Rolling pre-beta build of oabctl from main@50424ed. Overwritten on every pre-beta build — not a stable version, matches the pre-beta-* image tags. For a pinned version, use the openab-<version> release attached to a real openab release instead.

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed since openab-0.10.0-beta.3

This release lands the first slice of the Agent Control Plane (openab-cp), custom MCP HTTP headers for native agents, keyless Google Chat auth, and a new nightly image channel. It also retires the Hermes backend.

⚠️ Breaking Changes

• Hermes agent support removed — Dockerfile.hermes, the hermes targets in Dockerfile.unified / Dockerfile.package / docker-bake.hcl, docs/hermes.md, and every CI reference are gone. Hermes' image build fetched an install script from raw.githubusercontent.com, which routinely returned 429 on shared runners and failed the Docker smoke tests; retry hardening only masked it. Deployments pinned to a Hermes image must migrate to another backend (#1523)

🚀 Features

• openab-cp agent control plane (PR 1/4) — standalone control-plane binary implementing the wire protocol, identity-bound registry, CP-authoritative policy engine, and delegation router from the ADR, so agents can delegate to each other over ACP/WS instead of round-tripping through Discord/Telegram. Hardened over six review rounds: CP-generated registration handles, atomic insert-before-send admission, loopback-default bind (non-loopback cleartext requires explicit allow_insecure_bind), lease expiry that actually closes the connection, (namespace, delegation_id) scoping with byte-identical cancel refusals (no cross-tenant existence oracle), per-identity connection quotas counted from the HTTP upgrade, registration/write timeouts, generation-stamped two-phase result commit, and exactly-once capacity release. Runtime client, MCP facade, and openab agent <verb> CLI land in follow-up PRs (#1469) — see docs/control-plane.md
• Custom MCP HTTP headers for native agents — mcp.json servers accept secret-resolved per-server headers, so openab-agent can reach authenticated remote Streamable HTTP MCP servers (#1511, original implementation by @fisherivco)
• Nightly image channel — scheduled builds that package the current OpenAB binary with each vendor's latest coding CLI, resolved fresh at build time instead of using the pinned defaults in Dockerfile.package. ⚠️ Nightlies are not releases: no stability or compatibility guarantee, CLIs can change or break at any time. Pin a v* release or a pre-beta-* tag for reproducible images (#1519, hardening in #1522)

🐛 Bug Fixes

• Google Chat: keyless ADC + reliable send-once — the attached runtime service account now obtains a metadata credential and impersonates a dedicated Chat service account for the chat.bot scope (runtime/target equality is rejected up front, since Google prohibits access-token self-impersonation). Delivery acknowledgement is decoupled from cosmetic streaming: both the standalone and unified paths report API, auth, channel, and timeout failures to core instead of returning synthetic success (#1513)
• platform-schema conformance hardening — check_code_ref now rejects whitespace-only symbols (a file.rs# suffix previously matched almost any source file) and enforces lexical path containment before any filesystem access, so the traversal tests can no longer pass vacuously. The workflow also lists its own file in both path triggers, uses --locked caching and checkout@v6, adds a per-event concurrency group, workflow_dispatch, and a weekly safety-net run, and expands triggers to the gateway/core/main.rs sources its code refs point at (#1462)

🏗️ Maintenance

• Antigravity agy CLI bumped 1.1.4 → 1.1.13, with the version/SHA256 triple propagated across all five parity-controlled Dockerfiles and the pin-parity assertions in docker-smoke-test.yml (#1476)
• ARN-parsing tests now use AWS documentation values (123456789012, example/telegram/bot-AbCdEf) instead of real account/secret names. No secret value was ever present — only the ARN of the secret holding a bot token — so nothing needs rotating (#1506)

