v0.4.2 — enterprise-review fixes

Patch release addressing four findings from a post-v0.4.1 enterprise review. No user-facing behavior changes; correctness, documentation, and metadata.

Fixed

#	Severity	What
1	Medium	Go-side schema migration. Python's _migrate was the only path that added parent_id and created_unix to legacy DBs. The Wails UI opening against a pre-v0.2.2 DB would hit no such column on every read. Now the Go store ports the same BEGIN IMMEDIATE + PRAGMA table_info + ALTER + backfill sequence on a single pooled connection, with a regression test seeding a v0.2.1-shape DB and verifying end-to-end recovery.
2	Medium/Low	ui/README.md clean-checkout instructions. The old "validate the code compiles cleanly" block listed go build ./... standalone, but the //go:embed all:frontend/dist directive makes that fail before the frontend has been built. Rewrote with explicit ordering: frontend first, then any Go command (build, test, golangci-lint).
3	Low	Sidebar badge ↔ inbox view consistency. The desktop UI's per-recipient badge counted all unread + approved messages, but each recipient's actual inbox view filters unread to priority = info (action / urgent stay in the operator's pending queue until approved). Clicking a badge expecting mail and finding nothing is the kind of paper cut that erodes trust quickly. Aligned the predicates and pinned by a new test.
4	Low	Version metadata sync. ui/frontend/package.json and ui/wails.json:info.productVersion had drifted to 0.3.0 while Python was at 0.4.1. All four version strings now match.

Tests

• Go: 9 passing (was 7) — added TestMigrateLegacyDB and TestStatsByRecipientMatchesListForRecipient
• Python: 159 passing (unchanged)
• Total: 168

CI

12/12 cells green: lint (ruff + golangci-lint) + pytest × 4 Python versions on Linux + macOS + Windows + Go tests on 3 OSes + Wails build smoke (darwin/universal). Branch protection ruleset still gating ci-all-green.

Roadmap pointer

ROADMAP.md — what's likely (Dependabot, CodeQL, coverage upload), what's maybe (Claude Code hooks bundle, slash-command skills, agent-inbox install subcommand, PyPI publish), what's explicitly out of scope (cross-host, multi-tenant, mobile companion).

v0.4.1 — first public release

First public release of agent-inbox — a single-host message inbox for coordinating multiple AI coding agents that share one operator and one workstation.

What it is

When you run multiple AI coding agents on one workstation — say a Claude Code session for architecture, a Codex CLI session for implementation, and another for review — they work in isolation. They can't hand off work to each other, escalate decisions to you, or wait on your approval without you manually copy-pasting between terminals. The operator becomes the bus.

agent-inbox is a shared local inbox: one SQLite file plus an MCP server that any agent can call. Agents are registered by dropping a markdown brief into a directory; they then send, reply, check, and long-poll for new mail through standard MCP tools. The human operator manages approvals from a CLI or the bundled Wails desktop UI.

Vendor-neutral. Works with any MCP-capable client — Claude Code (CLI and Desktop), OpenAI Codex (CLI and desktop app), Cursor, Cline, Continue, Zed AI, anything else that speaks the Model Context Protocol.

What's in the box

• MCP server (Python, FastMCP) — nine tools: inbox_check, inbox_read, inbox_send, inbox_reply, inbox_mark, inbox_search, inbox_agents, inbox_brief, inbox_wait
• Operator CLI — agent-inbox command for the human user with twelve subcommands (list, read, send, approve, reject, watch, etc.)
• Wails v2 desktop UI — Go backend + Svelte 4 + Tailwind frontend, builds to native binaries for macOS (Intel + Silicon), Windows, and Linux
• Storage — single SQLite file in WAL mode. No database server, no daemon, no network. Safe for multiple processes
• Roster — agents are registered by dropping a markdown brief file into a directory; adding a brief enables a new sender/recipient
• Approval gate — info messages act immediately; action and urgent start in unread and require operator approval
• Reference brief bundle — seven roles (operator, architect, implementer, reviewer, failure-analyst, tester, ops) with consistent skeleton, ready to copy

Why you can trust it on day one

This release is the output of a deliberate audit cycle, all visible in git history:

• Four rounds of failure-analysis review before the first release tag — each round surfaced real bugs (XSS via marked.js without sanitizer, LIKE wildcard injection, broadcast state being globally mutable, regex anchor parity drift between Python and Go, orphan recipient handling, char-vs-byte length counting, AGENT_INBOX_OPERATOR validation against reserved names)
• All findings shipped fixes, all fixes have committed regression tests
• 166 tests total (159 Python + 7 Go) covering: core operations, concurrency under multi-process write contention, approval-gate enforcement, broadcast fan-out, char-counting parity, regex anchor strictness, orphan recipient validation, and 56 attack tests Patton wrote during the audit
• CI matrix runs every push and PR: lint (ruff + golangci-lint) + pytest across 4 Python versions on Linux + macOS + Windows + Go tests on 3 OSes + Wails build smoke on macos-latest = 12 cells, single ci-all-green aggregator gating branch protection
• Branch protection active on main: blocks force-push, blocks deletion, requires ci-all-green

Install

uv is recommended for Python management:

curl -LsSf https://astral.sh/uv/install.sh | sh    # macOS / Linux
git clone https://github.com/KI7MT/agent-inbox.git
cd agent-inbox

Wire the MCP server into your client (full snippets in README.md for Claude Code, Codex CLI, Claude Desktop):

{
  "mcpServers": {
    "inbox": {
      "command": "uv",
      "args": ["run", "--directory", "/abs/path/to/agent-inbox",
               "python", "-m", "agent_inbox"]
    }
  }
}

Drop the example briefs into your config directory:

agent-inbox paths    # show OS-specific briefs dir
mkdir -p "<briefs_dir>"
cp examples/briefs/*.md "<briefs_dir>/"

Trust model

Single trusted operator on one workstation. Sender names are a soft contract enforced by validation, not a security boundary. Filesystem permissions on the SQLite file are the actual access control. Cross-host coordination is explicitly out of scope — see the Trust model section of the README.

What's next

ROADMAP.md lists what's likely (Dependabot, CodeQL, coverage upload), what's maybe (Claude Code hooks bundle for auto-polling, slash-command skills pack, agent-inbox install subcommand, PyPI publish, reply-thread visualization in the UI), and what's explicitly out of scope (cross-host coordination, multi-tenant, mobile companion).

License

MIT — see LICENSE.