v0.2.6

multica-ai/multicav0.2.6Apr 18, 2026by github-actions[bot]

AI Summary

This release focuses on infrastructure improvements for self-hosting, agent configuration fixes, and security enhancements. It clarifies Docker deployment settings and adds important security validations.

Key Highlights

Added APP_ENV configuration for self-hosted Docker deployments (#1307, #1313)
Fixed per-agent MCP config field restoration (#1168)
Fixed open redirect vulnerability in auth (#1309)
Added restart: unless-stopped to self-host compose (#1274)
Wrote Copilot skills to .github/skills/ for native discovery (#1270)

New Features

APP_ENV passthrough to backend container
MCP config field for agents
Open redirect protection in authentication
Docker restart policy configuration
Copilot skills file generation for workspace

Full Release Notes

## Changelog
* 133a1f1c16930a4df8a808108f87d00dba81ac3e ci(release): restrict tag pattern to semver and reject -dirty tags (#1280)
* b1b66ab05d9f806a0a7e199191c9893dc0d6f6e4 ci: exclude apps/docs from frontend build/typecheck/test (#1279)
* e198a67f8f2afe637cde3dfad9e5c86205a78964 docs(prompt): warn agents that mention syntax is an action, not a text reference (#1306)
* 6cd49e132de7632b1f2aaa675c98e8eca9308bb7 docs(selfhost): clarify 888888 master code is disabled by default in Docker (#1313)
* 163f34f91868e4ea0c1e3d08937fca083b6e96e3 feat(agents): show launch mode preview in custom args tab (#1312)
* 63800f05ff8c1d4510bb147c9343b298484ff285 fix(agent): add per-agent mcp_config field to restore MCP access (#1168)
* 2c1478a69c05a4a1f84131634ec1f9dc4d08418d fix(agents): make issue tasks easier to open from agent details (#1152)
* 2317533da4d22f1c31509e048111925bd3613259 fix(auth): validate next= redirect target to prevent open redirect (#1309)
* 0ed16fc1b1c99c062c6ad5185fb3a9eabb7f2b27 fix(autopilots): spin the Loader2 icon while a run is in progress (#1305)
* 746f33a38b9987089264d8dceb629532408f9fa2 fix(claude): clear fresh session_id on resume failure so daemon fallback fires (#1285)
* d81e6a14a66d5ebddc94f9d930c525a312fcdf86 fix(comment): assignee on_comment path should use reply id, not thread root (#1302)
* aa9305f7e4b84f94412f6857d85658e4a026355d fix(daemon): populate workspace_id in ClaimTaskByRuntime for autopilot run_only tasks (#1294)
* eecb3a2bc85c86c89f7b3c8af951e3c45c7ef112 fix(desktop): use releaseType instead of publishingType in electron-builder publish config (#1268)
* 0fc9641bf60c2e7547bf7ff692d1493645afba00 fix(docker): add restart: unless-stopped to self-host compose (#1274)
* b2307a5ee9496a67d2a3095d5e1067fe633d59e9 fix(execenv): write Copilot skills to .github/skills/ for native discovery (#1270)
* 965561a6cc1687c9d675eaa27dfd29602dedafab fix(selfhost): pass APP_ENV to backend container, default to production (#1307)
* 4223d32b371baa484272628e15a90e2227823e89 fix(sidebar): prevent pin drag from reloading page and smooth drop animation (#1271)
* a6db465e46166ef5e3578162d95452ec64b39220 fix(ui/agents): drop Codex-incompatible --model example from custom args tab (#1310)