SessionFS

Your AI coding agent never starts from zero again.

SessionFS captures your AI coding sessions and makes them portable across tools — so every agent you work with already knows what happened last session.

Start in Claude Code, resume in Codex. Switch machines, switch tools, or come back tomorrow without re-explaining anything. No copy-pasting, no "let me catch you up."

Quick Start

# 1. Install
pipx install sessionfs

# 2. Run the setup wizard — it auto-detects your tools, starts the daemon,
#    captures your most recent session, and tells you what to ask next
sfs init

# 3. Ask your agent (MCP was installed by init):
#    "what did we do last session?"

# 4. Use your AI tools normally — sessions are captured in the background

# 5. Browse captured sessions
sfs list

# 6. Resume a session (same tool or different)
sfs resume ses_abc123 --in codex

See the full Quickstart Guide for a detailed walkthrough. See Installation for alternative install methods (curl, pip).

Supported Tools

How It Works

The sfsd daemon uses filesystem events (fsevents on macOS, inotify on Linux) to watch native AI tool session storage. When it detects new or updated sessions, it converts them into the .sfs format — a portable directory containing manifest.json, messages.jsonl, workspace.json, and tools.json.

Each tool has its own watcher:

• Claude Code — watches ~/.claude/projects/ JSONL files
• Codex CLI — watches ~/.codex/sessions/ rollout files, reads SQLite index
• Gemini CLI — watches ~/.gemini/tmp/*/chats/ JSON sessions
• Copilot CLI — watches ~/.copilot/session-state/ event files
• Cursor IDE — reads state.vscdb SQLite database (capture-only)
• Amp — watches ~/.local/share/amp/threads/ JSON threads (capture-only)
• Cline — watches VS Code globalStorage task directories (capture-only)
• Roo Code — watches VS Code globalStorage task directories (capture-only)
• Kilo Code — watches VS Code globalStorage task directories (capture-only)
• Antigravity — watches ~/.gemini/antigravity*/brain/ plaintext transcripts for the desktop app, the agy CLI and the IDE build (capture-only)

Sessions are indexed locally for fast browsing via the CLI. Cloud sync is opt-in; the daemon defaults to local-only.

Cross-Tool Resume

# Start in Claude Code, resume in Codex
sfs resume ses_abc123 --in codex

# Start in Gemini, resume in Claude Code
sfs resume ses_def456 --in claude-code

# Cursor sessions can be resumed in any bidirectional tool
sfs resume ses_ghi789 --in gemini

SessionFS converts between native formats automatically — message roles, tool calls, thinking blocks, and workspace state are mapped across tools. See Compatibility for details on which tools support resume and why some are capture-only.

Commands

See the full CLI Reference for options and examples.

Session Search

# Search across all local sessions
sfs search "rate limiting middleware"

# MCP server lets AI tools search your past sessions
sfs mcp install --for claude-code

For Teams & Enterprise

Team Handoff

# Hand off a session to a teammate
sfs handoff ses_abc123 --to sarah@company.com

# Teammate pulls and resumes
sfs pull ses_abc123
sfs resume ses_abc123 --in codex

Cloud Sync (Optional)

# Create an account
sfs auth signup --url https://api.sessionfs.dev

# Push a session
sfs push <session_id>

# Pull on another machine
sfs pull <session_id>
sfs resume <session_id>

Free tier includes 14-day cloud retention with 1 device. See the Sync Guide for setup, conflict handling, and self-hosted options.

Shared Project Context

Share architecture decisions, conventions, and team knowledge with every AI agent working on your codebase.

# Initialize project context (run from inside a git repo)
sfs project init
sfs project edit    # Opens in $EDITOR

# Any teammate with sessions in the repo can read it
sfs project show

AI agents connected via the MCP server can call get_project_context to read the document automatically. See Project Context for details.

Rules Portability

Maintain your project's AI instructions in one place. SessionFS compiles canonical rules into the tool-specific files each AI agent reads — CLAUDE.md, codex.md, .cursorrules, .github/copilot-instructions.md, GEMINI.md — so instructions stay consistent across every tool.

sfs rules init          # pick tools, seed canonical rules
sfs rules edit          # edit project preferences in $EDITOR
sfs rules compile       # write tool-specific files (commit them)

Compiled files are committed by default so fresh clones and teammates without SessionFS still get the same agent contract. Cross-tool resume preflights the target tool's rules file from current canonical rules (Case A/B/D write, Case C skip with warning). Each captured session records rules_version, rules_hash, and a full list of instruction artifacts so you always know what guided the agent. See Rules Portability.

Web Dashboard

A browser-based interface for browsing and managing synced sessions. Accessible at http://localhost:8000 when running the self-hosted server, or at app.sessionfs.dev for cloud accounts.

Self-Hosted Server

docker compose up -d

Starts the SessionFS API server, PostgreSQL, and web dashboard. See the Sync Guide for full configuration.

Session Format

Sessions are stored as .sfs directories:

• manifest.json — identity, provenance, model info, stats
• messages.jsonl — conversation history with content blocks
• workspace.json — git state, files, environment
• tools.json — tool definitions and shell context

All file paths are relative to workspace root. Sessions are append-only — conflict resolution appends both sides rather than merging.

