Home > MCP Servers > claw-pilot

claw-pilot

Multi-agent orchestration runtime with task board, flow engine, budget control, MCP integration and real-time dashboard. Self-hosted on Linux/macOS.

agent-orchestration agentic ai-agents anthropic claude dashboard llm llm-agent typescript

Description

Multi-agent orchestration runtime with task board, flow engine, budget control, MCP integration and real-time dashboard. Self-hosted on Linux/macOS.

README

claw-pilot

CLI + web dashboard to orchestrate multi-agent clusters on a Linux or macOS server

claw-pilot v0.69.0 manages the full lifecycle of claw-runtime agent instances: provisioning, service integration, visual Agent Builder, inter-agent messaging, middleware pipeline, named API keys, user profiles, budget enforcement, dynamic model discovery, task board with epic hierarchy, workflow orchestration, and a real-time dashboard to monitor and interact with multi-agent teams.

All instances use the claw-runtime engine — a native Node.js multi-agent runtime with built-in support for Agent-to-Agent (A2A) messaging, heartbeat scheduling, MCP integration, permissions system, memory management, middleware chain, and plugin architecture.

Installed from source only (/opt/claw-pilot or custom path via CLAW_PILOT_INSTALL_DIR).

Questions → Discussions (Q&A) · Bugs / Tasks → Issues · Ideas → Discussions (Ideas)

Features

Instance Management

Provision — interactive wizard to create new claw-runtime instances with auto Nginx + SSL config
Discovery — auto-detect existing instances on the server
Lifecycle — start, stop, restart, destroy instances (PID daemon-based control)
Health monitoring — real-time status via WebSocket, health checks, detailed logs

Agent Builder & Teams

Visual canvas — drag-and-drop to design multi-agent teams with live preview
Agent-to-Agent (A2A) — spawn links between agents, configure permissions and lifecycle modes
Blueprints — save reusable agent team templates, deploy to any instance
Team export/import — manage agent configurations as JSON/YAML for version control

Runtime Features

Permanent sessions — primary agents get a single persistent session shared across all channels (web, Telegram, CLI)
Inter-agent messaging — send_message tool for persistent cross-agent communication (synchronous or fire-and-forget with async processing)
Middleware pipeline — extensible pre/post middleware chain in the message processing pipeline (guardrail, tool error recovery)
Task board — Kanban board with 5 status columns, drag & drop, agent assignment with wakeup, epic hierarchy (parent-child goals), activity timeline, auto-completion
Workflow orchestration — declarative DAG-based workflow engine with fan-out/fan-in, per-step timeout & retry, SITREP extraction, session persistence (FLOW-001)
Heartbeat scheduling — per-agent background ticks with configurable intervals, timezone-aware active hours, permanent session reuse
MCP integration — discover and manage MCP servers per instance, real-time tool registry
Permission system — interactive approval for file access, bash execution, agent spawning
Memory management — context window compaction with FTS5 search on workspace files
Plugin system — extensible hooks for tool registration, session lifecycle, message interception
Named API keys — centralized AES-256-GCM encrypted key management, assignable to instances and agents
User profiles — per-user preferences (language, timezone, communication style, custom instructions)
Agent archetypes — 6 built-in templates (analyst, communicator, evaluator, generator, orchestrator, planner)
Budget enforcement — per-instance/agent monthly or lifetime limits, soft alert (80%), hard stop (100%), auto-pause, Telegram notifications
Dynamic model discovery — real-time model discovery from 8 provider APIs with polling, caching, and DB persistence

Dashboard & Tooling

Home screen — chatbot-styled entry point with system instance auto-provisioning, setup wizard, and 22-tool admin plugin (HOMEBOT)
Web dashboard — real-time status dashboard, agent builder, settings, device pairing (port 19000)
Command palette — global search (Cmd+K / Ctrl+K) across instances, agents, tasks, blueprints with FTS5 BM25 ranking
Runtime Pilot — multi-agent chat with tool call visualization, token/cost tracking, context panel, session tree
Cost dashboard — per-agent cost tracking with SVG charts + budget management tab
Activity console — live event stream (SSE) with filters and floating widget
Memory browser — browse and search agent memory files with decay scores
Heartbeat heatmap — SVG heatmap of multi-agent heartbeat activity
Agent templates — standalone reusable agent templates with archetype system, import/export YAML
Named keys panel — manage encrypted API keys, assign to instances/agents
Profile settings — user preferences, communication style, custom instructions
Permission overlay — real-time permission request/approval from dashboard
Inline file editor — edit agent workspace files (SOUL.md, AGENTS.md, MEMORY.md…) in the UI
Self-update — update to latest release via CLI or dashboard banner
i18n — UI available in 6 languages (EN, FR, DE, ES, IT, PT)

Requirements

Node.js >= 22.12.0
pnpm >= 9
Linux (Ubuntu/Debian recommended) with systemd user services
- OR macOS with launchd integration (M1/M2/M3/M4/M5 arm64 or Intel)
Bash >= 5.0 for installation scripts

Install

curl -fsSL https://raw.githubusercontent.com/swoelffel/claw-pilot/main/install.sh | sh

Clones the repo to /opt/claw-pilot (override with CLAW_PILOT_INSTALL_DIR), builds the CLI, and links the binary into your PATH.

