@@ -35,6 +35,18 @@ jobs:
       - run: bun run format:check
       - run: bun run lint
       - run: bun run typecheck
+      # The chart's default image tag is its appVersion, and a release must move both together. They
+      # drifted once, appVersion left pointing at a tag that was never published, and a default
+      # `helm install` sat in ImagePullBackOff. This refuses a tree where package.json (the last
+      # version published) and the chart's appVersion have come apart.
+      - name: Chart appVersion tracks the release version
+        run: |
+          pkg=$(bun -e 'console.log(require("./package.json").version)')
+          chart=$(bun -e 'console.log(require("yaml").parse(require("fs").readFileSync("charts/openbot/Chart.yaml","utf8")).appVersion)')
+          if [ "$pkg" != "$chart" ]; then
+            echo "::error::package.json is $pkg but charts/openbot/Chart.yaml appVersion is $chart. The release workflow moves them together; bring them back into line."
+            exit 1
+          fi
 
   # The two packages that are deployables in their own right rather than root workspaces. Root
   # `typecheck` is `bun run --filter '*' typecheck`, and `--filter '*'` enumerates `workspaces`, which
 
@@ -103,6 +103,11 @@ jobs:
           ' -- "$BUMP" > /tmp/version
           version=$(cat /tmp/version)
 
+          # The chart's default image tag is its appVersion, so a release that moves package.json
+          # without moving this leaves a default `helm install` pulling the previous image, or an
+          # image tag that was never pushed. Move them together, every time.
+          sed -i -E "s/^appVersion:.*/appVersion: \"$version\"/" charts/openbot/Chart.yaml
+
           # Unreleased becomes the version, and a fresh empty Unreleased takes its place so the next
           # change has somewhere to go without anyone hand-editing a heading.
           bun -e '
@@ -139,7 +144,7 @@ jobs:
       - name: Preview
         if: inputs.dry_run
         run: |
-          git --no-pager diff -- package.json CHANGELOG.md
+          git --no-pager diff -- package.json CHANGELOG.md charts/openbot/Chart.yaml
           cat /tmp/pr-body.md
 
       # A pull request opened by a workflow does not trigger the pull_request workflows, so the
 
@@ -17,12 +17,6 @@ tells its model the call was refused, with the status and the deployment's reaso
 Python LangGraph Bot already does, and the transcript draws it as a refusal. A tool that answered is
 passed on exactly as before.
 
-### The desktop setup's question box waits for a composed character before it asks
-
-Enter confirms a character being typed through an input method (Japanese, Chinese, Korean). On the
-final setup screen that Enter also sent the question, with its last character still unconfirmed. The
-box now waits for the character to be confirmed, the way a chat composer does, and an ordinary Enter
-still asks.
 ### Revoking a grant with a blank ref or Bot is refused instead of reported as done
 
 `DELETE /api/plugins/grants` checked its query params with truthiness, and a query param is
@@ -62,6 +56,21 @@ no check at all. Both reached the store, where the insert threw an uncaught erro
 caller error. A slug, a title and instructions must be non-empty strings now, the slug pattern is
 tested only after that, and a summary must be absent or a string; anything else is a 400 naming
 the field, before any refusal check, store write, or audit row.
+
+### More endpoints refuse a malformed request instead of coercing it or failing open
+
+The same treatment reached the rest of the write and query surface: the agent tool-call endpoint's
+name and arguments, the policy dry-run and audit-event list limits, a component's publication flag,
+the sandboxed-component fields, and a catalogue entry are each checked and answered with a 400 that
+names the bad field before the store is touched. The four hand-driven computer gestures — click,
+type, key and scroll — validate their own payloads the same way, so a click with no coordinates or a
+key with no key is refused rather than sent to the computer as a no-op.
+
+One of these closed a hole rather than tightening an edge. A component's list of decision functions
+was filtered to the strings in it, so `{"functions":[123,null,{}]}` became an empty list, the
+permission check ran over nothing, and the answer came back `allowed` for functions the caller had in
+fact named. The verdict is about the functions named now, or a 400; an absent list still means none.
+
 ### Generated interfaces, tables and forms
 
 Generative UI is enabled by default; set `OPENBOT_GENERATIVE_UI=false` or `0` to disable it.
 
