Changelog
New updates and improvements to Caliptic.
v0.1.100May 31, 2026
ITIL4 service management — incident↔CMDB, RACI, change/release governance, Integration Hub
New Features
- Integration Hub — a generic inbound endpoint turns Grafana / Prometheus-AlertManager / Datadog / any webhook into monitoring events and auto-raises incidents; outbound webhooks plus Slack & PagerDuty for Caliptic events.
- Incident ↔ CMDB — alerts carry a `ci` label that links the incident to its Configuration Item, records the downstream blast radius, and flips the CI status (restored when the incident resolves).
- RACI across the CMDB — every Configuration Item has an accountable owner (teammate or AI agent) and a responsible support group.
- Self-documenting setup — per-connection wiring examples in Settings → Integrations and a new Integrations guide under /docs.
Improvements
- End-to-end ITIL4 governance verified in production: CAB approval, change-freeze windows, the release readiness gate, and deployed → post-implementation review → continual-improvement.
- CMDB list now returns owner / support-group / continuity so detail and edit views pre-fill correctly.
Bug Fixes
- Release detail no longer crashes when a linked change passes the readiness gate.
- Asset and CMDB edit dialogs now pre-fill the selected record instead of showing a blank form.
v0.1.39May 18, 2026
Landing redesign + corporate palettes + settings overhaul
New Features
- Dark-tech landing redesign with 9-language support (ar/de/en/es/fr/ja/ru/tr/zh) and live theme switcher
- Corporate palette — 8 themes with full color/contrast swap available in Settings > Appearance
- 13 settings tabs added or refreshed: Billing, SSO, Compliance, Audit Delivery, Automation Rules, CalipticCore Modules, Integration Hub, Groups, Priority Matrix, Repositories, Showcase Import, GDPR, Tokens
- Onboarding refactor — questionnaire step replaced with focused team / modules / complete steps for faster first-run setup
Improvements
- Typography alignment — JetBrains Mono + Inter ss01/cv11 stylistic sets applied across landing, app shell, and settings surfaces
- Go handler test coverage raised from 22% to 36.7% with 26 new handler suites (asset, audit, automation, catalog, change, chat, cmdb, gdpr, group, inbox, invitation, issue, kb, ldap, problem, project, release, sla, sso, supervisor, task_lifecycle, webhook, workflow)
- TypeScript component test files grew from 51 to 80 with 25 new suites covering settings, onboarding, autopilots, chat, inbox, layout, projects, runtimes, and supervisors
- End-to-end coverage extended from 19 to 26 specs with 7 new flows: billing, daemon-registration, palette-switching, profile-edit, settings-tab-navigation, sso-config, webhook-crud
- CI runner cost reduction — CLI, Desktop, Helm Validate, and Workflow E2E moved to the public caliptic-org/releases repo for free unlimited Actions minutes, eliminating the macOS 10x multiplier
- Deploy pipeline simplified — v* tag push now triggers production deploy instead of release-branch merge; workflow_dispatch tag input is required for manual runs
Bug Fixes
- SSO just-in-time provisioning corrected — legacy table references (users / workspace_member) blocked first-time SSO logins; now writes to the canonical user / member tables
- Migration 109 drops the legacy auto-named issue_status_check constraint and re-asserts the canonical one including the 'reopened' status, unblocking the human-handoff workflow
- E2E cookie URL now resolves through PLAYWRIGHT_BASE_URL / FRONTEND_ORIGIN env vars instead of hardcoded localhost:3000, removing silent test-suite failure on non-default ports
- Playwright workers reduced to 1 to prevent shared-workspace fixture races between parallel test runs
v0.1.33May 15, 2026
Production hardening — security audit, 26 pen-tests, help center fixes
New Features
- Help Center module gate — opening help for a closed module now asks to enable it instead of silently navigating to an empty page
Improvements
- Authorization chokepoint refactor: every endpoint touching a project_id now routes through requireProjectAccess(level), closing 14 leak paths into private projects
- userCanUseAgent now consistently gates issue assignment, autopilot binding, comment @-mention, retry-failed-tasks, and rerun — agent_access grants are enforced everywhere, not just chat
- Sprint AddIssue / RemoveIssue handlers cross-check workspace before mutating issue.sprint_id, blocking cross-tenant ID manipulation
- Help center tour wrapper localizes Next / Back / Done buttons and uses isLastStep() instead of DOM-text introspection, so tours end correctly in any language
- click-and-tour items wait 700ms after opening their target modal so driver.js's overlay no longer dismisses both the modal and the tour
Bug Fixes