CLI commands

claw-pilot [command]

Instance Management:
  init              Initialize claw-pilot & discover existing instances
  create            Create a new instance (interactive wizard)
  list              List all instances with status
  status <slug>     Show detailed status of an instance
  destroy <slug>    Destroy an instance (stops service, removes files)

Instance Lifecycle:
  start <slug>      Start an instance
  stop <slug>       Stop an instance
  restart <slug>    Restart an instance

claw-runtime:
  runtime start <slug>        Start a claw-runtime instance (--daemon for background)
  runtime stop <slug>         Stop a claw-runtime instance
  runtime restart <slug>      Restart a claw-runtime instance
  runtime logs <slug>         View runtime logs (-f for live tail)
  runtime config <slug>       Show/edit runtime.json debug snapshot (DB is source of truth)
  runtime chat <slug> [msg]   Interactive chat with an agent

Tooling:
  dashboard         Start the web dashboard (default port 19000)
  token <slug>      Show instance token (--url for full URL, --open to launch browser)
  doctor [slug]     Diagnose instance health (PID, config, workspace files)
  logs <slug>       View instance logs (-f for live tail)
  update            Update claw-pilot to the latest release
  team              Export / import agent team configurations

Authentication & Service:
  auth              Setup / reset / check dashboard authentication
  service           Install / uninstall / restart dashboard system service (systemd/launchd)

Configuration:
  config get <key>  Get a global config value
  config set <key> <value>  Set a global config value

Web Dashboard

claw-pilot dashboard
# → http://localhost:19000  (login required, user: claw-pilot, auto-generated password)

Screens

Screen	Purpose
Home	Chatbot entry point with system instance, setup wizard, admin flows
Instances	Live status cards (health, port, agent count) with lifecycle actions
Task Board	Kanban board with drag & drop, epic hierarchy, agent assignment, activity timeline
Flows	Workflow editor, run history, step-by-step execution detail
Agent Builder	Visual canvas per instance — design teams with drag-and-drop, A2A/spawn links
Blueprints	Create, edit, deploy reusable agent team templates
Agent Templates	Standalone reusable agent templates with archetype system
Runtime Pilot	Multi-agent chat — tool calls, token usage, context panel, session tree
Session Logs	Browse session history, messages, system prompt snapshots
Settings	Per-instance configuration: general, agents, runtime, devices, MCP, permissions, named keys
Cost Dashboard	Per-agent cost tracking with SVG charts + budget management
Activity Console	Live event stream with real-time filters
Memory Browser	Browse and search agent memory files with decay scores
Heartbeat Heatmap	SVG heatmap of multi-agent heartbeat activity and scheduling
Profile Settings	User preferences, communication style, custom instructions

Architecture

src/
  commands/         CLI commands — thin wrappers over core/ (17 commands incl. auth, service)
  core/             Business logic (registry, discovery, provisioner, agent-sync, blueprints, …)
    repositories/   20 SQLite repositories (server, instance, agent, port, config, event,
                    blueprint, agent-blueprint, runtime-session, rt-event, cost, heartbeat,
                    named-key, runtime-config, user-profile, budget, task, task-activity, search, flow)
    model-discovery/ Dynamic model discovery service (8 provider adapters, polling, DB persistence)
  dashboard/        Hono HTTP server + WebSocket monitor + auth (sessions/cookies)
    routes/         REST API (~139 endpoints) + WebSocket
  db/               SQLite schema and migrations (schema.ts) — current version: 34
  lib/              Utilities (logger, errors, constants, platform, xdg, shell, …)
  runtime/          claw-runtime engine
    bus/            Event bus (pub/sub)
    channel/        Message channels (web-chat, Telegram, internal)
    config/         Runtime configuration types and loaders
    engine/         Engine bootstrap, config builder, plugin wiring
    middleware/     Pre/post middleware pipeline (guardrail, tool error recovery)
    permission/     Permission ruleset (wildcard glob matching, last-match-wins)
    profile/        User profile resolution (community resolver)
    provider/       LLM provider resolution and auth profiles
    session/        Prompt loop, message handling, compaction, system prompt
    tool/           Built-in tools + send_message + task delegation
    flow/           Declarative DAG workflow engine (FLOW-001)
    agent/          Agent defaults, registry, kind resolution
    plugin/         Plugin system (hooks, types)
    mcp/            MCP client integration
    memory/         Memory indexing, decay, search tool
    heartbeat/      Heartbeat scheduling and execution
  server/           ServerConnection abstraction (LocalConnection; SSH planned)
  wizard/           Interactive creation wizard (@inquirer/prompts)
ui/src/
  components/       54+ Lit web components (home screen, instance cards, agent builder, pilot, task board, flows, …)
    pilot/          Runtime Pilot subcomponents (messages, parts, context, input, header)
  services/         Auth state, WS monitor, router, update poller
  locales/          i18n via @lit/localize (6 languages)
  styles/           Design tokens, shared CSS
templates/
  archetypes/       6 agent archetype templates (analyst, communicator, evaluator, …)
  blueprints/       3 built-in team blueprints (design-studio, dev-harness, team-architect)
  workspace/        Workspace bootstrap files (SOUL.md, IDENTITY.md, AGENTS.md, …)

Data Model

SQLite ~/.claw-pilot/registry.db — schema v34. See docs/registry-db.md.

claw-pilot registry (instance management):

