deepagent-ltd · lxrzlyr · Jul 19, 2026 · Jul 17, 2026 · Jul 19, 2026 · Jul 19, 2026
diff --git a/.gitignore b/.gitignore
@@ -13,7 +13,7 @@ tmp
 dist
 ts-dist
 .turbo
-# Web/edge build artifacts (nitro .output, cloudflare .wrangler) — e.g. packages/console, packages/stats
+# Web/edge build artifacts (nitro .output, cloudflare .wrangler) - e.g. packages/console, packages/stats
 .output
 .wrangler
 packages/console/app/public/sitemap.xml

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,65 @@
 # Changelog
 
+## V4.0.4 - Contract-gap closure (engine-decoupled)
+
+- Fix Plan Gate deadlock: stale-plan latch now warns (never hard-blocks) on tool execution, aligned with codex exec-policy philosophy. A mutating tool on a stale plan receives a reminder but always runs.
+- Fix goal-loop scorer false positives: `extractValidationResults` now scopes extraction to declared validation commands only (toolCallId→command mapping), with latest-wins per command. Diagnostic bash calls no longer poison the score.
+- Fix cancel/loop test flake: `maxRetries:0` in the test provider config prevents AI SDK exponential-backoff retries against the intentionally-dead test URL; per-test budgets raised from 3 s to 15 s.
+- Release Desktop 1.4.2 with DeepAgent Core V4.0.4.
+- Publishing truth: fix quick-start command (`deepagent-code run`), comment out unpublished npm install, unify domain to `deepagent.ltd`, replace `lessweb`/`anomalyco` org handles, update SECURITY.md supported-version line and M-CRED status, update CHANGELOG.
+
+## V4.0.3 - Upstream kernel alignment (AppNode foundation)
+
+- AppNode foundation: additive node export layer aligning with upstream opencode V2 session architecture.
+- DocumentStore concurrency-safe durable body (F30-1): atomic CAS writes, version conflicts, recovery.
+- Plan single source of truth (I33-1): goal path and tool path write one plan document; DocumentStore is the authority.
+- safeGit hardening (I33-5): `--no-ext-diff --no-textconv` added to all read-path git calls; hook execution disabled via `core.hooksPath=/dev/null`; clean/smudge/process filters never invoked on read-only paths.
+
+## V4.1 - Steering + plan hot-edit
+
+- Steering foundation (S1.1): absorb mid-turn user input at the next turn boundary without aborting the current turn.
+- Goal plan hot-edit (S1.2): update plan steps while a goal loop is running; orphan-doc bug fixed (upsert-by-description → updateWithProvenance by-id).
+- Cache regression fix: DeepAgent gateway no longer bakes per-round volatile state (round number, budget, previous results) into the system prefix, preserving prompt cache across intra-turn calls.
+- Subagent panel and session fork lineage: forks use `metadata.forkedFrom`; depth cap 3; derived-from banner and folder-tree nesting.
+
+## V4.0 - Event-driven paradigm
+
+- Event-driven Agent OS: durable events, priority routing, backpressure, worker claims, leases, handoffs, retries, dead-letter recovery.
+- Consumer-driven goals: `goal.tick.requested` claims and executes one idempotent tick, records facts, schedules next tick when goal remains eligible.
+- V4.0-beta closeout: producer-starvation fix, security fails-closed, half-wired consumers wired. Autonomous path live in production.
+- V4.0.1 long-task design: soft-landing compression (P0), World State responsibility separation (P1), budget hot-swap without restart (P2), idempotent + per-model output (P3). Four feature flags. Fully verified.
+- Plan gate P0+P1: plan-stale signals all degrade to warn; U9 per-step binding retains hard block with grace release.
+- CLI ↔ GUI parity: full legacy server surface mounted on new CLI daemon; sessionClient wrapper seam.
+- Config data-root unification: global config moved from `~/.config/deepagent-code` to `~/.deepagent/code/config.jsonc` (claude/codex style).
+- Zero-config provider: add third-party provider with URL + key; protocol auto-detect; model discovery from `/models`.
+
+## V3.9 - Repo/Wiki + Expert Panel + Goal Loop
+
+- Repo and Wiki integration: session archive, wiki-backed knowledge, cross-session search.
+- Expert Panel: chat-button convenes a panel of domain experts; `panel.consult` tool.
+- Goal Loop: `goal_driver.ts` drives multi-step autonomous goals; goal-tick event pipeline.
+- AST code-graph: tree-sitter based symbol graph for semantic navigation.
+- Subagent plan permissions: plan-write capability gating per subagent.
+- Adversarial review wave: 20-file fix commit; flag-gating, budget-ceiling, anonymization, leaf-calls, sealed-leak all fixed; Arbiter + security boundary verified.
+- Cache hit regression root cause: volatile per-round state in system prefix → fixed by moving it out of the cached prefix.
+
+## V3.8 - V4.0 pre-release foundation
+
+- Session-internal scheduler: all sub-agent execution driven via `SessionPrompt.Service`; no-op stack replaced.
+- Context wiring: full context assembly pipeline connected end-to-end.
+- Sub-agent strength levels: permission presets per agent mode.
+- Mode redesign: codex-aligned auto/loop/design modes; flag kill-switch; permission presets.
+- Server mode connection: desktop→Server Edition gateway; wire contract; client code map.
+
+## V3.5 - M-CRED secure secret storage
+
+- Secrets stored in OS-backed secret storage: macOS Keychain (production), Linux Secret Service and Windows Credential Manager stubs with 0600-file fallback.
+- MCP credential values no longer persist in plain-text configuration; only variable names or references travel through config.
+- Credential migration: existing stored secrets migrated to the new store on first launch.
+- PTY and terminal fixes: stale-worktree redirect, terminal split circular-tree bug.
+- Archived sessions: restore, unarchive, delete operations.
+- Stale worktree redirect: same-repo clones share one project row; `fromDirectory` now returns live clone dir.
+
 ## V3.4.1 - Public release hardening
 
