[aaronphifer]

Agent Board now distinguishes recent and quiet reporting, organizes visible agent work, and shows completion outcomes with explicit verification provenance. Version 0.7.0 is prepared on this branch, remains unpublished, and awaits final merge approval. The plugin identity, settings and animated activity indicators are preserved.

Features

• Activity freshness and quiet-reporting indicators without treating long work as stalled.
• Structured completion outcomes, results, failures and explicitly agent-reported checks.
• Project/repository/provider/status filtering and grouping, including project grouping. Attention and summary counts remain global; filters cover the bounded snapshot.
• Connection, refresh and watcher health with compact empty attention presentation.
• Version-aware What's New, persistent version-scoped dismissal and notes that remain accessible.

Reliability

Preserve completion labels beyond preview truncation; qualify cached watcher health after disconnects or failed/overdue refreshes; retain unknown terminal timing when the source supplies no completion time; and omit absent optional metadata for JSON-safe RPCs. Version tests cover 0.6.1/RC → 0.7.0 announcements while retaining prior dismissal preferences and downgrade behavior.

The clean Windows install reproduced the known cold icon import (about 100 seconds, exceeding the existing 20-second hook limit). Vitest now prebundles the real data-only icon package once. No UI mocking, timeout increase or unconditional retry was added. Fresh hosted Windows/Linux runs pass.

Compatibility

BB 0.46.0 is recommended, with fresh official build/package checks. Earlier Linux RC review also passed BB 0.40.0 direct build/install/RPC smoke and production-only installation. The declared BB >=0.40 / public SDK >=0.4.21 floor and development SDK 0.4.34 pin remain unchanged. Stable-version minimum-BB/live-provider smoke was not rerun during hardening; its prior evidence is attributed rather than presented as new coverage.

Existing agent-board identity, settings and attention preferences remain unchanged; no migration/reset is required. Existing ^0.6.1 selectors exclude 0.7.0: after publication, users must explicitly select the new release/range. Pinned tags/commits stay pinned. Fleet/Redteam integrations remain optional.

Security and release hardening

• Assessed all eight supplied GitHub alerts against exact dependency paths and affected APIs. Current shipped/harness code does not establish a reachable exploit for those advisory mechanisms; development-only status was not treated as an exemption.
• Applied minimal compatible fixes: Hono 4.13.5 → 4.13.7, Undici 8.10.1 → 8.10.2, and source-map-js 1.2.1 → 1.2.2. The latter addressed an additional npm build/test advisory; the same Undici patch covers npm's additional reported advisories.
• npm audit --json on the updated stable graph returns zero vulnerabilities. Production dependencies, SDK, BB runtime and Node major were not upgraded. Lockfile root engines now match the existing package floor, with unrelated Linux libc metadata preserved.
• Default-main alerts can remain open until merge/reindexing; none were dismissed or modified. No confirmed release-blocking vulnerability remains in the assessed scope, and no exploit PoC or exhaustive security scan is claimed.
• The actual 68-file package is checked for required assets, fresh frontend/backend agent-board 0.7.0 metadata and exclusion of credentials, databases, tests and internal evidence.
• CI uses official hosted runners, contents: read, immutable official Action revisions, unpersisted checkout credentials and no repository-secret inputs, self-hosted runners, pull_request_target, release jobs or sensitive artifact uploads.

Verification

• Local Windows hardening and stable preparation: 468 tests / 24 files, typecheck and official BB 0.46.0 full build passed. Adapter regression 109 and focused release/dashboard/JSON/public-SDK 37 passed; these counts are subsets of the full suite.
• Hardening CI: all three jobs passed before promotion—Ubuntu/Windows full tests and typecheck, Ubuntu official build/package.
• Stable-head CI on 52f8d516bcfeb0e85a0f4a998c19eb0b674e9be8: all three jobs passed—Ubuntu tests/types 54s, Windows tests/types 1m07s, Ubuntu build/package 42s. Node 24.21.0, npm 11.19.0. No retries or failed hosted jobs.
• Package and both lock versions agree at 0.7.0. Fresh backend/frontend metadata are checked inside the actual packed archive; the old RC artifacts are not reused.
• Earlier Windows RC live Codex/Grok checks and Linux preview provider/recovery evidence remain historical. Newly patched dependencies are validated by fresh local Windows and hosted Ubuntu/Windows checks. New inference sessions, nonempty live Fleet/Redteam, physical-device and minimum-BB stable-version runs are not claimed here.

Documentation

• Dependency advisory assessment
• Compatibility and upgrade
• Validation provenance
• CI and isolated testing
• Prepared release notes

Remaining limits and release status

Nonempty live optional adapter and physical-device coverage remains limited. Older BB community catalog limits affect discovery; direct installation worked. The oldest SDK source-only comparison has eight pre-existing optional queue typing errors also found in unchanged 0.6.1; the development pin differs from host builder SDK stamps. Native Windows host/provider sandbox coverage remains empirical.

This PR stays Draft. Version 0.7.0 is prepared, not merged or published. There is no new public tag, GitHub Release, marketplace change, community announcement or installed stable-plugin update. Final review/merge and subsequent publication actions require explicit maintainer approval.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.