Table	Role
`servers`	Physical servers (always 1 local row in v1)
`instances`	Instances — slug, port, state, runtime_config_json, default_named_key_id
`agents`	Agents per instance/blueprint — canvas position, skills, config_json, named_key_id
`agent_files`	Workspace file cache (SOUL.md, AGENTS.md, MEMORY.md…)
`agent_links`	A2A spawn links and tool dependencies between agents
`blueprints`	Reusable agent team templates with canvas layouts
`agent_blueprints`	Standalone reusable agent templates
`agent_blueprint_files`	Workspace files per agent blueprint
`named_api_keys`	AES-256-GCM encrypted API keys (admin-global)
`ports`	Port reservation registry (avoid conflicts)
`config`	Global key-value configuration
`events`	Audit log per instance (creation, modification, deletion)
`users` / `sessions`	Dashboard user accounts + HTTP session auth
`user_profiles`	Per-user preferences (language, timezone, communication style)
`rt_budgets`	Per-instance/agent budget limits (monthly/lifetime, soft alert, hard stop)
`rt_budget_events`	Budget audit trail (alerts, overrides, resets)
`discovered_models`	Models discovered from provider APIs (cached, with capabilities + cost)
`discovery_status`	Provider discovery status (last success/error, model count)
`rt_tasks`	Task board — title, status (5 states), priority, assignee, labels, position, type (task/epic), parent_id
`rt_task_comments`	Task discussion threads (author, content, timestamps)
`rt_task_activities`	Activity timeline per task (9 types: created, status_changed, assigned, etc.)
`search_index`	FTS5 global search index (instances, agents, tasks, blueprints)
`rt_flow_definitions`	Workflow definitions — name, steps DAG (JSON), trigger config, enabled
`rt_flow_runs`	Workflow execution runs — status, trigger, timing, error
`rt_flow_step_runs`	Per-step execution details — agent, session, SITREP, tokens, cost

claw-runtime persistence (conversation history & state):

Table	Role
`rt_sessions`	Permanent (one per primary agent, cross-channel) or ephemeral sessions
`rt_messages`	Messages per session (user/assistant, model, tokens, cost)
`rt_parts`	Message parts (text, tool-call, tool-result, error)
`rt_events`	Runtime bus events per instance (activity console)
`rt_permissions`	Permission rules approved by user (filesystem, bash, A2A)
`rt_auth_profiles`	LLM provider auth profiles with failover chains
`rt_system_prompts`	System prompt snapshots per session (deduplicated by hash)

Development

git clone https://github.com/swoelffel/claw-pilot.git
cd claw-pilot
pnpm install

pnpm build         # Build CLI + UI (dist/)
pnpm build:cli     # Build CLI only
pnpm build:ui      # Build UI only (Vite)
pnpm typecheck:all # tsc --noEmit (backend + UI)
pnpm test:run      # Run unit/integration tests (~2400 passing)
pnpm test:ui       # Run UI tests
pnpm test:e2e      # Run e2e tests (~100, real HTTP server, in-memory DB)
pnpm lint:all      # oxlint src/ + ui/src/
pnpm format:check  # Prettier check
pnpm spellcheck    # cspell (en + fr dictionaries)

Pre-commit hooks (lefthook): format:check + lint:all + typecheck:all. Pre-push hooks: spellcheck + test:run. Commits follow conventional commits (commitlint).

Tech Stack

Layer	Stack
Runtime	Node.js >= 22.12.0, ESM modules, TypeScript ~6.0
CLI	Commander.js ^14 + @inquirer/prompts (interactive wizard)
HTTP / WebSocket	Hono ^4.12 + ws ^8 (real-time status + agent communication)
Database	better-sqlite3 ^12 + SQLite WAL (schema v34)
UI	Lit ^3 web components + Vite ^8 + @lit/localize (i18n, 6 languages)
Build	tsdown (CLI), Vite ^8 (UI)
LLM Integration	Vercel AI SDK ^6.0 (@ai-sdk/anthropic, openai, google)
Tests	Vitest ^4 (~2400 unit/integration + ~100 e2e)
Lint / Format	oxlint ^1.59 + Prettier ^3.8 + cspell + lefthook (zero-warning enforcement)
Plugin System	Event bus + hook-based plugins for tool, session, and message lifecycle
MCP	@modelcontextprotocol/sdk ^1.28 (stdio + HTTP transports)

Documentation

Document	Content
`docs/main-doc.md`	Architecture overview — read this before major changes
`docs/ux-design.md`	Dashboard UX — all screens, components, interaction patterns
`docs/ux-screens/`	Individual screen docs (16 screens)
`docs/ux-components/`	Individual component and dialog docs (29 components)
`docs/design-rules.md`	Design system, anti-patterns, delivery checklist
`docs/i18n.md`	i18n architecture — adding languages, translation workflow
`docs/registry-db.md`	Database schema (v38), migration history, recovery procedures
`CLAUDE.md`	Development conventions, key patterns, common pitfalls
`CHANGELOG.md`	Detailed release notes

Changelog

See CHANGELOG.md for detailed release notes.

