v0.7.0 — Craft CLI, Headless Server & Architecture Overhaul

Craft CLI

A new terminal client for running agent sessions from the command line — no GUI required.

• craft-cli run — launch agent sessions directly from your terminal with prompt input and streaming output
• Multi-provider support — select between multiple LLM connections and models from the CLI
• CI workspace support — create and manage workspaces programmatically for automated workflows
• --validate-server — verify server configuration with prettified diagnostic output
• Redesigned spinner — stays visible during agent thinking for better terminal UX

Why it's cool

This is the first step toward full programmatic control of Craft Agents. Script your agent workflows, integrate into CI/CD pipelines, or run sessions headlessly on remote machines. Partially addresses #343.

Headless Server

Run Craft Agents as a standalone server without the Electron desktop app — deploy on any machine, connect from any client.

• Standalone Bun server — headless entry point that runs without Electron, with sharp eliminated from the bundle
• TLS support — secure remote connections with automatic certificate handling
• Multi-platform build script — distribution packaging for Linux, macOS, and Windows
• Remote mode via env vars — configure headless operation through environment variables
• Thin-client connection state — WebSocket connection status and failure banners in the client

Why it's cool

Deploy Craft Agents on a remote server and connect from anywhere. Run it on your home lab, a cloud VM, or a CI runner. The thin-client mode means the browser UI stays lightweight while all the heavy lifting happens server-side. Partially addresses #291.

Transport & Architecture

The entire inter-process communication layer has been rebuilt from the ground up.

• WebSocket-only RPC — replaced Electron IPC with WebSocket RPC for all communication, enabling remote operation
• Bidirectional RPC — typed push events, server-owned OAuth token management
• Server-core extraction — 14 core handlers, session management, services, and domain utilities extracted into @craft-agent/server-core for reuse across Electron and headless
• Protocol formalization — channels, DTOs, and event maps extracted to @craft-agent/shared/protocol with wire-format stability tests
• Split-brain cleanup — removed dead handler/session copies, added IWindowManager and channel advertisement

Why it's cool

This is the foundation that makes CLI, headless server, and future remote/mobile clients possible. The architecture is now cleanly split between reusable server-core logic and platform-specific shells (Electron, Bun server, CLI).

Editor & UI

• Rich block interactions — tiptap image support, slash menu for inserting content blocks, and theme fallback
• Model fallback chain — automatic fallback between models when one is unavailable, with improved playground theming
• Browser tooling — better lifecycle management, metadata badge components, and safe-mode boundaries

Security

• Block unencrypted WebSocket — remote connections now require wss:// (TLS); plaintext ws:// is rejected
• Certificate generation — fixed curve name in cert generation script

Bug Fixes

• Pi 3-tier model persistence — fixed model save/hydration for Best/Balanced/Fast tiers. Fixes #336
• Multi-panel input focus — fixed focus scoping and race handling that caused keystrokes to jump between panels. Fixes #339
• Pi Azure base URL — propagate Azure base URL to Pi subprocess
• Deep-link routing — corrected deep-link client targeting with regression tests
• Split-turn expansion — fixed TurnCard expansion key collisions
• Explore mode false positive — no longer flags node arrow syntax (=>) as a write operation
• Onboarding loop — fixed onboarding always showing + silent connection save failures
• Copilot model listing — use GitHub OAuth token for CopilotClient model listing
• Label badge overlap — prevent premature label badge overlap in UI
• Transport hardening — hardened WebSocket startup routing, codec, and session watcher isolation
• OAuth fixes — open OAuth browser locally via shell.openExternal, accept /oauth/callback path
• Event payloads — consistent sources:changed and skills:changed payload shapes
• Global config guard — ensure config.json exists before handler registration