- Search no longer leaked private project titles via /api/projects/search — visibility now joined into the result scan
- Public projects again allow workspace members to create issues (the access-helper overhaul briefly required edit grants on public projects too)
- loadIssueForUser now blocks reads on issues in private projects the caller can't access, fixing the cross-cutting hole that affected GetIssue, comments, reactions, attachments, change, problem, SLA, subscribers, approvals, and files
v0.1.32May 15, 2026
Sprint workflow fix — issues no longer vanish when starting a sprint
Improvements
- 13 new Go regression tests cover the sprint lifecycle end-to-end, including the transactional-consistency invariant
Bug Fixes
- StartSprint is now transactional: the sprint status flip and the bulk backlog→todo issue promotion either both commit or both roll back, eliminating the 'active sprint with hidden issues' window
- Sprint WebSocket events follow the colon-separated naming convention (sprint:started / sprint:closed) so the frontend listener actually fires
- Frontend now subscribes to sprint lifecycle events and invalidates the workspace issue cache so other tabs / devices refresh automatically after a sprint starts or closes
v0.1.31May 15, 2026
macOS auto-update restart fix
Bug Fixes
- After clicking Install on the auto-update prompt on macOS the app would close but never reopen on the new version. The autoStop daemon shutdown handler was calling event.preventDefault() and racing Squirrel.Mac's atomic quit-install-relaunch sequence. The updater now drains the daemon synchronously and signals the quit handler to step aside, so the new build launches cleanly.
v0.1.30May 15, 2026
Multi-supervisor, agent access control, project knowledge & DAG fan-out
New Features
- Multi-supervisor scoping — each workspace can have multiple supervisor agents, each owning its own worker pool. Projects can pin a supervisor; the workspace defines a fallback default.
- Per-user agent access control (agent_access table) — restrict who in the workspace can chat with, assign, or invoke an agent
- Project Knowledge — pre-load What / How / With / Constraints sections that get injected into every agent task, replacing the 'discover the codebase' loop with cached context (8–12× token savings per issue)
- Parallel DAG fan-out for supervisor delegation — a merge worker can wait on multiple parallel workers via --blocked-by repeated flag
- Chat is now supervisor-only — workers are reached through delegation, not directly
- Delete chat messages with hover trash icon (session creator or workspace admin)
Improvements
- Per-task scoped agent token (mtt_ prefix, HMAC-signed) replaces the long-lived daemon token in agent subprocess env, narrowing leak blast radius from indefinite to a single task's window
- bareDirName for cached repos now includes a SHA-256 suffix so org-a/core.git and org-b/core.git no longer collide
- SIGTERM sent to agent subprocess on cancellation so it can flush final output before WaitDelay escalates to SIGKILL (all 8 agent backends)
- Task message delivery retries 3× and buffers up to 1000 messages on persistent failure — UI gaps during transient outages eliminated
v0.1.29May 13, 2026
CLI --issue-type flag
New Features
- caliptic issue create --issue-type {task | epic | incident | change | problem | release} for explicit type tagging at creation time
- caliptic issue update --issue-type for re-classifying existing issues
v0.1.28May 13, 2026
Daemon project-scope security + CMDB UX
New Features
- CMDB Mermaid-style hierarchical topology canvas with dagre layout and parent-CI containers (VPC / subnet / cluster)
Bug Fixes
- Daemon repo checkout is now scoped to the requesting user's project access — agents can no longer check out repos from projects the caller doesn't have access to (security)
- Daemon's allowedRepoURLs now includes project repos on initial registration so agents can resolve cross-project references in the same workspace
v0.1.27May 8, 2026
Desktop module routes + Calipticore modules
New Features
- Calipticore Modules — workspace owners can enable per-module functionality (CMDB, Release Management, Event Management, …) with topological dependency resolution
- 18 new Help Center articles covering CMDB, Release Management, and Event Management workflows
Bug Fixes
- Desktop app now resolves routes for CMDB, Changes, Releases, Events, Problems, KB, and Catalog modules (previously 404'd in the in-app router)
- Windows update check 404 no longer surfaces a scary 'authentication token' error to the user for legitimately offline / stale builds
v0.1.26May 8, 2026
CSRF fix for cookie-mode sessions
Bug Fixes
- JWT now persisted in sessionStorage in cookie-auth mode so a page refresh doesn't clear the in-memory token and break CSRF validation on the next mutation