v0.80.9 (current) — UI fixes (question cards render without F5, state reset), named-keys keyless provider support, crypto empty-string round-trip; contributor docs rewrite (develop-first gitflow)
v0.80.8 — ServerRegistry abstraction (hook H3): single entry point for "which server serves which resource"; Community ships SingleServerRegistry, Enterprise will plug FederatedServerRegistry
v0.80.7 — CodeQL triage — 0 open alerts: 5 true positives fixed, 21 false positives dismissed with justification
v0.80.6 — Enterprise Edition preparation Phase 0: pluggable permission middleware (permission() Hono factory, ACTIONS catalogue, NullPermissionChecker)
v0.80.5 — AuthProvider abstraction: pluggable auth registry, PasswordProvider (scrypt); Enterprise hook for OIDC/SAML/Azure AD
v0.80.3 — CapabilityRegistry: single source of truth for Community vs Enterprise feature gating
v0.79.0 — Instance shared workspace: per-instance workspaces/shared/ directory accessible by all agents, new dashboard tab, schema v38
v0.78.0 — Onboarding Start CTA: animated kickoff button, POST /kickoff route, system BOOTSTRAP.md for first-contact intro
v0.77.0 — Flow Sessions screen: run-centric master/detail view, sitrep-aware status colors, live SSE streaming for active runs
v0.76.0 — Instance Dashboard screen: widget-based overview (9 widgets), mini-pilot sidebar, clickable instance card
v0.75.0 — System-pilot documentation workspace: 45 embedded .md files, external workspace file loading, ws_search_files tool
v0.74.0 — INBOX-001: persistent notification inbox, bell badge, notifications table (v37), bus-driven emitter for 6 event types
v0.73.5 — CRUD workspace file tree: full file manager in agent panel, ws_list_files + ws_search_files plugin tools
v0.73.0 — Flow engine: outcome-driven DAG control flow, complete_step structured SITREP tool, automatic tool-call repair
v0.72.8 — Multi-user port isolation: OS username salt prevents port collisions between co-hosted installs
v0.71.0 — Live reasoning streaming: collapsible "Thinking…" card for extended thinking tokens; 5-phase pilot status indicator
v0.70.0 — Lean Home chat (cp-home-chat), live ClawPilot state in system prompts, bundled-question detection
v0.69.0 — HOMEBOT: chatbot home screen, system instance with 6 pre-configured flows, 22-tool admin plugin
v0.68.0 — FLOW-001: declarative DAG workflow engine, agent execution refactor (dashboard → runtime proxy)
v0.67.0 — SEARCH-001: command palette (Cmd+K), FTS5 global search across 5 entity types
v0.66.0 — TIMELINE-001: activity timeline per task, 9 activity types with field-level tracking
v0.65.0 — GOAL-001: epic hierarchy, heartbeat overhaul (permanent sessions, timezone validation)
v0.64.0 — TASK-001: Kanban task board with drag & drop, agent assignment, engineering excellence
v0.63.0 — Dynamic model discovery, 8 providers, circular dependency fix
v0.62.0 — Budget enforcement with auto-pause, Telegram alerts
v0.58.0 — Dashboard service management, auth command, system prompt snapshots
v0.55.0 — Agent templates, runtime config in DB, skills sync
v0.48.0 — Heartbeat heatmap, memory browser, activity console, cost dashboard
v0.45.0 — Cost tracking, send_message tool, multi-agent collaboration
v0.30.0 — Workspace autodiscovery, runtime-specific features

License

MIT — see LICENSE

Updated: 2026-04-12 — v0.69.0, schema v34, 20 repositories, ~139 REST endpoints, HOMEBOT, workflow engine, task board, command palette