📖 Documentation

• Agent Control Plane ADR — hub-and-spoke design for direct inter-agent delegation: outbound [control_plane] registration, the cp/delegate wire contract with delegation chain + deadline propagation, depth-1 primary-to-worker default policy, and an MCP facade (spawn_agent / check_delegation / list_agents / cancel_delegation) plus openab agent <verb> over one local UDS API (#1465)
• openab-pty composable runtime ADR — one codebase, two composable runtimes, three deployment profiles; MVP ships ACP-only and PTY-only as separate pods, with the colocated sidecar form demand-gated. The broker binary is untouched in every profile (#1478)
• openab-pty revision: two-tier kill domain + remote-only admin plane — post-spike owner decisions. Ancestry provably cannot attribute sessions, so Tier 1 (pgid + subreaper/pidfd, best-effort, explicitly labelled) is the unprivileged default and Tier 2 (per-session cgroup + cgroup.kill) is opt-in fail-closed hardening; the admin plane is remote-only, deleting the in-container credential surface (#1480)
• Model selection compatibility — /models table corrected for Gemini, Antigravity, OpenCode, and Devin (Gemini CLI and Antigravity are now distinguished); Antigravity model-selection instructions added; Devin's non-existent /model command reference fixed; Gemini account-migration guidance centralized; stale OpenCode statement removed from the Slack guide (#1521)

📌 Operator notes

• Hermes users must migrate before pulling 0.10.0-beta.4 images — the target no longer exists in any build lane
• openab-cp is a separate binary and separate service; it is not started by the broker and does nothing until agents register. No existing deployment changes behavior by upgrading
• If you expose openab-cp beyond loopback, terminate TLS in front of it — a non-loopback cleartext bind requires setting allow_insecure_bind explicitly, and bearer keys would otherwise cross the wire in the clear
• New openab-cp config fields all have serde defaults (register_timeout_secs 10, max_connections_per_identity 8, write_timeout_secs 30) and are rejected when zero — see crates/openab-cp/cp.toml.example
• MCP headers are opt-in per server in mcp.json; absent headers = beta.3 behavior
• Nightly tags are for tracking upstream CLI breakage early, not for production

Full Changelog: openab-0.10.0-beta.3...openab-0.10.0-beta.4

Version Info

• Chart Version: 0.10.0-beta.4
• App Version: 0.10.0-beta.4

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.4

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.4

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed since openab-0.10.0-beta.2

This release lands the OAB MCP Facade capability layer, browser control over MCP-over-ACP, a native Gmail adapter, and a new LINE WORKS platform adapter.

🚀 Features

• OAB MCP Facade MVP — new shared crates/openab-mcp workspace crate (MCP client runtime extracted from openab-agent) plus a broker-hosted, loopback-only Streamable HTTP MCP server exposing exactly search_capabilities / execute_capability. Activated by the [mcp] section in config.toml (absent = no listener, backward compatible). Also enforces the previously-unenforced tool_filter glob include/exclude at discovery and execution (#1448)
• Facade-only run mode — an adapter-less config with [mcp] present now runs just the facade listener in the foreground instead of bailing with "no adapter configured" (#1453)
• Session-aware capability sources — in-process CapabilitySource trait with per-agent-session opaque tokens (constant-time resolve, revoked on evict); session-bound sources are invisible and unreachable to anonymous clients; unified audit lines across both dispatch paths (#1454)
• Native Gmail adapter — six-tool profile (search_threads / get_thread / get_message / list_labels / list_drafts / create_draft) over GA Gmail REST, served as a loopback MCP server via openab mcp gmail-native serve|login. Drafts-only write surface, own PKCE OAuth flow with refresh-token persistence, header-injection-hardened MIME builder (#1449)
• LINE WORKS platform adapter — webhook ingress with X-WORKS-Signature HMAC verification + service-account JWT (RS256, auto-refresh), @-mention gating for channel messages, markdown replies rendered as flex bubbles with plain-text fallback, configurable receipt ack, inbound attachment download (image/audio/text through the shared media pipeline), first-class [lineworks] trust section, bounded two-tier ingress queue, and extensive review hardening across six rounds (#1456)
• Browser control via MCP-over-ACP (Phase 2) — an LLM agent can now operate a connected browser: reverse-MCP tunnel (mcp/connect / mcp/message per the official RFD) from the gateway /acp server to a browser extension, exposing katashiro.* tools (click / read_dom / navigate / type / screenshot). Delivered through the MCP Facade by default (per-session tokens, operator-configurable [[mcp.acp_servers]] deny-all allowlist with pinned tool sets), with proxy/bridge modes as explicit opt-outs. Includes SO_PEERCRED-authenticated bridge socket, constant-time bearer checks, tunnel-only 8 MiB frame allowance, and stale-transport cleanup that closes a facade-bypass path (#1447)

