chore(master): release 0.31.0

[arcbox-labs]

🤖 I have created a release beep boop

0.31.0 (2026-09-11)

Features

• automations: align layout with Codex (#501) (22c337f)
• client: consume brand identity agents/services allowlists (#479) (972a40c)

Bug Fixes

• workbench: skip the catalog of an uninstalled harness (#527) (41087da)

---

This PR was generated with Release Please. See documentation.

[pullfrog]

✅ No new issues found.

Reviewed changes — a release-please cut for the desktop component, the repo's only release-please package. Three mechanical files, no behavioral surface of its own, so this review is verification rather than code reading.

• Version bump to 0.30.1 — .release-please-manifest.json and apps/desktop/package.json both move 0.30.0 → 0.30.1.
• Changelog entry — a new 0.30.1 section dated 2026-09-09 listing the single shipped fix.

Verification performed, all passing:

• Version consistency — all three files name 0.30.1. Grepping for 0.30.1 outside CHANGELOGs returns exactly the manifest and apps/desktop/package.json, so nothing half-wrote the bump. Grepping for the old 0.30.0 outside CHANGELOGs returns zero hits — no drift.
• Bump size — exactly one commit since v0.30.0 (da9c0673): 41087da fix(workbench): skip the catalog of an uninstalled harness (#527). A lone fix: correctly yields a patch bump.
• Changelog completeness — that one fix: is the one entry; nothing is being suppressed by release-please's default changelog-sections.
• No undocumented riders — git log --oneline origin/master --not HEAD^ is empty, proving the PR base is master HEAD, so the tagged tree will match what the changelog describes.
• Compare link resolves — v0.30.0 exists on the remote at da9c0673, which is itself the release 0.30.0 commit, so v0.30.0...v0.30.1 is valid.
• No new release machinery — git diff --stat da9c0673...HEAD^ touches only packages/client/workbench/src/surface/use-agent-catalogs.ts and its __tests__ sibling. No workflow, composite action, packaging script, or toolchain pin moved, so this release exercises no code path a prior signed build hasn't, and a release-desktop.yml dry_run: true dispatch isn't warranted here.

The shipped fix lives in packages/client/workbench, which is shared rather than platform-scoped, so the desktop artifact genuinely benefits from this cut.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — release-please force-replaced this branch: the previously reviewed 0.30.1 cut (46dcf4db) was discarded and recut as 0.31.0 after 972a40c feat(client): consume brand identity agents/services allowlists (#479) landed on master. Still three mechanical files with no behavioral surface, so this is verification rather than code reading.

• Recut to 0.31.0 — .release-please-manifest.json and apps/desktop/package.json move 0.30.0 → 0.31.0 (the abandoned 0.30.1 is gone from both).
• Changelog rewritten — the 0.30.1 section is replaced by a 0.31.0 section dated 2026-09-11 carrying a new ### Features entry for #479 alongside the previously-listed fix #527.

Verification performed, all passing:

• Version consistency — all three files name 0.31.0. Grepping for 0.31.0 outside CHANGELOGs returns the manifest and apps/desktop/package.json, plus one pnpm-lock.yaml hit that is a dependency range (valibot: '>=0.31.0 || ^1.0.0-beta.4 || ^1.0.0-rc'), not a pin.
• Nothing half-wrote the abandoned cut — grepping 0.30.0 and 0.30.1 outside CHANGELOGs returns zero hits.
• Bump size — two commits since v0.30.0 (da9c067): 972a40c feat(client): … and 41087da fix(workbench): …. With bump-minor-pre-major: true, a feat: pre-1.0 correctly yields a minor bump.
• Changelog completeness — both commits appear, in the right sections; nothing is suppressed by release-please's default changelog-sections.
• No undocumented riders — git log --oneline origin/master --not HEAD^ is empty, so the PR base is master HEAD.
• Compare link correctly rebased — git ls-remote --tags origin confirms v0.30.0 exists at da9c067 and that v0.30.1 was never tagged, so v0.30.0...v0.31.0 is the right range for the recut rather than a dangling v0.30.1....

ℹ️ This cut ships packaging-script changes, but not ones a dry run would exercise

git diff --stat da9c067...HEAD^ is 52 files of apps//packages/ source and tests — no workflow, composite action, or toolchain pin moved. #479 does however touch four desktop build/packaging files, including apps/desktop/scripts/verify-artifacts.mts, which is the post-pack gate invoked from exactly one line in build-desktop.yml and therefore has no ordinary CI coverage. That normally argues for a release-desktop.yml dry_run: true dispatch before tagging; here it does not, and the reasoning is worth recording:

• The new verifyNoRestrictedAgentPackages() early-returns on if (!Array.isArray(bundle.agents)) return;, and package-app.mts's new extends overlay resolves to an empty exclude list via agentFilesExcludes(null). Unless the rendered bundle for this release declares agents, both are exact no-ops and the standard packaging path is byte-identical to 0.30.0's.
• The one thing that does run unconditionally in the release-only script is its new module-level import { AGENT_SDK_PACKAGE_PATHS } from '../src/build/agent-package-excludes.ts' — the failure mode #479 already hit once with ERR_UNSUPPORTED_DIR_IMPORT. That is empirically covered: package-app.mts imports the same module under the same bare-node loader, and ci.yml runs xvfb-run -a pnpm -F @linkcode/desktop e2e:packaged → package:devshell → node scripts/package-app.mts --devshell on Linux. agent-package-excludes.ts's only import is a type-only AgentKind, erased before the runtime loader sees it.