Release History

Version	Changes	Urgency	Date
v0.81.1	> 📣 Marketing & hygiene release — no runtime changes. > GitHub repo vitrine and documentation were aligned with the current product scope after external audit feedback. No schema change, no API change. ### Changed - README product-grade rewrite (#152) — repositions the project around user outcomes instead of a feature wall. New hero one-liner, badges (version / CI / license / node / website), "What you can build in an afternoon" section with three concrete scenarios (ops team with bud	High	4/21/2026
v0.81.0	> 🎖️ Milestone : Phase 0 Enterprise Edition preparation — complete. > All 9 hooks (H1–H9) landed. The Community codebase is now fully prepared for the upcoming Enterprise Edition fork: pluggable authentication, fine-grained permission, pluggable server & secret providers, audit event bus, plugin signature + API hardening, and automated discipline gates. The fork of `claw-pilot-enterprise` (closed source, private repository) can now proceed. ### Added - **Discipline gates — automated Comm	High	4/21/2026
v0.80.14	### Added - Plugin API hardening — `tool.beforeCall` decision (H8) — the `tool.beforeCall` hook now supports a discriminated return value `ToolCallDecision` (`allow` / `deny` / `modify-args` / `require-approval`). New `src/runtime/plugin/dispatcher.ts` observes each plugin's return sequentially: the first `deny` or `require-approval` short-circuits; `modify-args` chains the mutated args to downstream plugins and to `def.execute()`. A plugin that returns `void` is treated as `allow`; a plugi	High	4/21/2026
v0.80.13	### Added - Plugin Signature verifier (H7) — new `src/runtime/plugin/verifier.ts` introduces a pluggable `PluginVerifier` invoked before the dynamic `import()` in `loadPluginFromFile()`. The loader now reads the plugin bytes, computes a SHA-256 hash, and calls `verifier.verify({ path, bytes, hash })`. A failing result emits `plugin.rejected` to the audit bus (new `AuditEvent` variant with `{ path, verifierKind, reason }`) and throws `ClawPilotError("PLUGIN_REJECTED")` — the plugin modul	High	4/21/2026
v0.80.12	### Changed - cp-system team consolidated from 6 to 3 agents (#147) — `admin-exec` + `config-exec` merged into the new `ops` agent (generator, full CRUD + lifecycle); `db-analyst` absorbed into `analyst` which now owns `cp_query_db`; `architect` dissolved into system-pilot as a conversational team-design workflow. SOUL.md footprint dropped 69 % (652 → ~200 lines). The 4 removed agents are preserved on existing instances with sessions + history intact — only YAML spawn links are replaced so	High	4/21/2026
v0.80.11	### Added - Audit Event Bus (H6) — new `src/core/audit/` module introduces a typed `emitAudit()` API and a seven-variant taxonomy (`auth.login`, `auth.logout`, `auth.failed`, `permission.denied`, `secret.access`, `agent.tool_call`, `named_key.mutation`). Two default Community sinks ship at bootstrap: `FileAuditSink` writes a daily-rotated JSONL to `<stateDir>/audit/` (intended for `tail -f` and ops inspection) and `DbAuditSink` persists to the new `rt_audit_events` table (migration v39) wit	High	4/21/2026
v0.80.10	### Added - SecretProvider abstraction (H4) — new `src/core/secrets/` module introduces a pluggable `SecretProvider` interface with a Community `EnvSecretProvider` default. Every secret read now goes through `secretProvider.get(...)`: master encryption key, Telegram bot token, web-chat token, internal runtime token, and provider API keys for model discovery. Gated by the `vault-secrets` capability so Enterprise can drop in a Vault / AWS SM / Azure Key Vault implementation without touching f	High	4/21/2026
v0.80.9	### Fixed - UI — question cards render without F5 (#138) : `home-chat` and `runtime-pilot` now call `_reloadLastMessages` on the `question.asked` event instead of `_refreshMessages`. The latter short-circuits when `_status === "tool"`, which is always the case at question time since `tool.call.started` fires first. Subagent-initiated questions are now visible immediately. - UI — question state reset on call prop change (#138) : `part-question` now resets `_activeTab`, `_tabStates`, `_su	High	4/21/2026
v0.80.8	### Added - `ServerRegistry` abstraction (`src/server/registry.ts`) — single entry point for "which server serves which resource". Community ships `SingleServerRegistry` (always local); Enterprise will plug a `FederatedServerRegistry` via the `multi-server` capability. Bootstrapped from `withContext()` and the dashboard server entry, consumed by CLI commands (`init`, `update`, `dashboard`) and runtime tools. This is hook H3 of the Enterprise Edition preparation (Phase 0). See `ai-docs/p	High	4/21/2026
v0.80.7	### Security - CodeQL triage — 0 open alerts : complete sweep of pre-existing CodeQL findings. 5 true positives fixed in code, 21 false positives dismissed with justification, 2 covered by existing sanitization wrappers. - Fixes : `src/dashboard/routes/instances/workspace-download.ts` (file-system race + filename sanitization), `src/runtime/tool/built-in/write.ts` (file-system race), `src/runtime/tool/built-in/_skill-remote.ts` (path traversal defense on HTTP→file), `src/dashboard/rou	High	4/21/2026
v0.80.6	### Added - Permission middleware extension point (`src/dashboard/middleware/permission.ts`): contract for pluggable `PermissionChecker`, registration API, `permission()` Hono middleware factory, and `ACTIONS` catalogue. Every dashboard mutation route and sensitive read route is annotated with `permission({ action, resource })`. The auth middleware publishes an `AuthenticatedUser` on the Hono context with a `source: "session" \| "bearer"` discriminator. Community ships `NullPermissionChecker	High	4/20/2026
v0.80.5	### Added - `AuthProvider` abstraction (`src/core/auth/`) — the monolithic `src/core/auth.ts` is refactored into a pluggable provider pattern. Exposes `AuthProvider` interface (`kind`, `authenticate(credentials)`), a registry (`registerAuthProvider`, `authenticate(kind, credentials)` dispatcher), and a default `PasswordProvider` (scrypt) registered at dashboard bootstrap. Dashboard `POST /api/auth/login` now routes through `authenticate("password", …)` instead of inlining the SELECT + scryp	High	4/20/2026
v0.80.4	### Dependencies - `@inquirer/prompts` 8.4.1 → 8.4.2 (patch — fix freeze on some Windows terminals). - `marked` 18.0.1 → 18.0.2 (patch — bug fixes). ### Tooling - `knip` 6.4.1 → 6.5.0, `vite` 8.0.8 → 8.0.9 (dev deps). - GitHub Actions: `github/codeql-action` v3 → v4, `actions/setup-node` 6.3.0 → 6.4.0, `pnpm/action-setup` 6.0.0 → 6.0.1. ---	High	4/20/2026