 - Switch project license to AGPL-3.0-or-later.

diff --git a/README.md b/README.md
@@ -14,7 +14,7 @@
   <a href="https://github.com/deepagent-ltd/deepagent-code-enterprise">Enterprise</a>
 </p>
 
-<p align="center"><sub>Desktop 1.4.1 · DeepAgent Core V4.1</sub></p>
+<p align="center"><sub>Desktop 1.4.2 · DeepAgent Core V4.0.4</sub></p>
 
 ---
 
@@ -91,22 +91,25 @@ For high-risk decisions, convene an **Expert Panel**. Correctness, security, per
 
 Project IM brings people and agents into the same thread. Mention an agent to start a scoped run with project context, stream its progress, inspect its artifacts, and keep the answer attached to the conversation that requested it.
 
-## DeepAgent Core V4.1
+## DeepAgent Core V4.0.4
 
-V4.1 brings the complete DeepAgent control plane together:
+V4.0.4 closes production contract gaps while keeping the current turn engine stable:
 
-- **Durable Session V2:** prompt admission is persisted before execution; exact retries do not duplicate user intent; same-session wakes coalesce safely.
-- **One provider-turn contract:** native and AI SDK providers share the same budget, permission, artifact, audit, learning, and close lifecycle.
-- **Single durable truth:** DocumentStore owns documents, plans, learning candidates, governance state, and version conflicts through atomic, recoverable writes.
-- **Event-driven Agent OS:** durable events, priority routing, backpressure, worker claims, leases, handoffs, retries, dead-letter recovery, and distributed placement coordinate autonomous work.
-- **Consumer-driven goals:** `goal.tick.requested` claims and executes one idempotent tick, records facts, and schedules the next tick only when the durable goal remains eligible.
-- **Human oversight:** approval queues, trace correlation, takeover, rollback, Wiki archives, notifications, and organization/workspace isolation remain part of the execution path.
-- **Secure integrations:** MCP credentials use environment references or native OS secret storage; catalog risk, runtime permissions, trusted sources, and tool capability checks fail closed.
+- **Single durable truth:** DocumentStore uses atomic, recoverable writes for documents, plans, learning candidates, governance state, and version conflicts.
+- **Isolated subagents:** write-capable subagents use dedicated worktrees by default and return their changes to the parent workspace through a bounded, conflict-aware path.
+- **Reliable event delivery:** the Event Bus has a transport seam, durable consumer offsets, offline catch-up, real priority ordering, and observable queue depth.
+- **Governed learning and goals:** knowledge promotion is tied to review evidence and ship-gate snapshots; event-driven goal ticks remain idempotent and respect quiet hours.
+- **Secure integrations:** MCP credentials use environment references or native OS secret storage on macOS, Linux, and Windows; capability and source checks fail closed.
+- **Publishing truth:** installation, CLI examples, release metadata, public domains, and supported-version documentation match the product that is actually shipped.
 
 ## Installation
 
+> **Note:** The `deepagent-code` npm package is not yet publicly published.
+> Install via the desktop app or the install script below.
+
 ```bash
-npm install -g deepagent-code
+# Install script (macOS / Linux)
+curl -fsSL https://deepagent.ltd/install | bash
 ```
 
 Then run:
@@ -183,7 +186,7 @@ reference (base URL overrides, headers, per-model config, gateways).
 Start the agent and give it a task:
 
 ```bash
-deepagent-code "add rate limiting to /api/users endpoint"
+deepagent-code run "add rate limiting to /api/users endpoint"
 ```
 
 The agent will:

diff --git a/README.zh.md b/README.zh.md
@@ -14,7 +14,7 @@
   <a href="https://github.com/deepagent-ltd/deepagent-code-enterprise">Enterprise 版本</a>
 </p>
 
-<p align="center"><sub>桌面版 1.4.1 · DeepAgent Core V4.1</sub></p>
+<p align="center"><sub>桌面版 1.4.2 · DeepAgent Core V4.0.4</sub></p>
 
