fix: allow HuggingFace Spaces iframe embedding (cookies, CSP, CSRF)

feat: discover and display per-agent workspace skill roots (#426)

fix: remove CSP nonce from style-src to unblock reagraph canvas (#425)

fix: add workspace skill root to skill-sync.ts (#411)

feat: GNAP sync engine for git-native task persistence (#396)

feat: task assignment session targeting (#399)

fix: reduce server memory footprint (#405)

fix: remove duplicate task title constraint, improve delete handling and scrolling (#386)

fix: stop forcing dangerouslyDisableDeviceAuth + fix exec security value

fix: docker compose pids location + clear stale update banner

fix: unify GitHub sync token resolution with integrations env file

feat(tasks): classify task complexity and route to appropriate model tier

fix(tasks): use --expect-final for agent dispatch and Aegis review

fix: cron panel crash on missing schedule + doctor parser false positive (#347)

fix(gateway): resolve Docker connectivity — 404 endpoints, EROFS write, missing OPENCLAW_HOME (#343)

test: add coverage for pure utility modules, fix Vitest 60% threshold (#339)

fix(db): add busy_timeout pragma and guard build-phase eager init (#337)

feat(gateway): detect port-based Tailscale Serve proxies (#330)

fix(ui): null-safe trim calls in agent model config (#329)

fix(ui): persist doctor banner dismiss with 24h expiry (#328)

fix(docker): Compose v5 pids_limit + copy public assets (#327)

feat: add first-time setup wizard and zero-config startup

fix(tasks): use gateway agent ID instead of display name for dispatch

Merge pull request #313 from builderz-labs/fix/http-tailscale-login

fix(auth): fix HTTP/Tailscale login — opt-in HTTPS redirect, CSP nonce propagation

feat(auth): add trusted reverse proxy / header authentication (#306)

fix(auth): allow login on fresh HTTP Docker installs (#304)

Add Venice AI integration and model support (#301)

feat(gateways): add health history logging and timeline (#300)

test(tasks): replace external repo fixture with neutral local slug

feat(tasks): persist implementation target metadata for deterministic routing (#297)

fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)

feat(gateway-auth): enhance authentication configuration and credential retrieval (#292)

security(csp): remove unsafe-inline with nonce-based CSP (#288)

fix: dynamic coordinator routing + boxed doctor parsing (#279)

feat(refactor): ready for manual QA after main sync (#274)

fix(sync): support commented/trailing-comma OpenClaw config (#235)

fix(security): enforce server-side actor identity (#224)

Merge pull request #226 from builderz-labs/fix/issue-215-workspace-pending-state

fix(workspaces): unblock pending tenant bootstrap flow

fix(websocket): normalize gateway URLs and dedupe reconnect errors

merge: sync virtual office branch with main

feat(docs): add docs knowledge APIs for issue 189

chore: merge main into feat/task-outcome-feedback-192 to resolve PR #207 conflicts

feat(tasks): add outcome tracking and feedback analytics

feat(costs): add task-level token attribution and task-cost rollups

fix(gateway): use stored token for websocket connect payload

fix(gateway): improve remote websocket URL handling and client-id errors

chore: resolve merge conflict with main for PR #180

Merge pull request #201 from builderz-labs/fix/184-assignment-status-normalization