Status

v0.29.14 — Public Beta. 11439 backend tests + 2221 dashboard tests passing. Database migrations 001–133 (067 and 068 unused). 145 MCP tools. Evaluations and model/dataset lineage (#121, #122), record-only: versioned eval suites (inline or hash-only cases, people-only edits), eval runs posted by your own grader with server-computed verdicts, trusted only from a registered independent grader; compare runs; datasets/models/prompts registered as pointers with lineage edges; promotion to staging/production gated on a trusted pass of every required suite on that exact version. SessionFS never runs a model or fetches an artifact. sfs eval, sfs artifact, ten MCP tools, Project → Work → Evals/Artifacts. Migrations 131–133.

v0.29.13 — Public Beta. 11392 backend tests + 2203 dashboard tests passing. Database migrations 001–130 (067 and 068 unused). 135 MCP tools. External contacts (#125): people your org works with who aren't SessionFS users, in Organization → Contacts. Meeting and chat speakers resolve to members, then contacts, then a "To confirm" queue a person works through (extraction never creates contacts); tickets and action items can be owned by a contact (shown as external, never notified); a contact who joins with a verified email becomes the member and their open tickets follow. Emails masked except for owners, admins and the creator; merge, export, erasure and an optional retention sweep. sfs contact, four MCP tools, contacts:read|write scopes. Migration 130.

v0.29.12 — Public Beta. 11361 backend tests + 2185 dashboard tests passing. Database migrations 001–129 (067 and 068 unused). 131 MCP tools. Release gates and deployments record who wrote them (user, service key or webhook, from the credential only; migration 129). Merge readiness is a pure read: approval requests are raised only when something changes (a verdict, a decision, a policy write, the merge-check trigger or a PR/MR webhook). GitLab commit statuses are sent after the event is saved, with a bounded retry inside the webhook deadline; confirming link_meeting_action_item needs the previewed ticket; meeting unlink locks and re-checks like link.

v0.29.11 — Public Beta. 11324 backend tests + 2185 dashboard tests passing. Database migrations 001–128 (067 and 068 unused). 131 MCP tools. Meeting and chat action items suggest the existing ticket they look like (never linked automatically): one click links the item, a picker links any item to a ticket, and linked items show their ticket with Unlink (API, MCP link_meeting_action_item, sfs meeting|chat link|unlink, dashboard). For You shows 10 items per section with Show more, session helper conversations can be renamed, and the helper panel has a Large size. Review-loop and security hardening: retry-safe worker starts, one run per review round, implementers counted across every lease, bounded needs-you and approval gates, share links that stop with their creator's access, and unreadable projects answer 404. Migrations 125–128.

v0.29.10 — Public Beta. 11205 backend tests + 2152 dashboard tests passing. Database migrations 001–124 (067 and 068 unused). 130 MCP tools. Agents, tickets and agent runs on every plan, Free included, with no cap; merge readiness and review-state reads too. Review loops, worker runs and review rounds, workflow templates, releases, the merge check, loop share links and PR/release webhook ingest stay Team+ under the new review_loop feature. Project editors can assign, reassign and unassign tickets (API, MCP update_ticket/assign_persona, sfs ticket, dashboard one-click Unassign); other fields still need the creator or a project admin. The session helper publishes existing tickets to Jira (confirm-first, same path as Promote to Jira) and accepts meeting and chat ranges as proposal sources (GitHub #124). Meeting extraction no longer fails on PostgreSQL when an item's owner matches a participant (GitHub #124), and the project Agents tab shows the project's own agents with an Include org people switch (GitHub #126). No new migrations.

v0.29.9 — Public Beta. 11190 backend tests + 2140 dashboard tests passing. Database migrations 001–124 (067 and 068 unused). 130 MCP tools. Workflow templates (Team+): store a repeatable multi-agent plan (dispatch, fan-out implement, review, verify, document) as a project or org template, versioned; each step names a role, an agent, its dependencies, a fan-out of up to 10 tickets, an exit gate (trusted_clean, an approval policy or none) and a brief. Start one on an issue or a new title to create a review loop with a child ticket per step, then read the plan: step lanes, why each step waits, and the ready tickets with their agents and briefs. Record-only: your own orchestrator starts every agent and reports with step_id; every reviewer step needs its own independent trusted clean, and approval-policy gates wait for an approved request at the current commit. sfs workflow, --step on loop commands, MCP list_workflow_templates, get_workflow_template, start_workflow and get_workflow_plan, a templates editor with a step graph, step lanes on the Loop Board and org templates under Organization → Governance. Migration 124.

v0.29.6 — Public Beta. 10860 backend tests + 2018 dashboard tests passing. Database migrations 001–121 (067 and 068 unused). 124 MCP tools. Approvals (Enterprise): approval policies hold merges (readiness, the GitHub check and the GitLab status) and knowledge-base promotion until the right people approve, bound to the exact commit or entry content; nobody approves their own work, agents only read, and every decision lands in an exportable approval log. sfs approval, three read-only MCP tools, an Approvals page and Org → Governance in the dashboard. Meetings: pasted transcripts get a title and have caption timing stripped, extraction finishes on long transcripts and dates items from the meeting day, items with an unknown owner are kept, and the session helper can save a pasted transcript as a meeting. Migrations 120–121.

v0.29.3 — Public Beta. 10600 backend tests + 1950 dashboard tests passing. Database migrations 001–116 (067 and 068 unused). 118 MCP tools. One call per worker run and per review round, with usage and commit-bound verdicts (sfs loop run start|finish, sfs loop review). A merge check on GitHub and GitLab that turns green only when every linked ticket is ready at exactly that commit. Pull requests, releases and deploys linked to tickets, with a per-release or per-month Ship Report and a model scoreboard (sfs release), share links that show no dollars or emails (sfs loop share), and a Loop Board, Ship Reports and a Review loops inbox in the dashboard. Migrations 113–116.

v0.29.2 — Public Beta. 10482 backend tests + 1908 dashboard tests passing. Database migrations 001–112 (067 and 068 unused). 115 MCP tools. Review loops with budgets: start a loop on an issue with one child task per brief, cap it by tokens, dollars and review rounds, and let a person settle anything it parks (sfs loop start|status|update|close-item). A checklist that learns from review findings, plus per-round reports and project insights (sfs loop checklist|report|insights), and a Review Loop view in the dashboard. Also: a service key now counts as the person who minted it, so two keys from one person can't review each other's work. Migrations 110–112.