 ---
 
@@ -91,22 +91,25 @@ DeepAgent 可以把独立工作拆分给数量有界、相互隔离的 Worker。
 
 项目 IM 把团队成员和智能体放进同一条讨论。@ 某个智能体即可启动有明确作用域的运行，使用项目上下文、流式展示进度、关联执行工件，并把答案留在发起任务的对话里。
 
-## DeepAgent Core V4.1
+## DeepAgent Core V4.0.4
 
-V4.1 把完整的 DeepAgent 控制平面汇聚在一起：
+V4.0.4 在保持当前 turn 引擎稳定的前提下，关闭生产合同缺口：
 
-- **持久 Session V2：** prompt 先持久准入、再调度执行；精确重试不会复制用户意图；同一 Session 的唤醒会安全合并。
-- **统一供应商轮次合同：** native 与 AI SDK provider 共享预算、权限、工件、审计、学习和关闭生命周期。
 - **单一持久真相：** DocumentStore 通过原子、可恢复写入统一管理文档、计划、学习候选、治理状态和版本冲突。
-- **事件驱动 Agent OS：** 持久事件、优先级路由、回压、Worker claim、租约、handoff、重试、死信恢复与分布式 placement 协调自主工作。
-- **消费者驱动 Goal：** `goal.tick.requested` 每次认领并执行一个幂等 tick，记录事实，并只在持久目标仍满足条件时调度下一 tick。
-- **人类监督：** 审批队列、全链路 trace、接管、回滚、Wiki 档案、通知，以及组织和 workspace 隔离始终位于执行路径上。
-- **安全集成：** MCP 凭据使用环境变量引用或原生操作系统 secret storage；目录风险、运行时权限、可信来源和工具 capability 逐层失败关闭。
+- **隔离子智能体：** 具备写权限的子智能体默认使用独立 worktree，并通过有界、可感知冲突的路径把改动回传到父工作区。
+- **可靠事件投递：** Event Bus 提供可替换 transport、持久 consumer offset、离线补投、真实优先级排序和可观测队列深度。
+- **受治理的学习与目标：** 知识晋升关联审阅证据与 ship-gate snapshot；事件驱动 goal tick 保持幂等并遵守 quiet hours。
+- **安全集成：** MCP 凭据使用环境变量引用或 macOS、Linux、Windows 原生 secret storage；capability 与来源检查逐层失败关闭。
+- **发布真实性：** 安装方式、CLI 示例、发布元数据、公开域名和支持版本文档与实际交付产品一致。
 
 ## 安装
 
+> **说明：** `deepagent-code` npm 包尚未公开发布。
+> 请通过桌面应用或下面的安装脚本安装。
+
 ```bash
-npm install -g deepagent-code
+# 安装脚本（macOS / Linux）
+curl -fsSL https://deepagent.ltd/install | bash
 ```
 
 然后运行：
@@ -178,7 +181,7 @@ deepagent auth list
 启动智能体并交给它一个任务：
 
 ```bash
-deepagent-code "为 /api/users 端点添加限流"
+deepagent-code run "为 /api/users 端点添加限流"
 ```
 
 智能体将会：

diff --git a/SECURITY.md b/SECURITY.md
@@ -8,7 +8,7 @@ Do not include live secrets in reports. Use redacted examples or synthetic crede
 
 ## Supported versions
 
-Before the first public stable tag, the supported line is the current `main` branch and the latest published pre-release. Security fixes may be released as patch versions.
+The active development line is the `dev` branch. The supported release is the latest published version on the `core-v4.0-beta` branch and the desktop app release derived from it. Security fixes are applied to the active line and backported to the latest release where feasible.
 
 ## Source availability
 
@@ -20,13 +20,13 @@ Preset MCP servers are opt-in. The preset catalog records intended risk tiers, b
 
 Read-only database presets are intended to use restricted server modes and SQL guardrails. Guardrails are defense in depth, not a substitute for least-privilege database users.
 
-## Known limitation: preset MCP credentials in V3.4.1
+## MCP credential security (V4.0+)
 
-When enabling preset MCP servers that require credentials, credential values may currently be persisted in local configuration. Until V3.5 M-CRED lands:
+As of V4.0, MCP server credentials are stored in OS-backed secret storage where available (macOS Keychain; Linux and Windows fall back to a 0600 file). Credential values are not persisted in plain-text configuration. Only variable names or references travel through config files; values are resolved at runtime.
+
+If you are running a version older than V4.0:
 
 - Do not commit DeepAgent Code configuration files containing secrets.
 - Prefer environment-variable indirection where a server supports it.
 - Use least-privilege tokens and database users.
 - Rotate credentials if they were accidentally committed or shared.
-
-The planned V3.5 M-CRED work stores secrets in OS-backed secret storage where available (macOS Keychain, Windows Credential Manager, Linux Secret Service), passes only variable names or references through configuration, and resolves values at runtime.
diff --git a/bun.lock b/bun.lock