📖 Documentation

• OAB MCP Adapter ADR — facade boundary, two-tier positioning vs octobroker, capability-plugin path (#1446)
• OAB MCP Facade operator guide — enablement, two-tool surface, client registration, trust model (#1450)
• CLI conventions — top-level verbs for the bot, noun namespaces for subsystems (#1452)
• gmail-native: corrected the Desktop OAuth client claim (validated path is Web application + secret) (#1455)

📌 Operator notes

• All new config surfaces are opt-in: no [mcp], no [lineworks], no type:acp declarations = behavior unchanged from beta.2
• MCP audit lines use the bare mcp.audit tracing target — include it explicitly in RUST_LOG (e.g. RUST_LOG=openab=debug,mcp.audit=info) or tool-call auditing is silently off
• If a deployment previously ran browser proxy/bridge modes, facade-mode setup now removes the stale direct-transport entries automatically (they bypassed facade policy/audit)

Full Changelog: openab-0.10.0-beta.2...openab-0.10.0-beta.3

Version Info

• Chart Version: 0.10.0-beta.3
• App Version: 0.10.0-beta.3

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.3

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.3

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

Highlights

🔌 ACP Server over WebSocket (#1418)

OpenAB is now an ACP server, not just an ACP client. A new feature-gated acp_server gateway adapter exposes GET /acp (JSON-RPC 2.0 over WebSocket), so any standard Agent Client Protocol client — Zed, JetBrains, browser apps, custom CLIs — can drive an OpenAB agent directly, locally or remotely. Wire-conformant with ACP Schema v1.19.0.

• initialize / session/new / session/prompt / session/cancel / session/resume — the full Phase-1 chat subset, with stopReason semantics (end_turn / cancelled)
• WebSocket, not stdio — serves remote and browser clients that locally-spawned stdio bridges cannot
• Fail-closed security: non-loopback binds require OPENAB_ACP_AUTH_KEY (timing-safe compare); the bearer rides Authorization: Bearer or the Sec-WebSocket-Protocol subprotocol — never the URL; keyless loopback mode blocks all browser origins unless allowlisted via OPENAB_ACP_ALLOWED_ORIGINS
• Session resume re-attaches to a persisted session after reconnect (session_key = acp:<channel_id>)
• Enable with the acp build feature + OPENAB_ACP_ENABLED=true; runnable conformance suite at scripts/acp-ws-smoke.py
• Design docs: docs/adr/acp-server-websocket-base.md, method coverage in docs/acp-official-methods.md

Tool-call events, permission requests, and progressive streaming are scoped as Phase 2.

What's Changed

🚀 Features

• feat(acp): ACP server over WebSocket (revives #1260) (#1418)

🐛 Bug Fixes

• fix(feishu): start WebSocket long-connection in unified mode — Feishu/Lark previously never came up under the unified binary; includes bounded identity resolution on startup (#1443, thanks @SunnyYYLin)
• fix(ci): skip pending-maintainer label writes on fork PR review events — fork-triggered runs hold a read-only token and failed with 403 (#1442)

📖 Documentation

• docs: document maintainer take-over of fork PRs (cherry-pick, credit, merge) (#1444)

Full Changelog: openab-0.10.0-beta.1...openab-0.10.0-beta.2

Version Info

• Chart Version: 0.10.0-beta.2
• App Version: 0.10.0-beta.2

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.2

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.2

OpenAB 0.10.0-beta.1

Beta release: please validate in a non-production environment before upgrading critical workloads.