v0.29.1 — Public Beta. 10373 backend tests + 1859 dashboard tests passing. Database migrations 001–109 (067 and 068 unused). 109 MCP tools. What agent work costs: agent runs record model, tokens and cost as they go, with spend rolled up per ticket and per project (sfs agent usage|spend, MCP report_agent_run_usage and get_spend_summary); only org owners and admins see dollars. Safe-to-merge checks: sfs loop ready <ticket> --sha <head> and MCP check_merge_readiness say a ticket is ready only when a trusted clean review is bound to that exact commit by someone other than the implementer, with no harmful findings open. Also: structured review findings (round, class, harm, stage), service keys reading project context and wiki pages, and one active ticket per parallel worker. Migrations 106–109.

v0.29.0 — Public Beta. 10264 backend tests + 1859 dashboard tests passing. Database migrations 001–105 (067 and 068 unused). 106 MCP tools. Meeting transcripts: add a meeting to a project or group by pasting text or uploading a caption file, redacted before it is stored; pull out action items, decisions and participants with your own AI key, each tied to the transcript lines it came from; and turn an action item into a ticket through an editable preview (dashboard Meetings view, sfs meeting, six MCP tools). The session helper can read meetings and cite their lines, and now knows who is asking ("my tickets", tickets for a person or persona, groups by name). Also: a quieter tab style across the dashboard and the project Personas tab renamed Agents. Migrations 104 and 105.

v0.28.0 — Public Beta. 10042 backend tests + 1801 dashboard tests passing. Database migrations 001–103 (067 and 068 unused). 100 MCP tools. Ask the session helper about a whole project group (scope menu, sfs helper ask --group). Due dates, estimates and a full change history on tickets (sfs ticket history, Overdue filter), sent to and pulled from Jira. Jira sprints and parent epics on publish, with automatic field detection and no duplicate issues after timeouts or errors. Also: Fetch models on the org AI-key form, a clearer Jira template editor, sweep keys that explain their admin rule, and opt-in Helm CronJobs for every scheduled sweep. Migrations 102 and 103.

v0.27.0 — Public Beta. 9830 backend tests + 1659 dashboard tests passing. Database migrations 001–101 (067 and 068 unused). 100 MCP tools. Assign tickets to people: a ticket can go straight to a teammate, who gets "Your turn" notifications (sfs ticket create|update --user, MCP assigned_user, an Assigned to me filter), and the assignee picker warns when a persona represents nobody. Link tickets to existing Jira issues and choose which side wins: overwrite the issue in Jira or update the ticket from Jira (sfs ticket jira pull). A Jira-aware session helper that reads issues, sends comments to Jira, links, overwrites either side, and creates and publishes a ticket in one confirm. Also: review verdict headers accept any reviewer name, a review-loop guide, and merged projects no longer appear in project lists. Migration 101.

v0.26.0 — Public Beta. 9672 backend tests + 1493 dashboard tests passing. Database migrations 001–100 (067 and 068 unused). 100 MCP tools. Project groups: group an org's projects, grant reader/editor/admin access per group, search knowledge across a group, and optionally restrict members to the projects they can reach (Team and Enterprise; sfs project group, 15 MCP tools). Two-way Jira sync: status, comments and completion evidence flow between tickets and Jira issues through a signed per-org webhook, with custom story templates. Confluence publishing: wiki pages and project context publish to Confluence Cloud with drift protection (Enterprise; sfs org confluence, sfs project confluence publish). A more capable session helper: it reads tickets, wiki pages, agent runs and personas, drafts and assigns tickets and comments with confirmation, and finds sessions by model. Also: a calmer marketplace, Organization → Integrations, ticket detail and project settings, plus fixes for project merges, the transfer panel and PostgreSQL date search. Migrations 096–100.

v0.25.0 — Public Beta. 8967 backend tests + 1189 dashboard tests passing. Database migrations 001–095 (067 and 068 unused). 85 MCP tools. Helper actions: the session helper can propose moving sessions to Trash or turning Auto Narrative on or off, and nothing changes until you press Confirm (access re-checked per target, Trash is reversible for 30 days). A more useful, configurable helper: clickable ticket, project, session, PR and commit references with an in-place ticket preview; answers about SessionFS itself drawn from the official docs with links to the exact section; model settings and custom instructions per user and per org; per-turn token usage with a monthly org budget. Also: filter and sort sessions by model, Test connection for LLM keys with Base URL checks on save, a refreshed dashboard Help page, and a security fix limiting project edits to the owner and org members (people who only synced a session can still read and contribute, but their tickets and knowledge notes wait for approval). Migrations 094–095.

v0.24.0 — Public Beta. 8631 backend tests + 1049 dashboard tests passing. Database migrations 001–093 (067 and 068 unused). 85 MCP tools. Follow tickets: follow or mute a ticket, see "your turn" notifications in a dashboard inbox and sfs ticket inbox, get a digest email, and let agents poll what changed with sfs ticket updates or the MCP tools watch_ticket and get_ticket_updates. 14 LLM providers for the security review, session helper, summaries and Jira drafting, plus any OpenAI-compatible endpoint; reasoning models work behind any gateway (GitHub #102). Also: a redesigned session helper drawer whose citations open the exact message, a crash-safe local session store (deleted sessions stay deleted, atomic writes, uploads re-sent when content changed mid-upload), sfs pull making the local copy match the server, Enterprise features gated on the project's plan, and Helm-generated secrets that persist across upgrades. Migration 093.

v0.23.0 — Public Beta. 8402 backend tests + 972 dashboard tests passing. Database migrations 001–092 (067 and 068 unused). 83 MCP tools. Ask questions across your sessions: the Enterprise session helper answers questions about the sessions and project knowledge you can read, with citations to the exact messages, streaming into a dashboard drawer, sfs helper ask, or the MCP tool ask_session_helper, always on your own or your org's model key. Jira Cloud (Enterprise): promote a ticket to a Jira issue from a reviewable preview, one way. Also: a Changes tab with per-file diffs of what a session's agent changed (GitHub #94), replaying an agent run with an edited prompt or context and comparing runs (GitHub #95), scheduled knowledge-base compiles with an out-of-date banner (GitHub #93), resumable uploads for large sessions (GitHub #91), org admins proposing a project move for the owner to accept (GitHub #96), a weekly org activity digest (GitHub #97), persona activity and history panels (GitHub #92), and Prometheus metrics with a Grafana dashboard for operators (GitHub #90). Migrations 084–092.

