Everything notable that shipped in spruce-grove over the past 60 days, with plain-language breakdowns of what it is, what it does, and why it matters — plus a complete index of the smaller work.
952
commits
113
features
150
bug fixes
61
tools
22
agents
65
plugins
Extensibility & Plugins 3 headliners
The platform keeps growing by composition, not by core bloat. These three changes formalized how plugins and external packages load, and hardened the boundary between core and userland.
Entry-point plugin discovery
7f5ba17 · 2026-08-14 · feat
What it is
Plugins can now register themselves through Python package entry points, not just by living in a directory. The loader discovers installed distributions advertising the spruce_grove.plugins group at import time.
What it does
Lets plugin authors ship their work as a normal pip-installable package; the moment the package lands in the environment, it appears in spruce-grove alongside user-dir plugins without any config editing.
Why it matters
It turns a fork-and-pray ecosystem into a real distribution model. Upstream used this to extract the built-in plugin suite into code-puppy-core-plugins on PyPI — and it means any team can ship an internal plugin bundle the same way.
Installed core-plugin version surfaced at startup
0dd7f79 · 2026-08-15 · feat
What it is
The CLI now prints the version of the installed code-puppy-core-plugins package on startup, alongside the app version.
What it does
Shows two independent numbers in the startup banner: the app version and the version of the companion plugins package, since they rev separately after the plugin-extraction refactor.
Why it matters
Eliminates the whole class of "why does that plugin behave differently for you" confusion. When the core repo and the plugin package drift, the drift is now visible in the first line of output instead of manifesting as a phantom bug.
Project-tier plugin trust gate hardened
beeab61 · 2026-08-10 · fix
What it is
When spruce-grove is launched from a directory containing its own .spruce_grove/plugins, those plugins now load only after explicit trust approval — and running from ~ no longer accidentally treats your personal plugins as untrusted project code.
What it does
Adds a guard that returns None from get_project_plugins_directory() when the resolved path equals the user plugins dir, so the trust-gate applies only to actual repo-bundled code, never to your own home-profile plugins.
Why it matters
Closes a security hole where checking out an arbitrary repo and running spruce-grove in it would auto-load that repo's plugins without consent. Malicious repos can't inject behavior just by containing a plugins directory.
Reliability & Durability 3 headliners
Long-running agentic jobs used to face the entire Unix gauntlet: crashes, suspend/resume, network blips. This cycle made persistence a first-class concern instead of an afterthought.
Pickle replaced with versioned JSON envelopes
30edbc8 · 2026-08-15 · feat
What it is
Session and state persistence moved off pickle (Python-specific, version-fragile, unsafe to deserialize) and onto a versioned JSON envelope format with explicit schema migration.
What it does
Every persisted record now carries its own format_version and deserializes through a whole-tree migrator that validates on read and can roll forward old formats without breaking.
Why it matters
Pickles from an old spruce-grove version routinely crashed new versions in place. Versioned JSON survives upgrades, is human-inspectable, can be diffed, and removes an entire class of RCE risk from tampered state files.
Self-healing session-format sweep
1659081 · 2026-08-16 · fix
What it is
A migration pass that scans all saved sessions at startup and upgrades any in an old format, instead of failing on the first stale file.
What it does
Runs a quiet sweep at boot; when it finds a legacy session it rewrites it to the current envelope format in place and continues, with per-file errors logged to a transient channel instead of spamming the console.
Why it matters
Previously a single ancient session file could brick startup until someone deleted it by hand. Now the system absorbs its own history, and the failure-degenerate case (corrupted format) is contained to one log line.
Goal resume by stable UUID
90fde59 · 2026-07-22 · feat
What it is
Interrupted long-running goals can now be resumed by a durable UUID instead of whatever ephemeral session handle they happened to have.
What it does
Every goal gets a stable identifier written into the durable store on creation; killing the process mid-goal and restarting lets you reference that UUID and pick up where the DAG left off, toolcalls-as-checkpoints.
Why it matters
Before this, a laptop sleep or a core dump meant restarting a multi-hour orchestration from scratch. UUID-resume turns goal execution into something closer to workflow engines like Temporal — while staying in-process.
Agents & Orchestration 3 headliners
The core promise of spruce-grove is that delegation is cheap and safe. These changes made the recursion bounded, the failures recoverable, and the prompts identity-stable.
Bounded sub-agent recursion depth
350c5c66 · 2026-07-21 · feat
What it is
A hard cap on how deeply sub-agents can delegate to other sub-agents, enforced at invocation time.
What it does
Tracks agent invocation depth per session and refuses to start another nested level once the cap is reached, emitting a clear error instead of spinning into infinite recursion.
Why it matters
Nested delegation is powerful but has a catastrophic failure mode: an agent hallucinating its own name as a delegate target and invoking itself forever, burning tokens until rate-limit. The cap makes the failure immediate and legible.
Dead-model fallback on pinned sub-agents
12c5c3c · 2026-08-11 · fix
What it is
If an invoked sub-agent has a specific model pinned and that model is currently dead or unavailable, the invocation now falls back to a working model instead of hard-failing.
What it does
Catches model-resolution errors in the delegation path, logs a scoped warning (deduplicated per conversation, not per process), and retries with the next available provider for that agent's tier.
Why it matters
Model catalogs go stale. A marketing-model name gets deprecated and suddenly a whole orchestration tree dies because a leaf agent can't spawn. Fallback keeps the workflow alive with degraded capability rather than dead.
Sub-agent identity/depth prompt injection
b519df9 · 2026-07-23 · feat
What it is
Every sub-agent invocation now prepends an explicit system-context block describing the agent's own name and how deep in the delegation stack it is.
