Versões
O que mudou e quando.
As versões são numeradas, assinadas e acompanhadas de um inventário de componentes de software — sem alterações silenciosas, sem correções não divulgadas. Esta página documenta o que é publicado em cada versão, a começar pela primeira versão pública.
-
0.3
Personal vault, local models and sessions in a container
Every member gets a personal vault for logins, notes and authenticator codes, OpenCode runs on a model served from your own hardware, a session can run in a container, work hands off from a running session in any tool, and the console updates the server itself.
Ver versão no GitHubAdicionado- A personal vault for logins, notes and authenticator codes: every member keeps their own items under Vault (Identity & access), adds a login with a generated password, and copies a password or the current code in one click (the clipboard is cleared 30 seconds later). olivares vault does the same from the CLI, with secrets from files or stdin, never the command line. Items are sealed with the server’s key, not end-to-end encrypted.
- Bring your passwords in and take them out: olivares vault import reads the CSV export of Bitwarden, KeePass, 1Password, Chrome or Proton, and olivares vault export writes every item to one JSON file that olivares vault import reads back. No value is printed or logged.
- Run a model on your own hardware: olivares tool start llama-cpp or olivares tool start vllm starts the llama.cpp or vLLM you installed as a service of the engine, on loopback only and behind a key made at each start, and OpenCode runs on any OpenAI-compatible server at a loopback or private-network address. llama.cpp is measured end to end with OpenCode; vLLM has not been run on real hardware yet.
- Run a session in a container: olivares session start --isolation container, or the Isolation choice in New session, starts the tool in podman, or in Docker where podman is absent, with a read-only root and no capabilities. The container sees only the session’s folder, its account home, the tool’s program and the files governance reads, and tool-call hooks stay in force there.
- Hand work off from a session that is still running, and from Codex, Gemini CLI and OpenCode sessions as well as Claude Code’s. Everything that can be refused is refused before the running session is stopped.
- Update from the console: Settings → Updates shows the running version and the newest signed release in your channel with its notes, and Update asks first, names how many running sessions the restart stops, and runs olivares upgrade, so its verification and refusals are the CLI’s.
- Attach images to a message: paste, drop or choose a PNG, JPEG, WebP or GIF in the console composer, or olivares session send --attach. Claude Code and Codex receive the picture; a tool that takes no images refuses it by name before anything is sent.
Alterado- The edition table records where each capability sits and is the authority for this release. These are Business, and a Community server answers their routes with 501 and keeps their stored data: steering a session another person started (your own sessions work as before), group nesting, the inbound SCIM server, legal holds and erasure with key shredding, privileged-session recording, fleet managed settings, deployment, and approval policies that raise or lower a risk tier or approval count.
- A session belongs to the account that launched it, also when launched with that account’s API token.
- Navigation lists only what works here: a module that is off folds out of the sidebar, the palette and All areas, Settings → Modules turns it on, and its address keeps working.
Corrigido- Sessions survive an engine restart: a session the engine stopped when it shut down is resumed at the next start, in its folder and conversation, through the same checks as a person’s resume. A session stopped by a person or the idle policy stays stopped.
- A container keeps the release olivares upgrade applied across a recreate: the upgrade installs into the data volume, and each start verifies the stored signed release and runs it when it is newer than the image.
- olivares upgrade --enterprise on a Community build installs the Business build of the same version; it used to answer that it was already on that version and install nothing.
- Removing a member is guarded on the server as well as in the People tab: the server refuses removing yourself, the last active owner or a member who outranks you.
- An OpenCode session can edit the files of its folder again, only where the session itself may write.
Segurança- A Claude Code or Codex session on a key from Providers sends its provider only that key; a request carrying another key is refused with 403 and recorded as a high finding on the session, never with the key.
- A session working in a Git folder or linked worktree cannot change the repository’s hooks directory or config file, or move .git away, so the next git command you run there cannot run what the session wrote.
- A session does not start in a folder whose project files carry agent configuration that runs a program or redirects traffic until a person approves exactly that content; one changed character voids the approval.
- A Claude Code session is handed to a person after repeated policy refusals, 3 in a row or 20 in total by default, set per organization.
-
0.2
Session activity, slash commands and skills lifecycle
Claude Code sessions show what the tool is doing, the message box lists the session’s commands and skills, skills packs and tool versions are managed from the CLI and the console, and the access map, the identity inventory and the workspace wiki are now Community.
Ver versão no GitHubAdicionado- A Claude Code session’s Activity tab shows what the tool is doing, read from its own transcript: the task list, agents and subagents, background work, the files it changed with added and removed lines, and its context (model, effort, context tokens, compactions, skills and MCP servers). olivares session show <session> --activity prints the same.