The run that first executes the new gate's body for real is a branded release-brand-matrix.yml dispatch, not this tag-driven cut — that is where a dry run earns its keep.

Technical details

# First real exercise of `verifyNoRestrictedAgentPackages` is the branded matrix, not this tag

## Affected sites
- `apps/desktop/scripts/verify-artifacts.mts` — new `verifyNoRestrictedAgentPackages()`; body gated behind `Array.isArray(bundle.agents)`.
- `apps/desktop/scripts/package-app.mts` — new `withFilesOverlay(configPath, agentFilesExcludes(stagedAllowedAgents()))`; no-op when `stagedAllowedAgents()` is `null`.
- `.github/workflows/build-desktop.yml` — `node scripts/verify-artifacts.mts ${{ matrix.platform }}` is the sole invocation; the workflow's `pull_request:` trigger is commented out.

## Required outcome
- Nothing for this PR. Before the first **branded** `release-brand-matrix.yml` run whose rendered bundle declares `agents`, confirm the exclusion + post-pack assertion pair behaves as intended on a real signed pack.

## Suggested approach (optional)
- Dispatch `release-desktop.yml` with `dry_run: true` against a commit whose rendered bundle carries `agents`, rather than against this unbranded tag where both code paths early-return.

ℹ️ Nitpicks

• docs/RELEASE.md "Post-pack verification" enumerates every assertion verify-artifacts.mts makes and was not updated for verifyNoRestrictedAgentPackages. That gap arrived on master with #479 rather than in this diff, so it is not a reason to hold the release — just worth a follow-up so the prose stays the accurate index of that gate.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — release-please force-replaced the branch again after #501 landed on master. The delta against the previously reviewed c55a3eb cut is a single changelog line; the version numbers did not move.

• Changelog gains one ### Features entry — feat(automations): align layout with Codex (#501, 22c337f), added above the existing #479 bullet.
• Version unchanged at 0.31.0 — .release-please-manifest.json and apps/desktop/package.json are untouched by this recut, which is correct: 0.31.0 was already a minor bump and a second feat: doesn't move it further.

Verification re-run against 2415fc7, all passing:

• Version consistency — all three files name 0.31.0. Grepping outside CHANGELOGs returns the manifest and apps/desktop/package.json, plus the one pnpm-lock.yaml hit that is a dependency range (valibot: '>=0.31.0 || ^1.0.0-beta.4 || ^1.0.0-rc'), not a pin. Grepping 0.30.0 and 0.30.1 outside CHANGELOGs returns zero hits.
• Bump size — three commits since v0.30.0 (da9c067): 22c337f feat(automations), 972a40c feat(client), 41087da fix(workbench). With bump-minor-pre-major: true, feat: pre-1.0 correctly yields minor.
• Changelog completeness — all three appear in the right sections; nothing suppressed by release-please's default changelog-sections.
• No undocumented riders — git log --oneline origin/master --not HEAD^ is empty, so the PR base is master HEAD (22c337f).
• Compare link resolves — git ls-remote --tags origin v0.30.0 v0.31.0 returns v0.30.0 at da9c067 and nothing for v0.31.0, as expected pre-tag.
• No new release machinery — git show --stat 22c337f is 49 files of apps//packages/ source and tests plus docs/DEVELOPMENT.md. No workflow, composite action, packaging script, or toolchain pin moved, so this recut adds nothing to the dry-run question settled on the previous review.

ℹ️ This is the first release to ship wire protocol version 80

#501 moved WIRE_PROTOCOL_VERSION from 79 to 80 in packages/foundation/schema/src/wire/message.ts while leaving MIN_COMPATIBLE_WIRE_VERSION at 76. That is the correct call: the only schema change is ScheduleUpdateSchema widening name, maxRuns, expiresAt, and misfirePolicy to accept null (null clears, omission preserves), which adds accepted values rather than removing, renaming, or repurposing anything — exactly the additive case where the floor stays put.

Worth noting only because the desktop app is the vehicle that ships the daemon, and mobile releases on its own cadence: a mobile build stamped 77–79 stays above the 76 floor and keeps connecting to the 0.31.0 daemon. No action needed.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}