v0.22.0 — Public Beta. 7740 backend tests + 815 dashboard tests passing. Database migrations 001–083 (067 and 068 unused). 81 MCP tools. One project per repository: remotes written as ssh://, git://, scp style with any user, with an uppercase scheme or a trailing slash now map to the same project instead of creating a duplicate, and migration 083 rewrites stored remotes and lists any existing duplicate pairs for merging (GitHub #88). Operators get audited merge tools for duplicate accounts (sfs admin override user-merge) and duplicate projects (sfs admin override project-merge, GitHub #89). Also: project pages link by project id, GitLab instance URLs are checked against private and cloud-metadata addresses on save and before every request (SFS_GITLAB_ALLOW_PRIVATE_HOSTS for self-hosted GitLab on a private network), and the SSRF guards handle IPv4-mapped IPv6 addresses. Migration 083.

v0.21.1 — Public Beta. 7609 backend tests + 806 dashboard tests passing. Database migrations 001–082 (unchanged; 067 and 068 unused). 81 MCP tools. Project context you can actually read: project context and wiki pages render as documents (lists, quotes, tables, task lists and code blocks display properly, long ids wrap) with an "On this page" section list on the project Overview. GitLab gets a card in Settings → Integrations to connect, update or disconnect an instance, and GitLab trusted publishing now pins the project's namespace by default (--gitlab-namespace / --no-namespace-pin). Also: the session list no longer nests buttons inside clickable rows, platform administrators always count as Enterprise in plan checks, and GET /api/v1/settings/gitlab no longer returns the stored webhook secret. No migrations.

v0.21.0 — Public Beta. 7591 backend tests + 789 dashboard tests passing. Database migrations 001–082 (067 and 068 unused). 81 MCP tools. A reorganized dashboard that works on phones: a project's 12 tabs are now 5 sections (Overview, Knowledge, Work, Rules & Skills, Settings) with links that survive the back button, account settings and the Organization page are split into tabs, the sidebar is grouped, and every page fits a 375 px screen (GitHub #86, #87), with WCAG AA status colours and keyboard-friendly tabs. Marketplace publishers can now publish straight from GitLab CI with trusted publishing, no stored key needed (GitHub #82). Administrator overrides such as moving a project into an organization are recorded with a reason and the state before and after (sfs admin audit-log, sfs admin override; GitHub #84). Also: sfs --version (GitHub #85) and /health/ready through the Helm ingress now reaches the API (GitHub #83). Migrations 081–082.

v0.20.0 — Public Beta. 7444 backend tests + 667 dashboard tests passing. Database migrations 001–080 (067 and 068 unused). 81 MCP tools. An org persona can stand for a person (GitHub #81): an org admin links an org persona to the member it represents, and that member can keep its role, content and specializations up to date without org admin rights (dashboard, sfs persona represent, MCP represented_user); removing or deactivating the member clears the link, with an audit entry. Project MCP tools now accept the folder an agent is working in as git_remote (resolved through the repository's origin, worktrees included). Migration 080.

v0.19.0 — Public Beta. 7408 backend tests + 663 dashboard tests passing. Database migrations 001–079 (067 and 068 unused). 81 MCP tools. Find the right skill and install it with your tool's own plugin command. Marketplace discovery with categories, filters, safe READMEs, per-tool install counts and freshness flags; native plugin catalogs that Claude Code, Copilot CLI, Codex, Cursor and Gemini CLI add with their own commands (sfs catalog); a per-tool "works in" matrix from a sandboxed verification harness; an org skills policy for Enterprise, enforced on the server and compiled into each tool's managed settings (sfs policy); Git registries that publish their own tags (GitHub #69); and much faster pushes of large sessions (GitHub #71). Migrations 076–079.

v0.18.0 — Public Beta. 6901 backend tests + 636 dashboard tests passing. Database migrations 001–075 (067 and 068 unused). 80 MCP tools. A marketplace you can trust. Before you install a skill, SessionFS shows exactly what it will do in each tool (files, scripts, hooks, MCP servers, network endpoints, shell commands, hidden Unicode); updates that only change text carry your consent forward, while updates that change code or ask for more access stop for re-approval, in the CLI, the daemon and an org admin's "Updates to review" queue. Every version is scanned for dangerous instructions and rescanned as rules improve, with automatic quarantine; moderators and org admins can yank or block packages, and blocks reach every device. Publishers can verify a namespace by DNS or GitHub and publish straight from GitHub Actions with trusted publishing. Also: org-level personas shared by every project in an org (GitHub #70), Antigravity session capture (desktop app, agy CLI, IDE), GitHub App linking that requires a verified GitHub sign-in (closing an installation-claim hijack; GitHub-verified repos reset to owner-attested), fail-closed GitHub webhooks, organization creators as owners, and more careful billing reconciliation. Migrations 065–075.

v0.17.1 — Public Beta. 4020 backend tests + 492 dashboard tests passing. 64 database migrations (unchanged). 79 MCP tools. The daemon now backs off on sessions whose pushes keep failing (1 min, 5 min, 15 min, then hourly, pausing after a long failing streak) instead of retrying every cycle, with the state shown in sfs daemon status and sfs doctor and a new sfs daemon retry-sync. Local cleanup never removes changes that haven't been uploaded yet, and server error logs no longer include session content.

v0.17.0 — Public Beta. 3996 backend tests + 492 dashboard tests passing. 64 database migrations. 79 MCP tools. Agent feedback records let teams record whether an agent's work was useful (routing, summaries, actionability, duplicates, outcomes) and see quality summaries per persona, through the API, 3 new MCP tools and sfs agent feedback. Self-service org membership for enterprises: auto-join by verified email domain, sfs org set-role, and sfs org remove by email or in bulk. Self-hosted fixes: DLP redaction keeps session files intact and also catches secrets in JSON keys and field pairs, NUL bytes no longer break sync, Codex sessions with "info": null are captured, migrations run in order under ArgoCD with a schema-aware readiness probe, and local-license installs start cleanly. Migration 064.

