v0.21.0

Added

• openswarm work [issueIds...] — explicit issue-selection fan-out. Pick Linear issues directly (by id, or interactively with a checkbox picker) and deploy one agent per issue into an isolated git worktree, running the full worker→reviewer pipeline in parallel and delivering tracker completions itself. Replaces "point the daemon at a repo and let it choose" as the primary workflow now that the autonomous heartbeat defaults off. Honors openswarm.json automation policy (enabled/limits), skips issues with unresolved blockers or a mismatched Linear project mapping, dedupes against the shared run ledger (so a concurrently running daemon never double-executes), and supports --dry-run, --concurrency, --adapter, --json, and SIGINT-safe cancellation.
• Explicit issue dispatch in the daemon. POST /api/work + GET /api/work/issues + GET /api/work/projects let a UI hand the daemon a set of issues to fan out (In Progress claim before queueing, duplicate/rollback safety, work:queued SSE event) without the decision engine involved. With autonomous.enabled: false the runner now starts in explicit-dispatch mode: durable recovery and dispatch work, but no heartbeat loop.
• GET /api/health — unauthenticated daemon identity endpoint (status/app/version/instance/pid/uptime) compatible with the vega BackendHealth contract, served ahead of both auth gates.
• Static issue board at /app. A new vanilla-JS screen (repo picker → issue checkboxes → deploy → live pipeline-stage cards over SSE) served from web/static/, alongside the legacy dashboard. GitHub-dark token stylesheet as the single design-token source.
• macOS desktop app (phase 1). desktop/ — a thin Tauri v2 shell for the local daemon, ported from vega-agent's client flavor: real-log boot splash, health-identity gating (an arbitrary HTTP 200 on the port is not "the daemon"), PID-watching auto-reconnect across launchd restarts, tray + settings (server URL with shell-side connection test, close-to-tray), launchctl kickstart daemon restart, and strict origin trust — privileged IPC is capability- and sender-origin-gated, with no remote IPC capability granted at all. Build with scripts/build-desktop.sh (not part of the npm package).

v0.20.10

Added

• openswarm pr review --all. Reviews every open PR in the repo sequentially instead of just the current branch's PR / --number, combinable with --fresh. Fork PRs are skipped (with a per-PR note) under feedback re-application since that path can only fetch same-repo branches — use --fresh, which works for forks too. A --repo that doesn't match the checkout's own origin refuses upfront rather than fetching from the wrong remote.

v0.20.9

Added

• openswarm pr review --fresh. Runs a brand-new code review of the PR's current diff — the same reviewer openswarm review uses locally — instead of only reacting to feedback a reviewer already left, and posts the verdict as a PR comment naming the exact commit reviewed. Reviews inside a scratch git worktree at the PR/base merge-base, in read-only mode (the PR's contents are untrusted), so nothing under the caller's own checkout is ever touched.

v0.20.8

Added

• openswarm pr review. A new PR autopilot action that re-applies outstanding review feedback on demand — including comments left by Codex-based review actions, which formal CHANGES_REQUESTED-only detection previously missed entirely alongside Claude's. Sits next to status/fix/watch/create; skips conflict handling and CI waits, so it's safe to run as a lightweight "did a reviewer leave feedback I haven't addressed yet?" check.

v0.20.7

Fixed

• Worktree fan-out now survives durable admission. 0.20.6 intentionally omitted conflictScope when isolated worktrees should use capacity-only admission, but the ledger interpreted the omitted value as an unknown scope and failed closed as soon as one worker was active. The scheduler briefly started eight issues and the ledger immediately superseded seven, making the dashboard look single-threaded. Omitted scope now bypasses scope serialization while an explicitly supplied empty or unknown scope still fails closed. Verified live with eight KYTE-Portal issues simultaneously in EXECUTING state.

v0.20.6

Added

• Autonomous work now fans out by issue into isolated worktrees. With worktreeMode and same-project concurrency enabled, one project can fill the global worker pool (up to 32) even when issues touch overlapping files. Integration conflicts remain a PR/rebase concern instead of silently serializing execution.
• Draft analysis grooms duplicate Linear issues before implementation. The drafter compares an issue with open peers in the same project and creates Linear's native duplicate relation only when confidence is at least 90%, two concrete overlap signals are present, and the canonical issue is older. Ambiguous overlap continues to the worker unchanged.
• The web dashboard accepts direct Tailscale access. Trusted tailnet addresses can reach the dashboard while loopback and explicit host protections remain intact.