Highlights

Kimi Code CLI backend

• Added Kimi Code CLI as a first-class ACP backend, available in both standalone and unified images. It uses Kimi's native kimi acp adapter, supports interactive authentication with kimi login, and is registered in Helm examples, image builds, smoke tests, and documentation. #1429
• Fixed the package-image Kimi target so pre-beta Kimi images build and publish correctly. #1432

Updated bundled coding CLIs

• Kiro CLI: 2.8.1 → 2.13.0

• Codex ACP: 1.1.2 → 1.1.4

• GitHub Copilot CLI: 1.0.63 → 1.0.71

• Devin CLI: 2026.8.18 → 3000.2.17

• Google Antigravity CLI: 1.1.1 → 1.1.4

  These images now include stronger cross-image pin checks, post-install version smoke tests, and verified release artifacts where available. #1427

• Grok CLI: 0.1.220 → 0.2.106, with refreshed AMD64 and ARM64 SHA256 checksums. #1430

Installation

Helm repository

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.1

OCI registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.1

Full changelog

openab-0.9.0...openab-0.10.0-beta.1

A lightweight, secure, cloud-native ACP harness that bridges Discord, Slack, and webhook platforms to any ACP-compatible coding CLI.

openab 0.9.0 rolls up 12 beta releases (~150 merged PRs) since openab-0.8.5.

✨ Highlights

• Cargo workspace + unified binary — restructured into openab-core / openab-gateway crates with an opt-in unified build that embeds all gateway adapters (Telegram, LINE, Feishu/Lark, Google Chat, WeCom, Teams) in one binary (#1146, #1171, #1173)
• Identity trust framework (trust-none default) — a shared trust gate now guards ingress on every platform, with L3 identity phases for Discord, Slack, and the gateway (#1264, #1266, #1267, #1270, #1273, #1363, #1391)
• First-class platform config sections — [telegram], [line], [wecom], [googlechat], [teams], [feishu] are now fully config-first (credentials + connection), with a CI conformance guard (#1265, #1381–#1385, #1387)
• oabctl operator for AWS ECS — provision and manage OpenAB agents on ECS Fargate, including Telegram/LINE webhook ingress (API Gateway + VPC Link + Cloud Map), scheduling, and scale commands (#1275, #1285, #1296, #1308, #1321, #1336, #1404)
• Ambient mode — batch-flush dispatcher that observes configured channels/threads and lets the agent respond ambiently without @mentions (#1211, #1217, #1220, #1221, #1222)
• New agent backends & auth — Devin CLI support (#1229), Anthropic OAuth (Claude Pro/Max) for openab-agent (#1187), xAI SuperGrok / X Premium device-code OAuth (#1424), multi-vendor OAuth ADR + cross-process auth.json locking (#1190)
• S3/R2 file store — object-store-backed file attachments with streaming multipart upload (#1348, #1351)
• pre_seed lifecycle phase — S3 zip/tar.gz download before pre_boot, enabled by default, with security hardening (#1189, #1196, #1197, #1199)

⚠️ Breaking Changes

• Codex ACP adapter migrated (#1353) — feat(codex)!: the runtime moves off @zed-industries/codex-acp (which pinned Codex core 0.137.0) to the actively maintained adapter, fixing newer-model failures like gpt-5.6-sol; existing OpenAB mode settings are preserved across upstream mode-ID changes. Review docs/codex.md before upgrading Codex deployments.
• Standalone gateway WS path routed through the shared trust gate (#1391) — feat(gateway)!: with the new trust-none default, gateway ingress that previously passed implicitly may now be denied until trust is configured. See the identity trust ADR (#1264, #1291).
• Helm TOML rendering removed (#1277) — the chart no longer renders config.toml from values; use configToml pass-through (#1276) or configUrl instead (ADR #1271).

🚀 Features

Platforms

• Slack: [slack].streaming toggle for send-once mode (#1115)
• Discord: /auth slash command for device-flow auth (#1185), /usage command backed by kiro-cli ACP usage query (#1392), image attachment URL passthrough to agent prompt (#1208)
• Telegram: allow_all_users/allowed_users (#1297), native table rendering (#1313), webhook source-IP logging (#1248), cron support (#1315)
• Google Chat: scheduled-message (cron) support (#1374)
• Gateway: warn when webhook L1 auth is unenforceable (#1373), echo-on-deny (#1273)

