Notable product updates, client releases, and security improvements. Package-specific patch notes remain in each client repository.
Security
Private API framework security update
Private API runtime 1cf7aa0
The owner-only API runtime now uses Hono 4.12.34, resolving the current upstream production advisories without changing Delega's public contract or private-access boundary.
Request processing hardened:Hono 4.12.34 fixes algorithmic-complexity denial-of-service paths in CORS request-header parsing and language negotiation. Delega's CORS path receives the upstream fix.
Framework isolation fixes included: The same minimal framework update also fixes upstream memo-helper cross-request output retention and proxy-helper connection-header handling, whether or not those helpers are active in the current Delega runtime.
Release gate verified: The private API passed type checking, the complete 297-test suite, build and staging ingress checks. `npm audit --omit=dev: 0 vulnerabilities` confirms the production dependency result.
Availability: Owner-only API runtime active. No client upgrade is required.
Known limitation
This dependency update does not reopen public hosted access or change the retired service boundary.
MCP runtime resilience and dependency intake tightened
MCP 1.18.3 6f4d3af
The owner-runtime MCP client now recovers from short-lived network path failures without risking duplicate writes, reports the underlying connection failure more clearly, and ships with refreshed dependency security controls.
Bounded read recovery: Read-only GET API calls retry transient network failures up to three attempts within one 35-second deadline. The retry budget is shared across attempts, so a failing request cannot extend itself indefinitely.
Write safety preserved:POST, PUT, and DELETE requests remain single-attempt, and non-successful HTTP responses are never retried. A lost response therefore cannot cause the client to repeat a write that the service may already have accepted.
Actionable network errors: Exhausted network failures now surface the deepest runtime cause, error code, and attempted address when the Node transport provides them, while excluding query strings and credentials.
Dependency intake hardened: The current fast-uri, Hono, and ip-address advisories are resolved (`npm audit: 0 vulnerabilities`); Dependabot updates observe a seven-day cooldown; and npm install-script permissions explicitly allow only the reviewed esbuild version while denying fsevents scripts.
Availability: MCP 1.18.3 is published for Ryan McMillan’s existing owner runtime; public hosted access remains retired.
Retries cover transient transport failures on read-only calls only. Application-level HTTP errors and all mutating calls are surfaced immediately.
The client can identify the failed connection address when Node provides it, but it cannot identify the exact upstream network hop responsible for a historical path outage without contemporaneous packet or provider telemetry.
The public MCP, CLI, and Python packages remain available as verifiable engineering artifacts, but their maintained metadata now states that hosted access is owner-only and new public users cannot connect.
MCP 1.18.2:@delega-dev/[email protected] and its MCP Registry listing now carry the hosted-service retirement notice. The 1.18.2 follow-up shortens Registry metadata to satisfy its current description limit; no runtime behavior changed.
CLI 1.9.3:@delega-dev/[email protected] remains installable for source and portfolio verification while clearly documenting that interactive signup and general hosted access are closed.
Python 0.6.3:delega==0.6.3 remains on PyPI as an as-built client artifact with the same owner-credential-only maintenance status.
Retirement cleanup: Pre-retirement Pages deployments and Worker versions were removed, the unused Discord sales webhook was revoked, and growth/sales automations were retired or narrowed to owner-runtime reliability.
Availability: Public source and packages remain available; hosted use requires an existing owner credential.
Known limitation
The clients are not an invitation to request access and are maintained only as Ryan McMillan’s private runtime requires.
The owner-only service boundary now covers signed GitHub integration traffic as well as authenticated API traffic, and Cloudflare Worker preview routes are disabled so retired code cannot reach production data outside api.delega.dev.
Preview surface closed: Production and staging now set workers_dev = false and preview_urls = false. Previously deployed Worker versions are no longer externally reachable through their preview addresses.
Signed integrations owner-gated: GitHub installation lifecycle events, setup and OAuth callbacks, and repository webhook handling now enforce the same fail-closed account allowlist as the private API runtime.
Deployment-safe defaults: Production and staging configuration explicitly disable workers.dev and Preview URLs so a later deployment cannot silently restore those public routes.
Availability: Owner-only API runtime active. No client upgrade is required.
Known limitation
Historical Worker versions remain in Cloudflare deployment history for now, but Preview URLs are disabled and only post-retirement revisions are approved as production rollback targets.