Fixed

• Provider switches and restarts no longer leak stale model ids or quota pauses. Startup normalizes role models for the configured provider, an explicit switch clears only provider-quota retries, and the daemon persists the selected adapter. Codex PKCE-backed codex-responses can therefore resume work without inheriting incompatible OpenRouter pins.
• Durable automation recovers cleanly across daemon replacement. Shutdown cancellations, expired owners, retry claims, preserved worktrees, and superseded runs now reconcile without turning transient process replacement into permanent STUCK state.
• Pair stagnation gets a bounded fresh-context retry. A repeated response or revision ends the current pair session but no longer immediately consumes the entire outer retry budget.
• Verification and Git/worktree ownership checks are more reliable. Verification paths are normalized, worker commits preserve issue authority, existing PR ownership prevents duplicate publication, and worktree preservation carries actionable failure evidence into the next attempt.

v0.20.5

Release v0.20.5

v0.20.4

Fixed

• .env credentials that only exist in the global ~/.config/openswarm/.env are no longer invisible to repos with their own local .env. loadEnvFile() returned as soon as it found the first .env file on its search path, so a project whose own .env predates a credential added later to the global file never even read that file. ATLAS_CLOUD_API_KEY is global-only, so openswarm review --max run from a repo with its own .env (predating Atlas Cloud) failed every subagent auth instantly, project-wide, while the identical command worked from a repo whose .env already had every key. It now layers every file on the search path, applying each key only when not already set by shell env or an earlier, more specific file. (INT-3256)

v0.20.3

Fixed

• Switching provider to atlascloud no longer 400s on every review and worker call. mapModelForProvider special-cased codex/codex-responses and claude, but every other adapter — including atlascloud — fell into the generic "any vendor/model-shaped id survives" branch it shares with openrouter/gpt/local/lmstudio. OpenRouter and Atlas Cloud both name models vendor/model, but with different catalogs (OpenRouter's z-ai/glm-5.2 vs Atlas's own zai-org/GLM-4.6), so a role configured for OpenRouter kept its model id verbatim on a switch to atlascloud and every call to api.atlascloud.ai 400'd "not found" — confirmed live against the real API. It now checks membership against Atlas's curated model list and live catalog cache, in both directions, so a switch away from atlascloud can't leak its ids into OpenRouter either. (INT-3246)

v0.20.2

Three fixes to the CI review gate, all found by running it rather than reading it. Each is the same failure in a different place: the gate produced a confident verdict while something it needed was missing.

Fixed

• The reviewer is given the diff. buildReviewerPrompt handed direct mode only a list of changed filenames — its own comment said direct mode "reviews a Git diff supplied by a user/CI checkout", but no diff was ever supplied. In working-tree mode an agent can recover the rest with bash; under --read-only it cannot, and in --base mode there is nothing in the working tree to recover, because reading a file shows the result of a change and never the change. Those two flags together are what the GitHub Action passes, so the flagship CI path was reviewing blind — a real run said so in its own feedback ("I cannot determine the actual diff… the .git directory is not accessible") and returned a verdict anyway. The diff now travels in the prompt, bounded at 200KB and explicit when it truncates. (#375)
• search_files no longer loses its capability silently. It shells out to ripgrep, which a hosted runner may not have; every search then failed with ENOENT, the agent stopped searching, and it reviewed the diff without reading the code around it — while still returning approve. It falls back to git grep now, and when neither is available it says the search was unavailable and that this is not "no matches", because the quiet failure is the one that gets read as evidence of absence. The bundled action installs ripgrep so the fast path is used. (#373)
• A failing gate says why. --json suppresses the human report by design and SARIF carries only findings that have a file and line, so a revise reached the job log as a single word with its reasoning nowhere. The action now renders decision, feedback, issues, suggestions and follow-ups into the step log and the GitHub job summary. That text comes from a model that just read an untrusted diff, so it is written inside a ::stop-commands:: fence with an unpredictable token — otherwise injected prose could forge annotations or silence the rest of the step. (#374)