v0.16.1 — Public Beta. 3839 backend tests + 486 dashboard tests passing. v0.16.1 gives Starter the paid sync limits, sets Pro storage to 2 GB, seeds the Marketplace with the SessionFS sessionfs-workflows launch catalog, and hardens hosted publishing. 63 database migrations. 76 MCP tools. Skills and plugins across every tool, plus the SessionFS Marketplace. sfs skill (alias sfs plugin) installs Agent Skills and Agent Plugins from a local path, a pinned Git commit, or a marketplace into every supported tool in one transaction, keeping standard skills byte-for-byte and listing anything a tool can't support. Risky content (scripts, hooks, tool grants) needs explicit consent bound to the exact package version, and sfs skill sync --locked reproduces a project's packages on any machine. The hosted Marketplace shows each immutable version's source, hash, license, risk and per-tool compatibility: browsing is open to every signed-in user, private publishing is Starter+, and Team/Enterprise organizations get registries, assignments and install approvals. 8 new MCP tools let agents search, preview and load approved instruction-only skills, and request installs, without ever writing files or enabling executable content. Migration 063.

v0.15.6 — Public Beta. Site and docs. 3198 backend tests + 459 dashboard tests passing. 62 database migrations (unchanged). 68 MCP tools. The documentation site moves to Astro 7 and Starlight 0.42: no known vulnerabilities in the site build, tables in the docs render properly again, and the docs no longer point to the unavailable remote MCP endpoint. No CLI, server, schema or MCP tool changes.

v0.15.1 — Public Beta. Security patch. 3084 backend tests + 459 dashboard tests passing. 62 database migrations (unchanged). 68 MCP tools. Fixes an authenticated request-forgery flaw in the MCP server present in every release through 0.15.0: project-scoped MCP tools interpolated the caller-supplied git_remote into the API request path, so a crafted remote such as ../admin/users could redirect a request — carrying the user's own API key — to a different endpoint. Because MCP tool arguments are chosen by the model, prompt-injected content could use this to reach API endpoints the MCP surface does not expose. The same flaw applied to every other identifier the MCP server places in a request path — ticket, persona, wiki page, handoff, work-queue, run, entry and session identifiers — and to the hosted remote MCP server. All path parameters now pass through a single shared validator that rejects traversal and percent-encodes each segment; every legitimate value continues to resolve. Also updates PyJWT, urllib3 and anyio to clear published advisories. Upgrade recommended for all MCP users.

v0.15.0 — Public Beta. 3050 backend tests + 459 dashboard tests passing. 62 database migrations. 68 MCP tools. The adoption release — no new platform features by design. sfs init now ends with a demonstrated magic moment (your most recent session captured + ask your agent: "what did we do last session?"); pipx/brew/curl install paths; anonymous activation telemetry (default-on, prominently disclosed, dual opt-out — see docs/telemetry.md); capture-health self-monitoring (the daemon detects and reports format-break degradation instead of silently losing sessions); handoff recipients preview a bounded, redacted transcript before signing up; shared sessions render as public read-only pages at /s/{token} behind a hard DLP gate that scans exactly what it serves and re-scans when content changes. Fixed: SessionFS's own sk_sfs_ keys were excluded from every DLP gate by an allowlist entry — removed, with a dedicated detection pattern added. Migrations 059–062, all proven on PostgreSQL 16. Windows support is planned for v0.16.

v0.14.0 — Public Beta. 2882 backend tests + 442 dashboard tests passing. 58 database migrations. 68 MCP tools. Resident agents + the SSO dashboard. A resident runner — an operator-hosted, always-on agent that drives a work queue by calling your own LLM (no server-side key): a reviewer that posts trusted verdicts and an implementer that writes code in an isolated worktree and can only propose (never merges, never self-closes, never sends code to the server). Includes a server-side resident-memory primitive, living-context hydrate/compaction, fail-closed LLM cost bounding, a sfs resident CLI, a hardened sandbox, and a mandatory high-risk-merge checklist. Plus the dashboard for Organization SSO (backend-only until now): an org-admin surface to configure the OIDC provider, verify domains, arm enforcement, and issue break-glass grants — and a "Sign in with SSO" browser login using a secure single-use one-time-code exchange (the key is re-minted at exchange, never stored or placed in a URL; the code is bound to the authenticating browser). Migrations 057–058, both proven on PostgreSQL 16.

v0.13.2 — Public Beta. Patch: migration 056 no longer recreates uq_org_members_org_user (it has existed since migration 016) — the redundant CREATE raised DuplicateTableError on PostgreSQL. Combined with the v0.13.1 dialect-aware constraint-drop fix, alembic upgrade head now applies the SSO migrations cleanly on PostgreSQL (verified against a prod-accurate schema). Same test/migration/tool counts as v0.13.0.

v0.13.0 — Public Beta. 2669 backend tests + 397 dashboard tests passing. 56 database migrations. 68 MCP tools. Organization SSO (OIDC). Enterprise single sign-on: authorization-code + PKCE login (/api/v1/auth/sso/start + /callback), with anti-takeover account linking (auto-links only on a verified-email match to an already-verified account that is already a member of the IdP's org — identity keyed on (org_idp_id, subject), never the mutable email), JIT provisioning (member-only, seat-capped), owner/admin provider config + DNS-TXT domain verification (client secret stored only as a reference), and org-wide enforcement with an owner break-glass — while service keys (CI / automation) stay categorically exempt. Hardened id_token validation + an SSRF-guarded fetch layer for all issuer-derived requests. New dependency dnspython; migrations 055 + 056. Available on all paid tiers.