v0.80.3	### Added - `CapabilityRegistry` (`src/core/capabilities.ts`) — single source of truth for differentiating Community vs future Enterprise edition behavior. Exposes `capabilities.has(cap)`, `capabilities.require(cap)`, `capabilities.list()`. Community impl returns `true` for the "core" set and `false` for future "enterprise" capabilities (`sso-oidc`, `sso-saml`, `rbac-fine`, `abac`, `audit-siem`, `multi-server`, `plugin-signature`, `vault-secrets`, …). This is hook H5 of the Enterprise E	High	4/20/2026
v0.80.2	### Added - Opt-in UI debug logging — `ui/src/services/debug.ts` now exports four granular helpers (`debugSse`, `debugChat`, `debugRender`, `debugApi`) each gated by its own `localStorage` flag (`cp:debug-sse\|chat\|render\|api`, or `cp:debug` for all). Zero runtime cost when disabled. Call sites seeded in `home-chat.ts` and `runtime-pilot.ts` at the spots useful during streaming diagnostics. - `docs/debugging.md` — dedicated hub documenting the UI debug flags, how to enable them from devt	High	4/20/2026
v0.80.1	### Fixed - Home chat double render — on the `/home` screen (and `/pilot` full inspector), the assistant reply was painted twice during streaming: once as the persisted row coming back from `_reloadLastMessages`, once as the live streaming bubble. Track the in-flight assistant `messageId` and hide the matching row from the timeline while the stream is active. Cleared on session idle/ended/abort. - Missing `agentId` on `MessageCreated` — the bus event published at the start of an assista	High	4/20/2026
v0.80.0	### Fixed - Agent kickoff language — agents replied in English even when the user had selected another language. Four combined issues were fixed: - `initDatabase` now backfills a default `user_profiles` row for the admin user when missing. Historical installs were stuck without a profile because the onboarding wizard only triggers when no API key exists. - The onboarding wizard no longer silently swallows `PATCH /api/profile` failures — errors surface in the existing error banner. - `	High	4/20/2026
v0.79.1	## Fixed - Onboarding start CTA — removed the "Say hello to your Pilot" subtitle below the Start button on `/home` and `/pilot`. Only the Start button remains. i18n key `startCta.subtitle` removed from all six locales. Full changelog: https://github.com/swoelffel/claw-pilot/blob/main/CHANGELOG.md	High	4/20/2026
v0.79.0	### Added - Instance shared workspace — Per-instance shared file space at `<stateDir>/workspaces/shared/` accessible by every agent of the instance. Auto-created at install; auto-healed on agent-sync for legacy instances. - Schema v38 — New `instance_shared_files` table + `instance_shared_files_fts` FTS5 mirror (symmetrical to `agent_files` / `agent_files_fts`). Additive migration, triggers keep FTS in sync. - Dashboard UI — New "Shared files" tab in instance settings (`cp-instance-	High	4/20/2026
v0.78.1	## Fixed - Skills ZIP upload — `POST /api/instances/:slug/skills/upload` was failing with HTTP 500 on systems without the `unzip` binary installed (e.g. production Debian 12). Replaced `execFile("unzip", ...)` with the pure-JS [fflate](https://github.com/101arrowz/fflate) library. Zero native deps, small footprint. Added path traversal safety check and 6 new tests covering upload scenarios. ### Self-updater Production instances will auto-update to v0.78.1 within the poll cycle. No manu	High	4/20/2026
v0.78.0	### Added - Onboarding Start CTA — A centered, animated "Start" button appears on any empty permanent agent session (home screen + `/pilot/:slug`). Clicking it triggers the first prompt-loop turn so the agent introduces itself. - Kickoff route `POST /api/instances/:slug/agents/:agentId/kickoff` — Validates the permanent session is empty (409 `KICKOFF_ALREADY_DONE` otherwise), picks a localized greeting from the user's language profile, forwards it to the runtime via the existing `callRu	High	4/19/2026
v0.77.4	### Added - Branch coverage: dashboard routes — 17 new tests covering `_internal-api-client.ts` (0% → 100% branches) and `instances/workspace-download.ts` (0% → 90% branches). Exercises Bearer auth wiring to the runtime daemon, fetch-level failures, best-effort event publish, path traversal, symlink escape, and content-disposition escaping. ### Changed - CI coverage thresholds raised to lock in the gain: lines 59→60, statements 58→59, functions 61→63, branches 52→53. Prevents regressio	High	4/18/2026
v0.77.3	### Added - Renovate (`renovate.json`) — Weekly grouped dependency PRs against `develop`, with dedicated groups for `ai-sdk`, `typescript-tooling`, `vitest`, and `lint-format`. Major bumps isolated with `breaking-change` label. Security advisories bypass the schedule. - CodeQL (`.github/workflows/codeql.yml`) — SAST scan on push + PR + weekly cron, `security-extended` + `security-and-quality` query packs, scoped to `src/` and `ui/src/`. - Release automation (`.github/workflows/relea	High	4/18/2026
v0.77.2	## What's new in v0.77.2 Security hardening release — defense in depth fixes surfaced by a 360° technical audit. No runtime behavior change for the nominal path. ### Security - self-updater ref validation — `targetRef` is validated against `^v\d+\.\d+\.\d+(-suffix)?\|main$` before being passed to `git checkout`. Defense in depth against a theoretical GitHub API compromise that could have injected shell metacharacters. Unsafe refs now abort the job cleanly with an "unsafe ref" error, never r	High	4/18/2026
v0.77.1	## What's new in v0.77.1 Maintenance release — patches 3 moderate security vulnerabilities, bumps dependencies to latest patch/minor, and migrates the e2e Vitest config to the Vitest 4 pool API. ### Security - hono bumped to 4.12.14 — HTML injection in JSX SSR ([GHSA-458j-xx4x-4375](https://github.com/advisories/GHSA-458j-xx4x-4375)). - dompurify bumped to 3.4.0 — ADD_TAGS bypass ([GHSA-39q2-94rc-95cp](https://github.com/advisories/GHSA-39q2-94rc-95cp)). - brace-expansion pinned to	High	4/18/2026
v0.77.0	## Flow Sessions Screen New `Logs` button per flow opens a run-centric master/detail screen: ### Left panel — Run list - Status dots reflecting sitrep outcomes (green/orange/red) - "partially failed" label for runs with only partial outcomes - Pagination with hasMore ### Right panel — Step accordions - Nested accordions per step with lazy-loaded session messages - Tool call/result expansion, raw LLM toggle - Real-time SSE streaming for active steps (5s polling + SSE) - Running steps resolve	High	4/18/2026