- Type / as the first word of a message to list the commands, skills and agents that the session’s own tool reports, then pick one with the arrow keys and Enter or Tab. Claude Code reports its catalog today; for the other tools the menu says that the tool reported no commands.
- A skills pack follows its whole lifecycle from the CLI, the console and the API: skills update, skills diff, skills pin (an older revision is the rollback) and skills enable or disable per workspace, folder, template, agent group, agent or session. Pinning a skill that acts when it loads needs approval, and skills now also reach Gemini CLI, Grok Build and OpenCode sessions.
- Workspace wiki: olivares wiki init <folder> creates the missing wiki files and assigns the bundled olivares-wiki skill to that folder only. wiki ingest, wiki query and wiki lint run that skill in a Claude Code or Codex session.
- Manage installed tool versions with olivares tool update, tool rm and tool pin per workspace or agent; a pinned version that is no longer installed refuses the launch. Install a third-party CLI or MCP server from a pinned Git or release URL once an administrator admits its catalog entry; the archive digest is checked before the tools folder is touched.
- Move a stopped or failed Claude Code session to another account of the same tool with olivares session move or Move to in the console. Only that conversation’s files are carried, never the login, and olivares session handoff starts a new, linked session in any tool from a summary generated without a model.
Alterado- Model and effort are chosen up front, from the live catalog of the session’s profile, on the New session form, in the launch dialog and from the message bar. A running session keeps its model and effort; choosing another starts a new session.
- The edition table records where each capability sits and is the authority for this release. Since 0.1, the access map, the identity inventory, any number of approval policies that require review or raise the approval count or risk tier, and the workspace wiki are Community.
- A session’s secret_env and a provider credential adapter can no longer set the variables that make a tool run other code, trust another certificate authority, or use another registry or proxy for tools such as yarn, bun, uv, Maven and Gradle, nor git’s GIT_CONFIG* configuration. Registry credentials remain allowed.
- A session that answered and waits for input reads idle in the Sessions list and the API. Before, it read running until five minutes of silence.
- The container image runs on Node 24 LTS; 0.1 shipped on Node 25.
Corrigido- Claude Code sign-in with your own account works from the console: it was used with several real Claude Code accounts on the installed 0.1 release. Sign-in with real Codex, OpenCode and Gemini CLI accounts is not yet verified end to end.
- The deb package lets confined sessions run on Ubuntu 24.04 and other kernels with AppArmor’s unprivileged user namespace restriction. It installs an AppArmor profile for /usr/bin/olivares only and leaves the host’s global setting unchanged.
- The session conversation shows an assistant’s reply as formatted text. The reply is read into elements, never into HTML, so markup in it stays visible as text.
- Confined sessions start when the engine’s TMPDIR is up to 82 bytes long; before, the proxy socket path passed the Unix limit at about 70 bytes.
-
0.1
First two-number release
Community 0.1 is the first two-number release and a fresh installation baseline: upgrade, downgrade and recovery from the 26.x releases are not qualified, and the edition table defines what Community includes.
Ver versão no GitHubAdicionado- Setup offers a provider key or a local model before it installs a tool. Adding and testing an Anthropic, OpenAI or Ollama provider prepares a managed profile and installs its matching tool when the administrator has permission.
- Codex sessions bound to a provider key get the same provider-only network boundary as bound Claude Code sessions, or refuse to start. Grok Build can use a local xAI-compatible HTTP endpoint on loopback or a private network.
- Gemini CLI has a beta ACP session driver and executable discovery. Its profile refuses tool pre-approvals that would bypass Olivares’s permission requests.
- Opt into a separate git worktree with Work in a new git worktree or olivares session start . --worktree. Cleanup refuses to discard unmerged work or tracked changes without explicit confirmation.
- MCP starter definitions cover filesystem, git, Playwright, GitHub and GitLab servers, with declared confinement and network profiles. Cedar conditions can restrict calls by their arguments.
- The signed audit chain also has an RFC 6962 Merkle tree. olivares audit tree saves signed checkpoints and verifies chain proofs offline on SQLite and PostgreSQL.
Alterado- 0.1 is a fresh installation baseline. Upgrades from the retired 26.x packages, downgrades to them and their recovery journeys are not qualified, and native package managers can treat 0.1 as older than 26.x.
- Release identities use two numbers, MAJOR.MINOR. Patch numbers, v prefixes and release suffixes are refused.
- Per the edition table, live console terminals and session steering, departments and agent groups, budgets, Helm and the Kubernetes operator, reports, audit export, SIEM and observability export belong to Business, and installing offline update bundles belongs to Enterprise. Community still verifies bundles with olivares upgrade --bundle --check.