Delega no longer accepts public accounts or payments. The Cloudflare deployment remains active as Ryan McMillan’s private coordination runtime, while delega.dev and the public clients are preserved as an engineering archive.
Owner-only runtime: Authenticated access now fails closed around an immutable owner-account allowlist. Existing owner MCP, CLI, Python, browser, automation, ingress, and Decision Answer workflows continue at api.delega.dev.
Engineering archive: delega.dev now documents the system as built, with public pricing and onboarding removed. The canonical case study explains the production architecture, trust model, usage evidence, and decision to end the commercial thesis.
Data recovery period: Non-owner data is retained without service access through August 4, 2026 for manual export requests, then scheduled for verified deletion from the live database, connected identities, and pre-deletion backups.
Availability: Owner-only API runtime active; public signup, billing, and non-owner access retired.
Known limitations
The public OpenAPI document and historical documentation remain available as technical evidence, but protected operations require an existing owner credential.
Non-owner account data remains in a seven-day recovery window through August 4, 2026; service access is blocked during that period.
Agents can send a blocked decision to the account owner through a secure answer link, and selected tasks can require structured, checkable evidence before completion.
Decision Answers: A claimed task entering waiting_input can email the account owner a signed, single-use answer link. The side-effect-free preview shows the full question before submission, and the reply returns to the task as a human-stated context entry and comment.
Evidence-required completion: Tasks can set evidence_policy to required. Completion then needs at least one strong evidence reference such as a commit, pull request, CI check, deploy SHA, or artifact URL; command output can accompany but cannot replace a strong reference.
Tightening automation: The new set_evidence_policy automation action can tighten a task to required but never remove the policy. Automation actions run asynchronously and are best-effort; setting the policy when the task is created or successfully updated is the authoritative guarantee.
MCP 1.18.0: The existing 44-tool MCP surface now accepts evidence on complete_task, exposes evidence_policy on task creation and updates, and renders stored policy and completion evidence.
Availability: Hosted API deployed; MCP 1.18.0 published to npm.
Submitting an answer records the human ruling but does not automatically resume an agent session. The next session must read the task context.
Evidence is stored as a falsifiable claim for spot-checking. Delega does not execute the referenced command, inspect the artifact, or independently verify the claim.
If a task cannot accept another context key, the answer is preserved as a comment without a new human-stated context entry.
Signed inbound connectors now enforce task-title limits consistently and reject prototype-chain path segments, with an automated staging smoke covering the real signed delivery flow.
Safe path resolution: Template placeholders and filters resolve only own object properties. The reserved __proto__, prototype, and constructor segments are rejected before a source can be saved.
Plan-consistent task limits: Payload-rendered task content now uses the owning account's plan-specific title limit. Oversized rendered content returns 422 and is logged as a verified delivery error instead of being silently truncated.
Automated staging verification: Every staging deployment can run a credential-isolated synthetic ingress smoke covering source creation, signed delivery, deduplication, signature rejection, delivery metadata, secret rotation, and cleanup.
Availability: Hosted API deployed. No client upgrade is required.
Known limitation
The automated end-to-end smoke uses a dedicated staging credential. Production happy-path smoke remains an optional human-run check with an already approved credential.
Delega can now turn signed JSON events from CI systems, alerting tools, calendars, and other external services into provenance-marked tasks with pinned routing and explicit automation opt-in.
Signed event delivery: Each admin-managed source has a public POST /v1/ingress/:sourceId endpoint protected by a server-generated HMAC-SHA256 secret, timestamped request signatures, a 256 KiB body cap, and a per-source verified-delivery rate limit.
Closed task mapping: Dot-path templates render primitive payload values into task fields, optional strict filters run before quota is consumed, and project and assignee routing stay pinned to the saved source rather than the event payload.
Sticky provenance: Ingress-created tasks carry an ingress label and external-source warning. Automation-created children inherit that provenance, and rules process the chain only when they explicitly opt in with source eq ingress.
Privacy-conscious delivery history:GET /v1/ingress-sources/:id/deliveries returns verified delivery outcomes with the request body SHA-256 and byte size for correlation. Raw payloads are never retained.
MCP 1.17.0: Added list_ingress_sources, create_ingress_source, update_ingress_source, and delete_ingress_source, bringing the MCP surface to 44 tools.