@@ -139,21 +139,25 @@ Leave `EMBEDDED_POSTGRES` off and set `DATABASE_URL` to point at a database you
 
 ## Main surfaces
 
-| Route                | Purpose                                                            |
-| -------------------- | ------------------------------------------------------------------ |
-| `/`                  | Start and browse channels.                                         |
-| `/agents`            | Create, edit, duplicate, hide, delete, and launch coworkers.       |
-| `/channel/:id`       | Converse with one coworker, watch its screen, and see what it ran. |
-| `/bot`               | Direct chat with a Bot; `?agent=<id>` selects one.                 |
-| `/skills`            | Create and enable personal skills.                                 |
-| `/settings`          | User preferences.                                                  |
-| `/admin/credentials` | Store write-only encrypted credentials.                            |
-| `/admin/computers`   | View, stop, and reset Bot computers.                               |
-| `/admin/boundaries`  | Configure browser/file/MCP action policy.                          |
-| `/admin/components`  | Publish components and govern which Bots may use them.             |
-| `/admin/playground`  | Draft and publish sandboxed components in the browser.             |
-| `/admin/plugins`     | Configure MCP servers, MCP grants, and deployment skills.          |
-| `/admin/audit`       | Review permitted, refused, and failed actions.                     |
+| Route                       | Purpose                                                            |
+| --------------------------- | ------------------------------------------------------------------ |
+| `/`                         | Start and browse channels.                                         |
+| `/agents`                   | Create, edit, duplicate, hide, delete, and launch coworkers.       |
+| `/channel/:id`              | Converse with one coworker, watch its screen, and see what it ran. |
+| `/bot`                      | Direct chat with a Bot; `?agent=<id>` selects one.                 |
+| `/skills`                   | Create and enable personal skills.                                 |
+| `/routines`                 | See the routines that are standing, and stop one.                  |
+| `/settings`                 | User preferences.                                                  |
+| `/admin/credentials`        | Store write-only encrypted credentials.                            |
+| `/admin/computers`          | View, stop, and reset Bot computers.                               |
+| `/admin/boundaries`         | Configure browser/file/MCP action policy.                          |
+| `/admin/components`         | Publish components and govern which Bots may use them.             |
+| `/admin/playground`         | Draft and publish sandboxed components in the browser.             |
+| `/admin/plugins`            | Configure MCP servers and grant their tools to Bots.               |
+| `/admin/skills`             | Write deployment skills and grant them to Bots.                    |
+| `/admin/people`             | List, promote, demote, and remove people who have signed in.       |
+| `/admin/identity-providers` | Register a company SAML or OIDC provider, routed by email domain.  |
+| `/admin/audit`              | Review permitted, refused, and failed actions.                     |
 
 ## Features
 
 
@@ -3,9 +3,10 @@ name: openbot
 description: Run OpenBot on any Kubernetes cluster, managed or your own
 type: application
 # The chart's own version, bumped when templates or defaults change.
-version: 0.1.0
-# The OpenBot release this chart's default image tag points at.
-appVersion: "0.0.4"
+version: 0.1.1
+# The OpenBot release this chart's default image tag points at. Kept equal to package.json's version
+# (the last version published) by the release workflow, and CI refuses a tree where they have drifted.
+appVersion: "0.0.9"
 home: https://github.com/CopilotKit/OpenBot
 sources:
   - https://github.com/CopilotKit/OpenBot
 
@@ -15,7 +15,7 @@ node pool being the wrong shape is the last thing anybody checks. Either run amd
 architecture you have and push it somewhere the cluster can reach. Check before assuming:
 
 ```sh
-docker manifest inspect ghcr.io/copilotkit/openbot:v0.0.4 | grep architecture
+docker manifest inspect ghcr.io/copilotkit/openbot:v0.0.9 | grep architecture
 ```
 
 **Intelligence credentials.** OpenBot requires CopilotKit Intelligence and the chart refuses to
 
@@ -183,9 +183,13 @@ name it. Nothing else in the chart consults it.
 {{- end -}}
 {{- end -}}
 
