Changelog

Fresh off the board.

The headline addition this release is a full card comments feature: flat threaded comments with @mention resolution, unread state, a pinned teaser, and keyboard shortcuts. Alongside that, local board agents ship — account-owned AI agents that run on your own machine and coordinate via a companion process. Markdown attachment previews land too, rendering .md files with a Preview/Raw toggle. A security fix tightens the agent ingress gate by binding the proxy to loopback only. Several internal items round out the release: Claude Code GitHub workflows, linter cleanup, and documentation.

New

  • Comment threads on cardsCards now have a flat comment thread: write and post comments, @mention board members (with avatar chips for resolved mentions), delete your own posts, and see an unread badge on the board tile. The thread opens scrolled to the newest comment, and the board tile's comment glyph opens straight to the comments view. Keyboard shortcuts ⌘↵ posts and closes the composer; Escape preserves an unposted draft. 8f841c0 678d0bf
  • Markdown attachment previews with a Preview/Raw toggleOpening a .md attachment now renders it as formatted markdown instead of raw text, with a Preview/Raw switch above the page. The renderer gains fenced code, inline code, blockquotes, tables, horizontal rules, and h4–h6 support; styles are shared with the card description via a .markdown-render class. 98c7912
  • Account-owned local board agentsAccounts can now set up local AI agents that run on their own machine via the companion process. Agents appear on boards, coordinate on card comments, and are managed through a new onboarding UI in settings. The companion CLI handles pairing, approval, and HTTPS setup. d05e9a5 46dd8dd

Improved

  • All buttons use a consistent rounded-full pill shapeThe shadcn Button component's default shape changed from rounded-md to rounded-full, aligning every dialog, dashboard, and card button with the app's existing pill-shaped controls. No call-sites needed updating. 8f841c0

Security

  • XSS fix in markdown link renderingescapeHtml now escapes double quotes, closing a hole where a URL containing a " could break out of an href attribute and inject an event handler. This path was first reachable via uploaded file bytes in the new attachment preview. 98c7912
  • Agent ingress gate: proxy bound to loopback onlyThe kamal proxy previously published on 0.0.0.0:80 and 0.0.0.0:8443, making the CF-Connecting-IP header that the pairing rate-limiter trusts forgeable by any host that could reach the box. proxy.run.bind_ips now pins both ports to loopback. The ingress verification script was also corrected for Docker's firewall scoping and nftables/iptables compatibility. 85c8cf7

This release refines the board and zoom card experience, improves search and attention flows, expands "my cards" to include cards you created, fixes board layout actions and API placement, and bumps all dependencies to their latest major versions.

New

  • Cards you created now appear in "my cards"The filter for "my cards" previously only matched cards assigned to you. It now also includes cards you created, so your work is easier to find in one place. 14055a7

Improved

  • Attention center and search flows refinedThe attention center rows, search palette, and related keyboard and state handling have been updated for more consistent behavior across the app. Several UI components — including the dashboard, command palette, and mobile menu — received related adjustments. e15c624

Fixed

  • Zoom card view handles overflow and aligns metadata with card controlsThe zoomed card view now handles content overflow more reliably and the metadata section is aligned consistently with the card's own controls. These fixes improve readability when cards have long content. b90150b 7b5278f
  • Board layout actions and API placement correctedLayout actions on the board and their corresponding API endpoints were misplaced or behaving incorrectly. Arrangement, placement, and organization logic have been fixed so board operations work as expected. e33ce3a 385ac54