- Existing installations keep their data. Stored approval policies, budgets, group-to-role mappings, department structure and agent-group membership keep their protective effect in Community, which can remove stored policies and budgets but cannot create or change them.
- /v1/agents, /v1/users, /v1/workspaces, /v1/audit and /v1/audit/system return up to 50 rows when limit is omitted, matching OpenAPI. They returned 100 before.
Segurança- The binary, the container images and the Terraform provider are built with Go 1.26.9, which fixes eleven standard-library vulnerabilities in Go 1.26.8. golang.org/x/net moves to v0.60.0.
-
26.10.1
Patch release for 26.10
A patch release for 26.10 with safer provider-key sessions, upgrades that keep your certificate, overrides and AgentOps settings, and fixes across the console, CLI, installer and PostgreSQL installs.
Ver versão no GitHubAdicionado- An installation runs only the modules it selects in Settings > Edition & modules. A module that is off keeps its data and runs no work.
- Sessions run confined to their folder with Linux Landlock, and stdio MCP servers too. Without Landlock, every run says so.
- Sign in Claude Code, Codex and Grok Build through the engine. Start Ollama and pull its models from the console.
- Vault secrets as environment variables for a session or a template. Values reach only the session’s environment; output, approvals and audit show [secret <name>].
- One approval queue in Approvals or with olivares governance approvals approve|reject. For an MCP server, you choose which of its tools run without approval; by default every tool asks.
- New CLI commands, among them olivares session, olivares tool, olivares mcp and olivares login and logout. olivares alone shows this installation and the next step, and no command was removed.
Alterado- Setup is three steps: install a tool, sign it in, start a session. A new session picks how it runs by itself (your tool sign-in first, then the provider key, then a local model) and says which.
- Agent tools no longer use a sign-in stored in the server account’s home. Sign each tool in once from AI tools or with olivares tool login <tool>; the sign-in belongs to your organization.
- An upgrade keeps the certificate the engine already serves. A new installation gets a local CA that also covers the server’s LAN addresses.
- Back up before you upgrade: the database gains nullable columns and a deployment settings record, and rolling back to 26.10.0 is not supported.
Segurança- A session bound to a provider key reaches only that provider’s endpoint, or it does not start. Each tool in such a session runs with its own off switches, such as for non-essential traffic and self-update.
- The console keeps its sign-in in HttpOnly cookies. An approval cannot be granted after its session’s turn ended, was interrupted or stopped.
- olivares dr dump and restore and the backup scripts no longer put database passwords in process arguments.
Corrigido- Upgrades from 26.10.0 recognize the AgentOps service template that 26.10.0 installed and keep operator edits. Native package upgrades keep hand-edited service overrides.
- olivares quickstart works on PostgreSQL, and running olivares db init again no longer breaks the next start.
- Grok Build on Linux without bubblewrap stops before start and asks you to install bubblewrap, instead of failing with HTTP 502.
-
26.10.0
A console built around the work
The console is rebuilt around the work your agents do, agent tools and local models install from the console, sessions can hand work to each other, and the release adds two-factor sign-in and PostgreSQL 15 to 18 for the engine and disaster recovery.
Ver versão no GitHubAdicionado- One console screen lists your sessions as active, waiting for you or settled. A session opens into its run, with checks, last turns and the resources it touched, and every session has a link that survives a reload.
- Install and update Claude Code, Codex, Grok, OpenCode and Ollama from the Agent tools page or with olivares agent tool install. Downloads are checked against the publisher’s release metadata where it exists, and a download that cannot be checked is labeled unverified.
- Register Ollama as a provider without credentials, test it, list its models and bind them to Codex profiles.
- Agent profiles can carry orchestration grants for a workspace, and sessions hand work to each other through MCP tools that follow the same governed paths as the REST API.
- Manage MCP gateways in the console: add, test and remove upstream servers, and choose which tools each session gets. New servers start disabled, and upstream secrets stay in your secrets store.
- Local accounts can add a TOTP authenticator with recovery codes, and a deployment administrator can require it for administrators.
Alterado- Release tags no longer start with v: this release is 26.10.0.
- The engine now listens on every interface by default (:8443 and :8444). To keep it on the local host, start it with --listen=127.0.0.1:8443 --grpc-listen=127.0.0.1:8444.
- Upgrade every replica at once: the database schema moves to version 14, and an older binary refuses the upgraded database.
- The engine starts and upgrades on PostgreSQL 18, and the disaster-recovery restore works on PostgreSQL 15, 16, 17 and 18. PostgreSQL connection strings are now read exactly as PostgreSQL reads them.