v0.12.1 — Public Beta. 2525 backend tests + 397 dashboard tests passing. 54 database migrations. 68 MCP tools. Multi-repo project fixes + autonomous work-queue reviewer path completed. From a heavy user's multi-repo report: sfs project repos no longer crashes, projects can now be renamed (PATCH /projects/{id} + sfs project set --name), promoting a new primary repo demotes the old one instead of unlinking it, and project merge repo-linking is surfaced + proven. Plus the work-queue reviewer now posts trusted verdicts via the settle path (complete_work_queue_step), and org admins can register/revoke trusted reviewers (/orgs/{id}/trusted-reviewers + sfs admin trusted-reviewers) — completing the backend for an autonomous GPT-5.5/Codex reviewer. Additive only; no schema change (migrations 001–054 unchanged).

v0.12.0 — Public Beta. 2487 backend tests + 397 dashboard tests passing. 54 database migrations. 68 MCP tools. Agent work queues + review-verdict trust hardening. An agent (Claude / Codex / Gemini) can be pointed at a queue of tickets and repeatedly woken (via /loop, cron, or CI) to service, review, and close them using SessionFS as the source of truth — no human dispatcher. The server holds all loop state (it resumes with zero chat memory); run_work_queue_step returns one bounded directive at a time, complete_work_queue_step is the only durable advance, and a crash between them re-emits rather than loses or repeats work. Modes: review_until_clean (auto-finishes an item only on a server-verified, trusted, literal VERIFIED-CLEAN), implement_until_done, triage. Built-in safety envelope (attempt cap + 2m→5m→15m→60m backoff → failed for human reset, per-wake cap, cadence floor, dedicated rate limit). 6 new MCP tools (62 → 68); 2 new scopes (work_queues:read/write). Security: review verdicts now require a server-stamped verdict_trusted flag (set from the authenticated identity, never the request body), closing a spoof where a caller could forge a VERIFIED-CLEAN. Migrations 053–054. All tiers.

v0.11.2 — Public Beta. 2418 backend tests + 397 dashboard tests passing. 52 database migrations. 62 MCP tools. Self-service licensing is now usable in the dashboard. v0.11.0 shipped the licensing + org-management backend; this release adds the web UI: a guided license-activation flow (key → previewed org/tier → emailed single-use verification code → land as owner) for users not yet in an org, and organization ownership transfer (owner → admin, two-step with Accept/Decline + expiry). The owner role is shown in the members list and the owner row is protected. Also hardens /me and activation against a transient duplicate-membership race (no more 500s; clean 409). No schema change.

v0.11.1 — Public Beta. 2415 backend tests + 388 dashboard tests passing. 52 database migrations. 62 MCP tools. Patch: hardens the v0.11.0 entitlements backfill migration (a diagnostic statement could fail the upgrade on databases where the backfill recorded notes such as a plan-tier coercion or unmatched license) and restores a green CI. No schema change; no behavior change for databases already on v0.11.0.

v0.11.0 — Public Beta. 2415 backend tests + 388 dashboard tests passing. 52 database migrations. 62 MCP tools. Licensing + organization-management redesign. An organization's plan, seats, and storage now resolve from a single authoritative entitlements record instead of being scattered across user rows and license tables — which is what previously left enterprise admins unable to fully manage their own organizations. On that foundation: self-service license activation with required email verification (an org admin activates a key, then confirms a single-use, time-limited code sent to their address), two-step organization ownership transfer with an explicit owner role, and last-owner safety guards so an org can never be left without an owner. Existing orgs are backfilled deterministically, so no plan changes for anyone. Migrations 050–052 (entitlements foundation + ownership-transfer table + role/status integrity constraints). Backend + dashboard.

v0.10.32 — Public Beta. 2279 backend tests + 388 dashboard tests passing. 49 database migrations. 62 MCP tools. Hotfix: a paying customer whose payment temporarily fails (for example, a declined card that is still being retried) is no longer downgraded to free or disconnected from their subscription — only a cancelled subscription downgrades, so access continues and the account recovers automatically once payment succeeds. Prior feature — Multi-repo projects — a project can now own more than one git repo, so personas / knowledge / tickets / rules are shared across a product's repos instead of duplicated across split projects (migration 049 + project_repos). Verified-ownership repo linking (GitHub App installation proof, owner-attested fallback, verified-beats-unverified reclaim), sfs project link-repo / unlink-repo / repos, and sfs project merge to consolidate split projects (dry-run by default, atomic, audited) with a dashboard Repos tab + Merge surface. Free for all tiers. Also clears freshly-published CVEs (starlette/python-multipart/cryptography + site vite/astro).

v0.10.30 — Public Beta. 2179 backend tests + 369 dashboard tests passing. 48 database migrations. 62 MCP tools. Complete dashboard visual redesign — dark-first OKLCH design-token foundation, a ui/ primitive library (incl. a custom anchored keyboard-accessible Select/Dropdown), a grouped left sidebar, Sessions/Projects list-grid toggles, and a fully rebuilt captured-session conversation surface (tool-aware rendering instead of raw JSON, a real transcript with speaker hierarchy and themed markdown). Brand tagline → "Memory Layer For AI Agents" (dashboard + site). Frontend/site only — no backend, schema, MCP-tool, or auth changes.

v0.10.29 — Public Beta. 2179 backend tests + 198 dashboard tests passing. 48 database migrations. 62 MCP tools. Named auth profiles for multi-account on one device: sfs auth login --profile / use / profiles / whoami, one shared resolver behind every command (coordination + sync + daemon), precedence SESSIONFS_API_KEY > SESSIONFS_PROFILE > active profile > default, per-profile store isolation, daemon profile pinning, atomic 0600 key-file writes. Plus the cloud-only dashboard 428 fix: CORS now exposes ETag so the cross-origin dashboard can replay If-Match on rules saves.