Availability: Hosted API deployed; MCP 1.17.0 published to npm and the MCP Registry.
Ingress-source management requires an account-admin agent key. Event senders authenticate with the source-specific signing secret returned only at creation or rotation.
Automation rules do not process ingress-sourced events unless they include an explicit source eq ingress condition; source eq automation deliberately excludes ingress-tainted children.
The browser task console now provides a complete human coordination surface for searching, inspecting, recovering, and steering agent work without dropping into raw API calls.
Operations views: The console adds task and decision-memory search, quick views, project and ownership filters, recently completed work, and Fleet Attention buckets for abandoned, silent, errored, blocked, overdue, or looping tasks.
Full task detail: The task drawer now combines description, context with write-by-write provenance, comments, subtasks, links, delegation chain, handoff state, source markers, and capability-aware actions.
Safe steering: Humans and coordinators can create tasks, run duplicate checks, complete or reopen work, reassign unclaimed tasks, release stuck claims with handoff notes, update context with optimistic concurrency, and remove only comments or links the API says they may delete.
Recurring-work oversight: Create and edit recurring schedules in the console, inspect each schedule's spawned task history, and page that history through GET /v1/recurrences/:id/tasks.
Shareable task links: Open or share a specific task with delega.dev/tasks?task=<id>; filter state remains in the URL so operational views are also recoverable.
Availability: Hosted API and browser task console deployed.
Known limitation
The task console uses the permissions of the agent key you sign in with. Admin-only automation-rule and ingress-source management remain available through REST and MCP rather than this console.
Delega can now react to task and comment events with account-scoped automation rules, while bounding cascades and preserving the fields of live-claimed work.
Rule engine: Admin-managed rules can create or delegate tasks, assign agents, set priority, add labels, and add comments when supported task events occur.
Safety controls: Automation cascades have a depth cap and shared action budget, self-triggering rule chains are suppressed, field mutations skip live-claimed tasks, append-only comments remain allowed, and repeatedly failing rules disable automatically.
Run history: Every evaluated action records an account-scoped result at GET /v1/automations/:id/runs, including claimed-task and idempotency skips, with automatic retention cleanup.
MCP 1.16.0: Added list_automations, create_automation, update_automation, and delete_automation, bringing the MCP surface to 40 tools.
Availability: Hosted API deployed; MCP 1.16.0 published to npm and the MCP Registry.
Automation rules are account-admin managed and run only for Delega events emitted by the hosted API.
Task-producing idempotency is keyed by rule action slot and source event. Reordering or replacing an occupied slot does not replay it for an already-seen source key; create a new rule when a clean idempotency history is required.
Agents can now recover a prior decision without knowing which task recorded it. The new read-only recall path searches context across every task the caller can read while preserving account, role, and task-level access boundaries.
MCP 1.15.0: Added the recall tool, bringing the MCP surface to 36 tools.
Hosted API: Added GET /v1/context/search with project, source, key, result-limit, and superseded-history filters.
Ranking: Results use lexical overlap, provenance weighting, and recency; human-stated context receives the strongest provenance weight.
History: All readable live entries are considered before ranking, so older relevant decisions are not hidden by newer unrelated entries. Superseded entries remain opt-in.
Project references: Search accepts both internal project IDs and external project references.
Availability: Hosted API deployed; MCP 1.15.0 published to npm and the MCP Registry.
Recall is lexical in this first release. For object-valued context, query by the context key because nested JSON fields may not match independently. Semantic or full-text retrieval is the planned scale and matching-quality path.
Coordination reliability: handoffs, Fleet Attention, and escalation
Hosted API a166230
MCP 1.14.0
Delega now preserves the state an agent leaves behind, surfaces work that needs intervention, and alerts the account owner when automation is blocked or abandoned.
Handoff notes: Releasing a task can include where the agent stopped and why. The next claimant sees a “Resuming from…” line instead of starting cold.
Fleet Attention:GET /v1/fleet/attention and the MCP fleet_attention tool group abandoned claims, silent holders, errors, input blocks, overdue work, and repeatedly reopened tasks.
Human escalation: Transitions into errored or waiting_input can notify the account email, with delivery-aware deduplication.