v0.76.0	## What's new in v0.76.0 ### Added - Instance Dashboard screen — New `#/instances/:slug/dashboard` route with a widget-based overview of a single instance. 2-column layout: 9 widgets (Agents, Tasks, Costs with sparkline, Activity, Flows, Heartbeat, Logs, Memory, Settings) + sticky mini-pilot sidebar. - Dashboard mini-pilot — SSE chat sidebar (`cp-dashboard-pilot`) with permanent session detection, text-only message bubbles, streaming status indicator (5 phases), and input bar. - **Click	High	4/18/2026
v0.75.1	### Fixed - Circular dependency — Extracted notification bridge from `dashboard/monitor.ts` into `lib/notification-bridge.ts` to break `monitor.ts → runtime/index.ts → engine.ts → monitor.ts` cycle that failed CI `madge --circular` check. Full changelog: https://github.com/swoelffel/claw-pilot/compare/v0.75.0...v0.75.1	High	4/18/2026
v0.75.0	## System-pilot documentation workspace The system-pilot agent now has a comprehensive documentation workspace with 45 files covering all ClawPilot features. The agent searches this documentation via FTS5 before answering user questions, providing accurate and detailed responses about instances, agents, flows, tasks, budgets, channels, monitoring, security, and more. ### What's new - 45 documentation files in `templates/system/workspace/system-pilot/docs/` organized in 13 thematic dir	High	4/18/2026
v0.74.1	## What's new in v0.74.1 ### Fixed - Knip dead code false positive — Replaced inline `import("./types.js").NotificationsPage` with a named import in `ui/src/api.ts` so knip correctly detects the type as used. --- ## Install / Update ```sh curl -fsSL https://raw.githubusercontent.com/swoelffel/claw-pilot/main/install.sh \| sh ``` See [CHANGELOG.md](https://github.com/swoelffel/claw-pilot/blob/main/CHANGELOG.md) for the full history.	High	4/17/2026
v0.74.0	## What's new in v0.74.0 ### Added - Persistent notification inbox (INBOX-001) — Bell icon with unread badge in the app bar opens a notification drawer. Notifications are generated automatically by the bus for budget alerts, task status changes, heartbeat failures, runtime errors, permission requests, and flow completions. Features deduplication (15-min window), auto-prune (30 days), cursor-based pagination, and mark-read actions. DB migration v37, 815+ lines of tests. --- ## Install / Up	High	4/17/2026
v0.73.7	## What's new in v0.73.7 ### Changed - Instance card header simplified — Removed state text label (`running`, `stopped`…) from the header badge; only the colored dot (or spinner) is displayed, with the state name as a `title` tooltip on hover. Also documented the conditional SYSTEM badge in the component spec. --- ## Install / Update ```sh curl -fsSL https://raw.githubusercontent.com/swoelffel/claw-pilot/main/install.sh \| sh ``` See [CHANGELOG.md](https://github.com/swoelffel/claw-pilot	High	4/17/2026
v0.73.6	## Changes ### Changed - File tree icons aligned to ClawPilot style — Replaced emoji file (`📄`) and folder (`📁`) icons with geometric Unicode symbols (`◈` for files, `⊟` for folders), consistent with the rest of the UI (tool icons, context panel, instance card actions). - VS Code-style "New file" and "New folder" toolbar buttons — The text "New file…" button in the workspace file tree header is replaced by two SVG icon buttons (add-file and add-folder, matching VS Code's explorer tool	High	4/17/2026
v0.73.5	## Highlights ### CRUD workspace file tree for agents The "Files" tab in the agent detail panel is now a full workspace file manager with a collapsible tree view. Users can see every file in an agent's workspace — including files created by the agent itself via its Write tool — create files at arbitrary paths (`notes.md`, `memory/custom.md`, `projects/plan.md`), and delete files they no longer need. - Recursive workspace scanning replaces the old hardcoded 6-file whitelist - Path validatio	High	4/16/2026
v0.73.4	## Added - Configurable maxSteps per flow step (default 50, soft/hard cap with extension). Flow step agents previously hit the global \`maxSteps=20\` cap before completing multi-tool missions. Flow steps now default to 50 LLM steps, configurable per step via \`FlowStepDef.maxSteps\` and the flow editor UI. - Soft cap + extension mechanism: when the agent approaches \`maxSteps\`, a system reminder is injected offering \`complete_step\` (finish) or \`request_step_extension\` (more step	High	4/16/2026
v0.73.3	## Added - Automatic tool call repair for all sessions — enabled \`experimental_repairToolCall\` on the Vercel AI SDK \`streamText\` call. When a model produces malformed JSON arguments (e.g. markdown bullets instead of a JSON array), the repair function first attempts a lightweight local fix (regex markdown-bullets to JSON array), and if that fails, returns \`null\` so the SDK surfaces the error to the model on the next step for self-correction. This is global — it benefits every tool in e	High	4/16/2026
v0.73.2	## Added - `complete_step` tool — structured, forced SITREP for flow steps. The flow engine now injects a per-step-run tool called `complete_step` into the toolset of every flow step agent. The agent calls it with `{ outcome, summary, keyFindings }` as its final action; the tool writes the structured SITREP directly to `rt_flow_step_runs.sitrep_json` via a DB handle captured at construction time. This replaces the fragile regex parsing of free-text responses, which broke every time an ag	High	4/15/2026
v0.73.1	## Fixed - Missing SITREP now correctly maps to `outcome: \"failure\"` (was `\"partial\"`) — when an agent finishes a flow step without emitting any `OUTCOME:` marker, `extractSitrep()` used to default to `outcome: \"partial\"` with a misleading first-500-chars summary. \"partial\" is semantically reserved for agents that explicitly report incomplete work; a missing SITREP is a reporting-contract failure and must be surfaced as such. Observed on MAC web-maintenance run #3: `site-maintain	High	4/15/2026