v0.10.28 — Public Beta. 2153 backend tests + 198 dashboard tests passing. 48 database migrations. 62 MCP tools. Bundles four tickets: update_ticket MCP/API/CLI verb (migration 048 ticket_edits audit table; per-field diff + system diff comment + lease_epoch fence + creator/admin authz), admin POST /admin/users/{user_id}/api-keys mint-on-behalf for lost-key recovery, org invite UPSERT over stale rows (declined/expired/orphan-accepted) with SELECT FOR UPDATE, and /compile single-pass auto_generate_concepts (halves LLM latency on real-compile). Also bumps PyJWT 2.12→2.13 to clear 4 CVEs.

v0.10.27 — Public Beta. 2119 backend tests + 198 dashboard tests passing. 47 database migrations. 61 MCP tools. Daemon liveness hotfix (is_excluded guard inside _sync_sessions()) + tier-aware per-file cap discovery (server exposes max_member_bytes in GET /sync/settings; CLI reads it with precedence env-var > server > 50 MB literal fallback). Additive only — no schema changes, no breaking changes; older CLIs ignore the new field harmlessly.

v0.10.26 — Public Beta. (v0.10.25's click<8.4 pin didn't actually fix the CI test failures — typer 0.26 vendors its own click, so BadParameter no longer inherits from click.exceptions.ClickException. v0.10.26 catches both class hierarchies in handle_errors so Deploy API ships.) Underlying v0.10.24/0.10.25 feature set unchanged.

v0.10.25 — Public Beta. 2108 backend tests + 198 dashboard tests passing. 47 database migrations. 61 MCP tools. v0.10.25 is a one-line hotfix pinning click<8.4 so the v0.10.24 Deploy API workflow ships — click 8.4 changed BadParameter exit code + class hierarchy, breaking 2 CLI tests that pass on local .venv but fail in fresh CI installs. Underlying feature set is identical to v0.10.24: Issue/Task rollup (migration 047 adds kind + parent_ticket_id to tickets; full dashboard surface), two enterprise blockers closed from GH #51 (sfs org create 500 + meaningful error envelope), GH #50 MCP persona update/delete parity, click-to-edit session title + alias inline, CORS preflight If-Match allow, Rules-page max-tokens UX, and a new user_is_project_admin actor-side authz helper.

Session capture, resume, and search

• Ten-tool capture — Claude Code, Codex, Gemini, Cursor, Copilot CLI, Amp, Cline, Roo Code, Kilo Code, Antigravity
• Cross-tool resume — start in Claude Code, resume in Codex (and vice-versa with Gemini / Copilot); auto-launches the native tool, full transcript via --append-system-prompt-file with 50-message trim, sfs resume --model to override the model
• Narrative session summaries — LLM-powered what_happened, key_decisions, outcome, open_issues
• Full-text search across all sessions (CLI, dashboard, API), tier-aware
• Session browsing — inspect, export, fork, checkpoint, compare; multi-select bulk delete + Find Duplicates in dashboard
• Message pagination — newest-first default, order toggle, sidechain/empty filtering
• Changes tab — per-file diffs of everything an agent created, edited or deleted in a session, rebuilt from the captured (redacted) tool calls
• Session helper (Enterprise) — ask questions across the sessions and project knowledge you can read and get answers that cite the exact messages, streamed in the dashboard, the terminal (sfs helper ask) or over MCP; uses your own or your org's model key

Project knowledge

• Shared project context — one document per repo, shared across the team, readable via MCP, manageable from dashboard
• Living Project Context — auto-summarize on sync, knowledge entries (6 types), wiki pages with backlinks, structured compilation, concept auto-generation
• Rules portability — canonical project rules compiled into CLAUDE.md, codex.md, .cursorrules, .github/copilot-instructions.md, GEMINI.md; managed-file safety, deterministic output, optimistic-concurrency API; sessions persist rules_version + rules_hash + instruction_artifacts for full instruction provenance
• Scheduled compiles — keep a project's context fresh nightly, weekly or after a number of new claims, with an out-of-date banner and one-click compile
• Knowledge base lifecycle — entry decay after 90 days unreferenced, auto-dismiss past retention, context-document budget, section page caps, concept auto-refresh, quality gates on contributions
• LLM Judge — confidence scores (0-100), CWE mapping, evidence linking, dismiss/confirm workflow

Team and collaboration

• Skills and plugins marketplace — install Agent Skills and Agent Plugins across every supported tool with sfs skill; the hosted SessionFS Marketplace shows exactly what each package can do before you install it, asks again when an update needs more access, scans every version for dangerous instructions, supports verified publishers and trusted publishing from GitHub Actions, quarantines versions a rescan flags, and lets moderators and organization admins yank or block packages, with blocks reaching every installed copy
• Org-level personas — define a persona once for the whole organization and use it in every project; a project persona with the same name overrides it
• Team handoff — email notification, status stepper, session context card, smart workspace resolution
• GitHub PR App (signature enforcement) + GitLab MR integration (per-user webhook secrets, comment dedup) — auto-comment AI session context on pull requests and merge requests
• RBAC with admin and member roles; seat enforcement on invite accept
• Jira Cloud (Enterprise) — promote tickets to Jira issues from an editable preview; one way, the ticket stays the source of truth
• Org administration — weekly activity digest for owners and admins, project-move proposals the owner accepts, persona activity and represent history

Cloud, sync, and reliability

• Resumable uploads — sessions over 8 MiB upload in parts and resume where they stopped
• Cloud sync with push/pull, email verification, ETag conflict detection, bounded per-user concurrency (5 client-side, 3 server-side), 429 + Retry-After backoff
• Connection pool optimization — configurable via SFS_DATABASE_POOL_SIZE/MAX_OVERFLOW/POOL_TIMEOUT/POOL_RECYCLE; sync_push splits into 3 phases so DB connections are held ~70ms (not ~5s)
• Sync atomicity — commit-then-promote blob invariant; temp blob preserved until second commit succeeds
• Self-healing SQLite index with auto-rebuild from .sfs files
• sfs doctor health checks with auto-repair (store, index, daemon, capture health, sync retries, API, auth, config permissions, install consistency)
• handle_errors decorator on all CLI commands (no raw tracebacks)
• Multi-provider email (Resend, SMTP, or disabled for air-gapped)