Config & Ops

• s3:// config source via -c (#1183)
• default_config_options for auto-setting agent mode/model (#1307)
• Helm: configToml pass-through (#1276), unified image tag format openab:<tag>-<agent> (#1179)
• Force-evict hung sessions so zombie slots cannot exhaust the pool (#1300)

🐛 Bug Fixes

• Surface error on agent EOF without a final response (#1198); diagnostic on empty 0-token end_turn (#1213)
• Slack: bound reconnect-path and socket-write calls with timeouts (#1334); collapse duplicate tool lines in Full display (#1397)
• Discord: truncate select-menu options to the 100-char cap (#1398); clickable URLs in /auth output (#1232, #1240)
• Telegram: thinking-indicator cleanup — emoji reactions only (#1238, #1247, #1249, #1256)
• LINE: no duplicate messages when streaming (#1292)
• agy-acp: surface swallowed backend errors (quota 429) instead of "(no response)" (#1320)
• agentcore bridge: integer protocolVersion per latest ACP spec (#1323)
• pre_seed: safe relative symlinks; lifecycle hooks Unix-only (#1255)
• ANSI escape stripping in /auth output (#1206); ctl thread resolution for single-adapter bots (#1216)
• oabctl: task/execution role wiring (#1280), stage-prefix stripping on private API GW (#1283), ECS-native secret :jsonKey:: suffix (#1288), service drain on delete (#1305), execute-command always on (#1314), cluster resolution from bootstrap state (#1324), scale restricted to oabctl-managed services (#1327)

🏗️ Build, CI & Security

• Runtime base upgraded to Debian Trixie (#1251); Rust builder image pinned by digest (#1246)
• Unified image repo with shared builder and tag-based variants (#1175); one build per arch with packaging fan-out (#1242); stage aliasing to skip Rust recompilation (#1227)
• CI hardening: no expression/script injection in workflows (#1393, #1395), third-party actions pinned to commit SHA (#1396)
• Windows build kept green with cfg(unix) gating (#1231)
• CLI version bumps: kiro 2.8.1, codex 0.141.0 + codex-acp 0.16.0, claude 2.1.179, gemini 0.47.0, copilot 1.0.63, cursor 2026.06.19, opencode 1.17.9, antigravity 1.1.1, pi 0.79.9, hermes v2026.6.19 (#1168, #1371, #1419)

📖 Docs

• Traditional Chinese README (#1347)
• Tailscale integration guide (#1299)
• Reference architectures: Telegram/LINE bots on AWS (#1274), GitHub App token vending machine (#1341), Kiro defined agents (#1403)
• Canary testing guide + fork-PR preview workflow (#1369); frozen Review Contract policy (#1422)
• Schema-driven platform facts knowledge base with CI conformance (#1295)

Full Changelog: openab-0.8.5...openab-0.9.0

Version Info

• Chart Version: 0.9.0
• App Version: 0.9.0

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

Version Info

• Chart Version: 0.9.0-beta.12
• App Version: 0.9.0-beta.12

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.12

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.12

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed since 0.9.0-beta.10

🐛 Bug Fixes

• claude: default agent command is now claude-agent-acp (bare claude is the interactive REPL and broke ACP login), plus version bumps, auth docs, and CI coverage (#1419)
• slack: consecutive duplicate tool lines in ToolDisplay::Full now collapse into a single line with an (×N) suffix — order- and state-preserving (#1397)

🏗️ Refactoring

• oabctl: operator split into a reusable library crate plus a thin CLI binary — downstream control planes can now call typed manifest validation and ECS apply reconciliation in-process (#1404)

📖 Documentation

• Kiro defined-agents reference architecture (#1403)
• Microsoft Teams enterprise guide: Unified Mode section (#1408)
• AWESOME.md: openab-dashboard (#1406)

🔧 Repo CI (contributor-facing)

• /review comment command for targeted PR review (#1412, #1413)
• ⚠️ Stale issue lifecycle: open issues with no linked PR for 14+ days are now automatically commented on and closed as not planned (#1414, #1417). Reopened issues are permanently exempt; manual dispatch defaults to dry-run.