-{{/* The image, with the chart's appVersion as the tag unless one is named. */}}
+{{/*
+The image, with the chart's appVersion as the tag unless one is named. Published tags carry a `v`
+(`v0.0.9`), and appVersion is plain semver, so the default is prefixed with `v` to name a tag that
+actually exists. A named `image.tag` is used verbatim.
+*/}}
 {{- define "openbot.image" -}}
-{{- $tag := default .Chart.AppVersion .Values.image.tag -}}
+{{- $tag := .Values.image.tag | default (printf "v%s" .Chart.AppVersion) -}}
 {{- printf "%s:%s" .Values.image.repository $tag -}}
 {{- end -}}
 
 
@@ -12,7 +12,8 @@ fullnameOverride: ""
 
 image:
   repository: ghcr.io/copilotkit/openbot
-  # Empty means the chart's appVersion, so an upgrade of the chart moves the image with it.
+  # Empty means the chart's appVersion prefixed with `v` (the form published tags take), so an
+  # upgrade of the chart moves the image with it. A value set here is used verbatim.
   tag: ""
   pullPolicy: IfNotPresent
 imagePullSecrets: []
 
@@ -18,6 +18,7 @@ Regenerate it with `bun run diagram` after changing anything it shows.
 | `agent-computer`         | 4100                       | Chromium, `/workspace`, browser profile, screenshots, snapshots, and file tools.                                                            |
 | `agent-bot`              | 4200                       | Proof-of-concept AG-UI Bot.                                                                                                                     |
 | `agent-langgraph`        | 4201                       | LangGraph AG-UI Bot.                                                                                                                        |
+| `agent-harness`          | 4202                       | The Bot framework harness chosen during setup, one of the `agent-<framework>` images, behind the `harness` compose profile.                 |
 | `supervisor`             | 4500 host / 4300 container | Creates, stops, resets, and lists per-Bot computer containers.                                                                              |
 | PostgreSQL with pgvector | 5432                       | Product data, audit rows, credentials, policy, grants, channels, and components.                                           |
 | CopilotKit Intelligence  | external                   | Durable threads, memory, and realtime gateway.                                                                                              |
@@ -54,6 +55,7 @@ Policy rules can inspect:
 - `page.url`, `page.host`
 - `element.ref`, `element.role`, `element.name`, `element.type`
 - `key`
+- `command`
 - `file.path`, `file.name`, `file.extension`
 - `mcp.server`, `mcp.tool`, `mcp.effect`
 
 
@@ -24,7 +24,9 @@ bash scripts/start.sh
 | `INTELLIGENCE_GATEWAY_WS_URL` | CopilotKit Intelligence realtime gateway URL.                                                         |
 | `INTELLIGENCE_API_KEY`        | Runtime key for the Intelligence project.                                                             |
 
-The three above are required together. Missing any of them stops server startup.
+All five above stop server startup if missing. The three `INTELLIGENCE_` values are additionally
+checked as a set, so a partial set is refused as a misconfiguration rather than treated as
+unconfigured.
 
 `COPILOTKIT_LICENSE_TOKEN` is optional: managed Intelligence issues no licence token, and a
 self-hosted Intelligence that has one sets this and has it forwarded to the runtime.
@@ -51,8 +53,10 @@ at `agent-langgraph` on a laptop.
 | `ANTHROPIC_BASE_URL` | unset                              | Anthropic-compatible endpoint that key is spent against.            |
 | `GOOGLE_API_KEY`     | unset                              | Google key when `BOT_PROVIDER=google`.                              |
 | `GOOGLE_GENERATIVE_AI_BASE_URL` | unset                   | Google-compatible endpoint that key is spent against.               |
-| `BOT_MODEL`          | provider default from Bot code/env | Model used by the shipped Bots.                                     |
+| `BOT_MODEL`          | provider default from Bot code/env | Model for the framework Bot (`agent-langgraph`). Provider defaults are `gpt-5.5`, `claude-sonnet-4-5`, and `gemini-2.5-flash`. |
+| `AGENT_BOT_MODEL`    | `gpt-5.5`                          | Model for the proof-of-concept Bot (`agent-bot`), kept separate because it speaks `/v1/chat/completions` directly and refuses a model it cannot use. |
 | `BOT_RESPONSES_API`  | `false`                            | Makes `agent-langgraph` use the OpenAI Responses API.               |
+| `BOT_REASONING_EFFORT` | unset (provider default)         | OpenAI and the Responses API only: one of `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`. `agent-langgraph` refuses to start on any other value, on a non-`openai` provider, or without the Responses API. |
 | `AGENT_STALL_TIMEOUT_MS` | unset (off)                    | How long a Bot's stream may produce nothing before the turn is ended for it. |
 | `AGENT_TOOL_TOKEN`   | unset; `start.sh` generates one    | The secret a framework Bot presents when it calls a granted tool back through this server. |
 | `APP_DIST_DIR`       | unset                              | Where the built app is, when this process serves it. Set inside the container image; unset in development, where Vite serves the app. |
@@ -128,6 +132,8 @@ in-cluster Service address.
 