Agent personas and tickets (v0.10.1)

• Agent personas — portable AI roles per project (atlas, prism, scribe, ...), shared by humans and AI agents; CRUD via sfs persona (CLI) or 5 MCP tools (list_personas, get_persona, create_persona, assume_persona, forget_persona); ASCII name regex (1–50 chars), soft-delete preserves history. Every plan (Pro+ before v0.29.10). Dashboard management UI shipped in v0.10.3.
• Agent run replay — re-run a recorded agent run with an edited prompt, ticket, persona or context and compare the findings of two runs (sfs agent replay|compare, MCP replay_agent_run)
• Agent tickets — full ticket FSM (suggested → open → in_progress → blocked → review → done) with acceptance criteria, context refs, file refs, dependencies, comments; CRUD + lifecycle via sfs ticket (15 commands) or 9 MCP tools (list_tickets, get_ticket, create_ticket, start_ticket, complete_ticket, resolve_ticket, assign_persona, escalate_ticket, add_ticket_comment); atomic state transitions with rowcount-1 guard; agent-created tickets require ≥1 acceptance criterion + ≥20-char description (max 3/session); persona-delete refuses when non-terminal tickets reference it (--force bypass). Every plan (Team+ before v0.29.10). Dashboard UI shipped in v0.10.3.
• Following tickets — subscribe to a ticket and get notified when it changes hands, changes state, or picks up a comment. The creator, assignee, commenters and reviewers follow automatically; anyone else can follow (or mute) with sfs ticket follow/unfollow or the ticket detail's Follow/Unfollow/Mute controls, and agents can via the MCP watch_ticket tool. Notifications are server-generated summaries that never copy comment bodies, coalesced into one row per 15-minute burst, and surface in the dashboard Inbox (with an unread-count bell) and sfs ticket inbox; agents poll them with MCP get_ticket_updates or sfs ticket updates. An optional email digest (off / your-turn-only / all, default your-turn-only) is sent by a scheduled sweep — see the CLI reference and self-hosted docs.
• Compiled persona+ticket context — start_ticket returns markdown context (persona + ticket + criteria + file refs + active KB claims + completed-dep notes + recent comments) sized to the target tool's token budget (?tool=claude-code|cursor|codex|gemini|copilot|generic); same project_id + active-state filters applied across KB claims and dep notes.
• Local provenance bundle — ~/.sessionfs/active_ticket.json written by start_ticket (CLI + MCP) and consumed by all 7 watchers (claude_code/codex/copilot/cursor/gemini/amp/cline); the bundle's ticket_id + persona_name flow into the manifest at capture time and through sync into the sessions table (migration 037).
• Bundle ownership safety — complete_ticket only unlinks the bundle when both ticket_id AND project_id match the completing ticket; bundles written by another tool/session are preserved.

MCP and dashboard

• MCP server (local, stdio) with 145 tools — sessions, knowledge read and write, rules, personas, tickets, external contacts, evaluations and model/dataset lineage, agent runs and feedback, work queues, handoffs, project groups (manage groups, search their knowledge, compile and read a group overview), meetings and chat threads, reminders, read-only approvals, and marketplace tools (search, inspect, diff versions, preview and load approved instruction-only skills, request installs) that never write files or enable executable content. The full list is in the CLI Reference
• sfs mcp install --for <tool> for all 10 tools (stale registration repair, malformed config handling)
• Web dashboard with light/dark mode, resume-first layout, date-grouped sessions, lineage grouping, command palette (Cmd+K), mobile nav, accessibility (focus trapping, ARIA live regions), product identity
• /help page — MCP-first guidance, 10-tool installer with live terminal + copy button, agent prompt examples, curated CLI quick-reference

Security, compliance, and billing

• DLP / Secret Scrubbing — 14 PHI patterns + 19 secret patterns, BLOCK/REDACT/WARN modes, server-side scan of all archive files, sfs dlp scan/policy, dashboard settings tab
• sfs init wizard with auto-detection of 10 tools and optional sync setup
• sfs security scan/fix for config permissions, API key exposure, dependency audit
• Security pipeline — pip-audit, Trivy (rendered Helm chart), Bandit, Dependabot, SECURITY.md; CRITICAL/HIGH blocks the pipeline
• FSL licensing with open-source core and enterprise extensions
• Self-hosted license lifecycle with grace periods, admin CLI, dashboard licenses tab
• Server-side tier gating — 6 tiers (free, starter, pro, team, business, enterprise), 30+ gated features
• Hosted billing with org-isolated checkout and subscription management
• Organization management (sfs org commands)

Self-hosted deployment

• Helm chart (EKS / GKE / AKS tested) with license validation, single-ingress via nginx, seed job
• Hardened security posture — all containers run as non-root (UID 10001) with readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, all capabilities dropped, seccompProfile: RuntimeDefault; PostgreSQL container mounts emptyDir at /tmp and /var/run/postgresql so it works with read-only root; helm test hook pod matches the posture
• Operator metrics — Prometheus endpoint (/api/v1/admin/metrics) and a ready-made Grafana dashboard; see Operator metrics
• See self-hosted docs for the full Security Posture section

On the roadmap

• Session similarity (related-sessions ranking)
• VS Code extension
• Cost analytics dashboard

Telemetry

SessionFS collects anonymous usage telemetry (install ID, version, OS, and funnel event name) to help us understand adoption. No paths, session content, or personal data is ever sent. Disable with export SFS_NO_TELEMETRY=1 or [telemetry] enabled = false in config.toml. Full disclosure: docs/telemetry.md.

Contributing

See CONTRIBUTING.md for development setup, testing, and PR guidelines.

License

Apache 2.0 — Core. FSL (Functional Source License) — Enterprise extensions in ee/.