Changelog

Notable changes in each Sugar release.

v3.10.0 - July 18, 2026

Task Orchestration ships as advertised - the 4-stage workflow (research, plan, implement, review) is now wired into the live execution path.

Added

  • Task Orchestration - intelligent decomposition and execution of complex features through staged workflows and specialist agent routing
  • 4-stage workflow: research, planning, implementation, review - with context accumulation across stages to .sugar/orchestration/{task_id}/context.md
  • orchestration: config block emitted by sugar init (detection rules, per-stage agents/timeouts, agent routing patterns)
  • --orchestrate and --skip-stages flags on sugar add (and the MCP sugar_add_task tool)
  • sugar orchestrate [TASK_ID] and sugar context TASK_ID CLI commands
  • Specialist agent routing (frontend-designer, backend-developer, qa-engineer, security-engineer, devops-engineer, code-reviewer, tech-lead, general-purpose)
  • Dependency-wave executor: sub-tasks persist to the queue and execute in dependency order, sequentially within each wave
  • Read-only research and planning stages (Read, Glob, Grep, WebSearch, WebFetch) so analysis stages gather context without writing files; configurable via read_only: false
  • Review stage runs the project test suite and fails the orchestration when require_passing: true
  • Orchestration exposed over MCP: sugar_add_task gains orchestrate/skip_stages, sugar_view_task surfaces stage, context_path, parent_task_id, assigned_agent, and sub-tasks

Fixed

  • Wire TaskOrchestrator into SugarLoop - orchestration previously fell through to simulated output and sub-tasks were never persisted
  • Latent execute_work_item -> execute_work executor call bug, and the *ui*-matches-"build" router wildcard bug
  • Cascade-fail orphaned sub-tasks: dependents of a failed sub-task are no longer stranded in hold
  • Enforce configured per-stage and per-subtask timeouts (previously dead config) via asyncio.wait_for
  • Harden the plan parser: line-based parsing handles unbolded titles and dependency refs like "1 and 2", "1-3", "1 to 3"
  • Drop sentinel "none" dependency values that could strand a sub-task forever
  • One failed task no longer aborts the whole loop cycle

Intra-wave parallel subtask execution is planned future work; sub-tasks run sequentially within each wave today. See the Task Orchestration guide.


v3.9.1 - April 9, 2026

Security fixes, documentation overhaul, and new positioning as an autonomous issue resolution tool.

Security

  • Fix SQL injection via dynamic column names in WorkQueue.update_work()
  • Fix grep flag injection in MCP _search_codebase
  • Fix shell injection in HookExecutor task field substitutions

Fixed

  • Add missing thread locks to MemoryStore.list_memories, count, and prune_expired
  • Replace silent exception swallowing with logger.warning() for vector deletion and unknown memory types
  • Fix .gitignore duplicate entries

Changed

  • Pin all dependencies to exact versions
  • New positioning: "Autonomous issue resolution for AI-assisted development"

Added

  • Architecture.md - contributor-focused architecture overview with system diagram
  • Workflow examples - security auto-fix, bug triage, test coverage, code quality, feature development
  • Document hold, release, logs, and opencode CLI commands

Removed

  • Unused billing module

v3.9.0 - March 17, 2026

Global memory layer and concurrency fixes.

Added

  • Global memory store at ~/.sugar/memory.db for cross-project knowledge
  • New guideline memory type for standards that apply everywhere
  • --global flag for remember, recall, memories, forget, and memory-stats
  • sugar://global/guidelines MCP resource
  • Project-first tiered search strategy with reserved guideline slots

Fixed

  • Six concurrency fixes across storage layer and core loop
  • Thread-safety improvements for subagent manager, issue response manager, and work queue

v3.8.0 - January 22, 2026

Goose integration guide and improved MCP setup.

Added

  • Dedicated Goose integration guide
  • Goose setup instructions in README, installation guide, and quick start

v3.7.0 and earlier

See the full changelog on GitHub for earlier releases.