agentic/MEMORY.md through workspace_notes.
Persistent To-Do boards with priorities, dependencies, blockers, decisions, evidence, checkpoints and next-action recovery.
Structured foreground/background command execution with allowlists, timeouts, cancellation, output caps, durable logs, and Windows .cmd shim resolution to node <script>.
Git and GitHub CLI workflows for init, status, diff, log, show, staging, commits, branches, pushes, issues and pull requests, with ref and remote validation.
Bounded web search and fetch through DuckDuckGo HTML, Wikipedia or a configured SearXNG endpoint, with source ledgers, SSRF defences, and permission-mode gating of egress.
Durable deep-research projects with queries, fetched-source snapshots, sourced notes, reports and agent-run linkage.
Optional persistent Chromium automation for JavaScript-heavy pages, with request interception and separately gated JavaScript evaluation.
Durable pass-based coding, research and general sub-agent runs with bounded state reconstruction.
Retention facts and artifacts shaped for a context compressor that understands agentic-workspace/v1.
.agentic/
Approvals are scoped to a workspace, not to a chat; every record expires 24 hours after it is created.
Permission modes (Manual / Plan / Auto) over every mutating action, with /accept and /deny in chat, durable approval records, and workspace_plan proposals.
Symlink-aware workspace containment, canonical-path protected globs (including Windows 8.3 short-name and NTFS alternate-data-stream aliases), and securely resolved .agentic/ storage.
Bounded tree listing, ranged reads, stat, literal/regex search, filename discovery and ranked lexical code discovery.
Multi-file transactional create, rewrite, exact replace, line splice, copy, move, delete and mkdir operations.
Scratchpad notes and a persistent .agentic/MEMORY.md through workspace_notes.
Persistent To-Do boards with priorities, dependencies, blockers, decisions, evidence, checkpoints and next-action recovery.
Structured foreground/background command execution with allowlists, timeouts, cancellation, output caps, durable logs, and Windows .cmd shim resolution to node <script>.
Git and GitHub CLI workflows for init, status, diff, log, show, staging, commits, branches, pushes, issues and pull requests, with ref and remote validation.
Bounded web search and fetch through DuckDuckGo HTML, Wikipedia or a configured SearXNG endpoint, with source ledgers, SSRF defences, and permission-mode gating of egress.
Durable deep-research projects with queries, fetched-source snapshots, sourced notes, reports and agent-run linkage.
Optional persistent Chromium automation for JavaScript-heavy pages, with request interception and separately gated JavaScript evaluation.
Durable pass-based coding, research and general sub-agent runs with bounded state reconstruction.
Retention facts and artifacts shaped for a context compressor that understands agentic-workspace/v1.
.agentic/
Approvals are scoped to a workspace, not to a chat; every record expires 24 hours after it is created.