What it does
Frames the delegation-chain position for the model: you are QA-Kitten, 2 levels deep, spawned by Pack Leader. Models answer differently and more conservatively when they know their own place in the tree.
Why it matters
Anonymously-nested models exhibit hallucinated authority: a deep-nested agent starts emitting "let me delegate that further" because it can't tell it isn't the orchestrator. Identity prompts measurably reduce unnecessary fan-out.
Models & Providers 3 headliners
New frontier models keep shipping with weird knobs. This cycle handled three of them: per-tool guardrails for the sharpest new model, a generalized request-param surface, and OAuth for baselines that needed it.
Per-tool guardrails for GPT-5.6 family
5ce5975 · 2026-07-21 · feat
What it is
Models in the GPT-5.6 family can now be gated per-tool: some tools allowed, some blocked, based on a per-model safety profile.
What it does
Reads a model-family capability map at agent setup; a GPT-5.6-backed agent gets its available tool list filtered so, for example, file-writing tools may be disabled while read-only tools remain.
Why it matters
The newest models are the least predictable. Shipping them with a full toolbox means inheriting every regression immediately. Per-tool gating lets you adopt frontier models for read-heavy agents first, and only widen the tool scope as trust grows.
User-defined custom request params per model
d08b6c9 · 2026-08-01 · feat
What it is
A pass-through config surface letting you attach arbitrary key/value params to any model's request payload without forking the provider.
What it does
Reads extra params from the model config (e.g. "request_params": {"reasoning_effort": "high"}) and merges them into the HTTP payload that provider actually receives.
Why it matters
Every new model ships with some bespoke API knob that the codebase doesn't know about yet — new thinking modes, new safety tiers, whatever. This is the escape hatch that means you never have to wait for a code release to enable one.
Meta Muse OAuth provider
c0e26247 · 2026-08-05 · feat
What it is
Full OAuth support for Meta's Muse model family, with token lifecycle handled the same way as the existing Claude and Codex OAuth paths.
What it does
Implements the Muse auth flow (browser-redirect + token refresh + encrypted storage) and exposes Muse models in the model factory under the muse: prefix once authenticated.
Why it matters
Muse is a meaningfully different price/latency profile from the incumbent providers; without this, using it required manual bearer-token wrangling. Now it's a one-time login flow, like everything else.
Observability & Telemetry 3 headliners
An agent that can't report its own token usage is a black box. This cycle made the reporting granular, lossless across providers, and end-to-end timestamped.
Per-run token usage and latency
ccc81e7 · 2026-07-24 · feat
What it is
Every agent run now reports granular token consumption and wall-clock latency at turn-end.
What it does
The turn-completion telemetry includes prompt/completion token counts (broken out by cache-read vs cache-write where the provider exposes it) and the millisecond duration from first request to final stream close.
Why it matters
Cost debugging used to require correlating provider dashboards to session logs. Now the ground-truth economics are in the same place as the conversation, making "why did that four-step task cost 90k tokens" immediately answerable.
Sub-agent invocations now reliably surface their own token-usage back into the parent session's telemetry, and the triad of cache-write-cost hallucinations, provider-reported drift, and reporting regressions were closed in a single sweep.
What it does
Plumbs sub-agent token counters through the delegation finish protocol so the parent's usage pane reflects the leaf work, and normalizes providers' differing cost-reporting semantics so the display never invents numbers.
Why it matters
Before this, a Pack Leader spawning four sub-agents would report only its own (small) token cost, hiding the real total. The observability was silently lying, and any cost-allocation decision made from it was wrong.
timestamp_heartbeat plugin
5ae287b · 2026-07-23 · feat
What it is
A plugin that stamps a __SYS_TIMESTAMP__ field into tool results every N calls, so every result in a session has a coarse but consistent clock.
What it does
Hooks the tool-callback chain; on every k-th invocation it appends a timestamp block to the result payload, giving downstream log parsers and the model itself a time anchor.
Why it matters
Long sessions drift. Models lose track of wall-clock time in extended context, leading to subtly-wrong time-sensitive reasoning ("is that before or after my context window started"). A heartbeat counter is cheap and durable.
New Since Last Curation auto-detected
Feature commits detected by the pipeline that haven't been
curated into deep-dives yet. These render straight from the changelog so the page
never goes stale between curation passes.
left sidebar navigation across all pages, mobile-optimized
a1b20a8e · 2026-08-24 · feat
What it is
A feature that landed since the last curation pass.
What it does
See commit a1b20a8e in the repo for the implementation diff.
Why it matters
Auto-detected — a curated narrative will be added on the next observatory curation pass.
sortable, filterable plugin sidebar
3cdb0825 · 2026-08-24 · feat
What it is
A feature that landed since the last curation pass.
What it does
See commit 3cdb0825 in the repo for the implementation diff.
Why it matters
Auto-detected — a curated narrative will be added on the next observatory curation pass.
master-detail plugin ecosystem explorer
dba4cd94 · 2026-08-24 · feat
What it is
A feature that landed since the last curation pass.
What it does
See commit dba4cd94 in the repo for the implementation diff.
Why it matters
Auto-detected — a curated narrative will be added on the next observatory curation pass.
white logo toolkit plugin + white logo for grove theme
25bd211e · 2026-08-24 · feat
What it is
A feature that landed since the last curation pass.
What it does
See commit 25bd211e in the repo for the implementation diff.
Why it matters
Auto-detected — a curated narrative will be added on the next observatory curation pass.
sweep legacy page bodies to WCAG 2.2 AAA body-text contrast
7402d085 · 2026-08-18 · feat
What it is
A feature that landed since the last curation pass.
What it does
See commit 7402d085 in the repo for the implementation diff.
Why it matters
Auto-detected — a curated narrative will be added on the next observatory curation pass.