v0.73.0	## Added - Flow engine: outcome-driven control flow — sitrep `outcome` now drives the DAG instead of being decorative metadata. When a step completes with `outcome=failure` / `outcome=partial` (or with a malformed/missing sitrep), every dependent step is eagerly marked `skipped` with an explanatory error, unless the step opts in via the new `continueOnFailure: true` flag (typical for `notify` / cleanup steps). The overall flow run is now marked `failed` whenever any step did not finish with	High	4/15/2026
v0.72.13	## What's new in v0.72.13 Hotfix for a flow engine crash: flows whose root step omitted \`dependsOn\` in the stored JSON crashed with \`dependsOn is not iterable\` and deadlocked the entire DAG. ### Fixed - Flow engine: root steps without \`dependsOn\` no longer crash the DAG — agents creating flows via \`cp_create_flow\` can legitimately omit \`dependsOn\` on root steps (Zod schema marks it optional), but \`FlowStepDef.dependsOn\` was typed as required and the engine iterated it directly.	High	4/15/2026
v0.72.12	## What's Changed ### Fixed - CI: security audit steps no longer block the pipeline — npm retired its legacy audit endpoints (`/npm/v1/security/audits/quick`, `/npm/v1/security/audits`) returning 410 Gone, causing the Quality job to fail before any other check ran. Marked both `pnpm audit` steps as `continue-on-error: true` so audit output remains visible in CI logs without blocking format, typecheck, lint, or complexity checks. Full changelog: https://github.com/swoelffel/claw-pilot/b	High	4/15/2026
v0.72.11	## What's new in v0.72.11 Hotfix for a UX regression: when an assistant turn contained text, a tool call (question, A2A delegation), and more text, the two text segments appeared merged in the timeline and the tool_call card was pushed visually after the merged block — breaking the conversational narrative. ### Fixed - Assistant text parts now split around tool calls in the timeline — `StreamingState.textPartId` was never reset between Vercel AI SDK steps, so when the LLM produced text → t	High	4/15/2026
v0.72.10	## What's new in v0.72.10 Hotfix for a UX regression: questions asked by subagents did not appear in the chat UI until the user pressed F5. ### Fixed - Questions now appear in real time in the UI — the `question` tool emits a `question.asked` SSE event when it suspends the prompt loop, but neither `home-chat.ts` nor `runtime-pilot.ts` had a handler for it. The switch statement silently dropped the event in the default case, so subagent-initiated questions only appeared after a manual reloa	High	4/15/2026
v0.72.9	## What's new in v0.72.9 ### Fixed - cp-system subagents now load their SOUL.md: the 5 subagents (admin-exec, config-exec, analyst, architect, db-analyst) had `promptMode: subagent` which restricted the system prompt to AGENTS.md only. Their rich domain knowledge (DB schema, CLI commands, providers, archetypes) was written to disk but never injected into the LLM context. Switched to `promptMode: minimal` so SOUL.md + AGENTS.md + USER.md + memory files are all loaded. - **Template sync now r	High	4/15/2026
v0.72.8	## What's new ### Multi-user port isolation Two ClawPilot installations on the same machine (different OS users) can now coexist without port conflicts. Root cause: port derivation was `djb2Hash(slug) % 100 + base` — a pure function of the slug. Same slug on the same machine = same port = `EADDRINUSE` for the second installation. Fix: - User salt: `os.userInfo().username` is now included in the hash, so different OS users derive distinct ports for the same instance slug - **EADDR	Medium	4/14/2026
v0.72.7	## What's new in v0.72.7 ### Changed - Documentation restructured for vibecoders: split the 807-line monolithic `main-doc.md` into 7 focused files under `docs/architecture/` (data-model, code-structure, features-cli, dashboard, api-reference, runtime-engine, plus index). Added onboarding `docs/README.md` with documentation map. - SSE architecture documented: new `docs/sse-architecture.md` covers all 3 SSE streams, WebSocket monitor, 43 bus event types, proxy layer, reconnection strategy	Medium	4/14/2026
v0.72.6	## Zero complexity baseline Refactored 44 files across the entire codebase to eliminate all 64 ESLint `sonarjs/cognitive-complexity` and `max-lines-per-function` warnings. Every function now passes strict thresholds (cognitive complexity ≤20, max 150 lines) with zero exceptions — the `BASELINE_FILES` array has been removed from `eslint.config.js`. ### Key decompositions \| File \| Before \| After \| \|---\|---\|---\| \| `message-builder.ts` \| complexity 114 \| ✅ 0 \| \| `system-prompt.ts	Medium	4/14/2026
v0.72.5	## What's new in v0.72.5 ### Changed - Enterprise-ready: DB-direct system tools — replaced the HTTP-proxy `system-dashboard` plugin with a new `system-tools` plugin that queries `registry.db` directly via Registry, Lifecycle, Provisioner, and Destroyer. The 22 `cp_` tools no longer depend on the dashboard REST API or `CLAW_DASHBOARD_TOKEN`. Each component (dashboard, runtime) now connects to the DB independently — first step toward externalized DB architecture. - *Reinforced cp-system age	Medium	4/14/2026
v0.72.4	### Fixed - Thinking blocks visible by default: reasoning traces no longer disappear after streaming completes. `thinking` filter now defaults to `true` in both the home chat and runtime pilot. - Streaming timestamp includes seconds: live streaming entries now show `HH:MM:SS` instead of `HH:MM`, matching persisted timeline entries.	Medium	4/14/2026
v0.72.3	## Changed - Setup wizard replaced with form: the chat-bubble wizard for initial setup is replaced by a single-page form. All fields (provider, API key, model) are visible at once. New profile section collects display name, language (auto-detected from browser), and timezone (auto-detected). Localized in 6 languages.	Medium	4/14/2026

Dependencies & License Audit

Loading dependencies...

Similar Packages

tweetsave-mcp📝 Fetch Twitter/X content and convert it into blog posts using the MCP server for seamless integration and easy content management.main@2026-04-21

mofloMoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.4.8.79

agentroveYour own Claude Code UI, sandbox, in-browser VS Code, terminal, multi-provider support (Anthropic, OpenAI, GitHub Copilot, OpenRouter), custom skills, and MCP servers.v0.1.31

my-claudeAll-in-one agent harness for Claude Code — Boss meta-orchestrator, 200+ agents, 200+ skills, 87 rules, 3 MCP servers, 7 hooks. One plugin install.v0.46.2

claude-code-proxyMonitor and visualize your Claude Code API interactions with Claude Code Proxy. Easily set up a transparent proxy and live dashboard. 🛠️🚀main@2026-04-21