Segurança- This release includes a set of security fixes. The full list is in the project changelog on GitHub.
-
26.9.0
Official Codex and Grok session drivers
The official Codex CLI and Grok CLI join Claude Code as session drivers, provider profiles give each configured provider a durable identity, a live session turn can be interrupted from the console, and native installs accept a custom data directory.
Ver versão no GitHubAdicionado- Official Codex CLI and Grok CLI as session drivers: name the pinned official binary on a node (OLIVARES_SESSION_RUNTIME_CODEX_BIN, OLIVARES_SESSION_RUNTIME_GROK_BIN) and that driver is registered there. Readiness is per driver, and no binary is resolved off PATH. Grok runs over ACP; Claude Code keeps its hook-level integration.
- Provider profiles: the durable identity of one configured provider instance on one execution environment (driver, environment, config and user home). Launches require an operable profile, and the console gains a Provider profiles tab (register, rename, disable, retire, source bindings) on its own permission tiers.
- Interrupt a live session turn from the console while the process and the draft stay available for the next turn; work-bound runs carry their exact lease fence, and the interruption is recorded with the authenticated operator.
- Native installs you can shape: install.sh --data-dir and install-agentops.sh accept a custom data directory and an external workspace under a strict path policy; systemd units bind exactly that directory; .apk packages ship a real OpenRC unit; olivares uninstall and olivares doctor corroborate the estate from the unit that actually runs.
- Several sources of the same connector kind at once, each under the operator’s own name; events carry the configured source name, so two sources of one kind stay distinguishable downstream.
Corrigido- 14 fixes, among them: an engine upgrade no longer drops the recorded workspace and AgentOps entries; uninstalling a preserved estate no longer claims the live service; provider-profile authority and replay are fenced on delayed frames; the .apk no longer resets the data directory’s ownership after post-install.
-
26.8.0
First public release
One self-hosted Go binary to run and govern the AI agents you already use — durable work items with fenced leases, four deny-closed enforcement points, a read/write access map with permitted-vs-observed drift, and a hash-chained, signed audit ledger.
Ver versão no GitHubAdicionado- Work plane: durable work items, fenced leases (acquire, renew, release, take over, revoke), launch-for-work and A2A delegation to authorized peers with durable receipts; messages with acknowledgements scoped to an orchestration workflow.
- Governance: Cedar authorization (RBAC + deny-overlay + scoped grants), four deny-closed enforcement points — the Claude Code PreToolUse/PostToolUse hook, an inline /v1/messages inference proxy, an MCP tools/call gate and an A2A delegation gate — two-person approvals, break-glass with dual control and an estate kill-switch.
- Evidence: append-only, hash-chained audit ledger with Ed25519-signed checkpoints; exports to CEF, LEEF, syslog, OTLP and OCSF; push to Splunk HEC, Microsoft Sentinel, Datadog, New Relic and HMAC webhooks; 26 compliance framework catalogs.
- Integrations: 30 modules and 158 integrations — Claude Code at the hook, Codex and Grok Build as first-class command surfaces, gemini-cli, Cursor, opencode, goose, cline, OpenHands, OpenClaw and Hermes as connectors, each stating what it can enforce versus only observe.
- Modules named for the roadmap, all in the community binary with no license check: the MCP catalog and admission (approved agents, MCP servers, skills and templates, MCP admission policies) with the MCP introspection source and the MCP tools/call gate; FinOps budgets that deny or throttle spend, live in the default binary with no provisioning; compliance evidence mapping over 26 framework catalogs with sealed, exportable evidence.
- Distribution: signed archives for linux/darwin (amd64/arm64, FIPS builds alongside), .deb/.rpm/.apk packages with a hardened systemd unit, multi-arch container images on Docker Hub and GHCR (with -fips and -stig variants), a Homebrew cask and a one-command verified installer.
Segurança- The checksums manifest and the container image are cosign-signed (keyless); archives carry SPDX and CycloneDX SBOM attestations plus OpenVEX statements, and the set carries SLSA build provenance; scripts/verify-release.sh from a trusted source checkout verifies the files it recognizes and reports skipped steps. Keyless Sigstore and SLSA checks need network access.
- No mandatory telemetry and no control-plane egress by default; license validation is offline; the one vendor call is olivares upgrade, and --endpoint points it at your own mirror.
Mantenha-se informado
Acompanhe o repositório no GitHub para ser notificado de cada nova versão. O feed RSS é o do blog.
Cada versão é verificável
Binários assinados, atestações SLSA e SBOM acompanham cada versão pública — verifique a proveniência e a integridade de cada artefacto sem confiar em nós.