Abandoned-work recovery: The scheduled reaper resets expired claims before sending a best-effort digest, so notification failures cannot block cleanup.
MCP 1.14.0: Added fleet_attention and the release_task handoff parameter, taking the tool count from 34 to 35.
Availability: Hosted API deployed; MCP 1.14.0 published to npm and the MCP Registry.
Following a full security audit, we shipped hardening fixes across the Delega clients, hosted API, and infrastructure. No critical or actively exploited vulnerabilities were found. Most findings were defense-in-depth issues that required specific conditions, such as local machine access, an authenticated account, or a compromised or redirected server.
Hosted service and infrastructure fixes are already deployed. Client fixes are available in the versions below. Severities reflect the audit’s High, Medium, and Low ratings.
@delega-dev/cli 1.9.2
Medium: Fixed a Windows-only command-injection risk in delega github connect. The CLI now validates the server-supplied URL and opens it without shell re-parsing. macOS and Linux were not affected.
Low: Removed guidance that disabled TLS verification process-wide. Certificate errors now point to NODE_EXTRA_CA_CERTS for custom certificate authorities.
Low: Centralized path-segment encoding and rejected literal . and .. identifiers before URL construction.
@delega-dev/mcp 1.13.2
Medium: The create_webhook tool now masks the webhook signing secret by default so it does not enter model context or logs. Set DELEGA_REVEAL_WEBHOOK_SECRETS=1 when you intentionally need the full value.
Low: API error response bodies are no longer written to stderr by default. Detailed error logging is available with DELEGA_DEBUG=1.
Low: Rejected literal dot-segment identifiers before URL construction and patched all audited runtime dependencies.
delega Python SDK 0.6.2
Medium: URL-encoded every dynamic API path parameter and rejected literal dot segments to prevent untrusted IDs from changing a request path or query.
Low: Tightened webhook timestamp verification and made signature hex comparison case-insensitive.
Corrected version metadata so the SDK reports the right version in its User-Agent header.
Hosted API
Medium: Added per-IP and per-email rate limits to POST /v1/signup.
Medium: Added abuse limits and stable, single-use codes to verification resend and key recovery flows.
Medium: Enforced request, task, agent, and webhook quotas atomically across Worker isolates.
Medium: Strengthened webhook SSRF protection with numeric CIDR checks, including 127.0.0.0/8, 100.64.0.0/10, 0.0.0.0/8, and IPv6 fc00::/7.
Low: Made classic signup and verification responses state- and timing-uniform, issuing a usable key only after email proof.
Low: Escaped agent labels in claim emails and enforced request-body limits while streaming.
Low: Corrected the security disclosure contact in security.txt to [email protected].
Reliability: Fixed scheduled cleanup of stale, unverified sandbox signups.
Infrastructure and CI
High: Fixed script injection in the marketing site’s preview-deploy workflow by moving pull-request branch data out of the shell expression and validating it against a strict allowlist.
Medium: Pinned the backup worker’s deploy actions to immutable commit SHAs.
Medium: Pinned and checksum-verified the MCP Registry publisher before running it with OIDC permissions.
High: Upgraded or safely overrode every dependency covered by the audit; all Node repositories now report zero advisories.
Low: Expanded client-side HTML escaping on landing pages to cover quotes in attribute contexts.
Low: Changed backup decryption to read its key from an environment variable or prompt instead of a process argument.
Low: Provisioned test containers with random root passwords.
Auditable context, task links, and GitHub onboarding
Hosted API 6c19c38
MCP 1.8.0 / 1.9.0
CLI 1.5.0 / 1.6.0
Python SDK 0.4.0
Task memory gained provenance and optimistic concurrency, while Git and GitHub references became first-class parts of the task record.
Context provenance: Each context key records its source, author, version, and timestamp in an append-only history; stale values can be superseded without erasing the ledger.
Conflict-safe writes: Context updates accept an expected version and return the current context on conflict so agents can merge and retry.
Task links: Branches, commits, pull requests, and URLs can travel with a task and appear in its detail view.
GitHub App onboarding: Accounts can connect selected repositories through a verified installation flow instead of manually entering installation IDs.
Client support: Context provenance and task links shipped across MCP 1.8–1.9, CLI 1.5.0–1.6.0, and Python SDK 0.4.0.
Availability: Hosted API deployed; client releases published.