Full Changelog: openab-0.9.0-beta.10...openab-0.9.0-beta.11

Version Info

• Chart Version: 0.9.0-beta.11
• App Version: 0.9.0-beta.11

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.11

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.11

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed (since openab-0.9.0-beta.9)

⚠️ Breaking Changes

• gateway: standalone WS path now routes through the shared trust gate — existing standalone gateway deployments must ensure their trust config passes the gate (#1391)
• codex: migrate to @agentclientprotocol/codex-acp v1.1.2 adapter — old codex command removed from image (#1353)

🚀 Features

• discord: /usage slash command — reports Kiro account billing (credits, overage, plan, cycle reset) via ACP extension (#1392)
• discord: truncate select menu option text to Discord's 100-char limit instead of crashing (#1398)
• cron: support Google Chat platform for scheduled messages (#1374)
• gateway: warn when webhook L1 auth is unenforceable (#1373)
• trust: first-class trust sections for Slack, LINE, WeCom, Google Chat, and Teams (Phase 1) (#1363, #1365, #1366)
• config-first: full per-platform config sections for LINE (#1381), WeCom (#1382), Google Chat (#1383), Teams (#1384), Feishu (#1385) — all credentials and connection settings now live in config.toml

🐛 Bug Fixes

• googlechat: enable config-only startup without gateway (#1390)
• wecom: enable config-only unified startup without gateway (#1389)

🔒 Security

• ci: pin all third-party actions to commit SHA (#1396)
• ci: eliminate script injection in pending-decision.yml (#1395)
• ci: harden release-pr workflow against expression injection (#1393)

📖 Documentation

• ADR: first-class per-platform configuration (#1263)
• ADR: revise identity-trust-none — three-layer architecture (#1291)
• Platform facts: schema-driven knowledge base with CI conformance (#1295)
• Platform quirks: WeCom DM-only L2, ISV id formats, is_bot no-op (#1386)
• Canary testing guide + fork-PR preview workflow (#1369)
• README: refresh architecture diagram and platform list (#1370)

🏗️ Infrastructure

• build: bump agy CLI 1.0.10 → 1.1.1 (#1371)
• test: gateway config-first conformance guard (#1387)

Full Changelog: openab-0.9.0-beta.9...openab-0.9.0-beta.10

Version Info

• Chart Version: 0.9.0-beta.10
• App Version: 0.9.0-beta.10

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.10

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.10

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed (since openab-0.9.0-beta.8)

🚀 Features

• filestore: S3/R2 object store for file attachments with streaming multipart upload (#1348), with hardening and cleanup follow-ups (#1351)
• oabctl: add scale command with EventBridge Scheduler support (#1321); --with-schedule moved to an independent schedule create subcommand (#1336)
• oabctl: support per-service taskRoleArn in manifest (#1316)
• telegram: auto-disable table code-block wrapping for native table rendering (#1313)
• cron: support Telegram platform for cronjobs (#1315)

🐛 Bug Fixes

• acp: use integer protocolVersion per latest ACP spec (#1323)
• agy-acp: surface swallowed backend errors (e.g. quota 429) instead of "(no response)" (#1320)
• oabctl: always enable execute command on ECS services (#1314)
• oabctl: resolve cluster from bootstrap state instead of hardcoding (#1324)
• oabctl: restrict scale to oabctl-managed services only (#1327)
• oabctl: get-config --cluster support and help-text alignment (#1312)
• slack: bound reconnect-path and socket-write network calls with timeouts (#1334)

📖 Documentation

• Reference architecture: running Telegram/LINE bots on AWS (#1274)
• Reference architecture: GitHub App token vending machine (#1341)
• AWS Secrets Manager path for GitHub token setup (#1333)
• AWESOME.md with openab-control-plane (#1342)
• Traditional Chinese README (#1347)

🏗️ Infrastructure

• ci: mention PR/issue author when adding closing-soon label (#1325)
• ci: fix closing-soon comment wording — say "add a new comment", not "push a commit" (#1326)
• ci: accept discordapp.com URLs in PR discussion check (#1345)

Full Changelog: openab-0.9.0-beta.8...openab-0.9.0-beta.9

Version Info

• Chart Version: 0.9.0-beta.9
• App Version: 0.9.0-beta.9

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.9

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.9