 It moves the whole deployment rather than one Bot. The API server reads it for package built-in agents, `agent-bot` reads it for the client it constructs, and `agent-langgraph` reads it for `BOT_PROVIDER=openai`.
 
+`OPENAI_CONTAINER_BASE_URL` overrides that value inside the Bot containers only, for an endpoint the containers reach by a different route than the host does. Unset, the containers use `OPENAI_BASE_URL` like everything else.
+
 The other two providers work the same way under their own names, because they are different APIs rather than different URLs for this one: `ANTHROPIC_BASE_URL` and `GOOGLE_GENERATIVE_AI_BASE_URL`. All three are the names the API server already reads, so one line moves the built-in agents and the Bots together and a deployment cannot end up with half of itself pointed somewhere else.
 
 Model names travel verbatim, so use whatever the endpoint publishes. An endpoint that namespaces its catalogue wants both halves of the name, in `BOT_MODEL` and in the tenant package's `default_model` alike.
@@ -244,11 +250,17 @@ then is a row nothing will read.
 | `COMPUTER_SUPERVISOR_URL`            | Supervisor URL for per-Bot computers. If absent, Bots share `AGENT_COMPUTER_URL`.         |
 | `SUPERVISOR_TOKEN`                   | Bearer token required by the supervisor.                                                  |
 | `AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS` | Local-only private-host browsing when `true`. A deployment running with `NODE_ENV=production` refuses to start while it is set. Cloud metadata addresses are refused either way. |
-| `AGENT_ENDPOINT_ALLOWED_HOSTS`       | unset | Private addresses an agent may be registered at, comma separated. Host, optionally with a port. Exact match; no wildcards. Never-allowed addresses cannot be named. |
+| `AGENT_ENDPOINT_ALLOWED_HOSTS`       | Private addresses an agent may be registered at, comma separated; unset (none) by default. Host, optionally with a port. Exact match; no wildcards. Never-allowed addresses cannot be named. |
 | `AGENT_COMPUTER_POLICY`              | JSON action policy: `{"mode":"enforce","deny":[...],"allow":[...]}`.                      |
 | `COMPUTER_RUNTIME`                   | Set to `runsc` to run supervised computers under gVisor.                                  |
 | `COMPUTER_SANDBOX`                   | Set to `on` to enable Chromium's own sandbox where the host permits user namespaces. Which way it went is printed at start-up. |
 
+`COMPUTER_SANDBOX` is not the cluster sandbox provider. A Kubernetes deployment can instead run each
+computer as a sandboxed pod, selected by `COMPUTER_SANDBOX_NAMESPACE` with `COMPUTER_SANDBOX_IDLE_AFTER`
+and `COMPUTER_SANDBOX_TEMPLATE_FILE` beside it; those are set by the Helm chart, not by Compose, and
+are covered in [charts/openbot/README.md](../../charts/openbot/README.md). The similarly named
+`COMPUTER_SANDBOX` above only toggles Chromium's own process sandbox on a Docker computer.
+
 Changing `COMPUTER_BROWSER_MODE` affects new supervised computers. A computer that already exists is
 left running until its image changes or its container is recreated. To apply a mode-only change to
 all computers while preserving their browser profiles and workspaces, apply the new supervisor