Release notes

Notable changes to NavFlow, newest first. The project follows Semantic Versioning ; earlier 0.0.x history is in the git log.

0.2.0 — 2026-07-26

Added

NavFlow agents: a prompt attached to a trigger. When the trigger fires, NavFlow reads the correlated timeline and writes a finding back onto the entity’s timeline (a built-in findings source). Configured in the console (Agents) or the catalog (agents:); enabled ⟺ subscribed to its trigger; read-only (it concludes, it doesn’t act). The demo ships one that diagnoses the injected incident out of the box.
navflow up --auth: one switch for authentication. Bare --auth generates and persists a root token and prints a …/?token=… login URL each launch; --auth=<token> uses your own. Open by default (navflow up).
Per-source API keys: creating a push source on a secured instance mints an ingest-scoped API key for it (shown once). The Security page groups Access, API keys, and the Anthropic key.

Changed

Ingest is gated by auth like every route. Producers authenticate with scoped ingest API keys (Authorization: Bearer <key>), not a shared token.

Removed

NAVFLOW_INGEST_TOKEN and NAVFLOW_READONLY — folded into the one auth switch + scoped API keys.
GITHUB_TOKEN and NAVFLOW_VERCEL_VERIFY env vars — GitHub tokens come from the source’s token config; Vercel drain verification echoes Vercel’s own probe header.
NAVFLOW_ANTHROPIC_KEY — use ANTHROPIC_API_KEY (or the console-stored key).

Added

alertmanager connector — a push receiver for Alertmanager. Point a webhook_configs.url at the source’s ingest endpoint; each routed alert becomes an event (keyed by a label, firing / resolved). The source page shows a copy-paste alertmanager.yml receiver block.

Added

prometheus_alerts connector — polls Prometheus’s own /api/v1/alerts and emits one event per active alert (keyed by a label), plus a resolved event when it clears. Discover lists the configured rules with an optional severity filter.
reference connector — documents (json / csv / md / txt) attached to an entity by their labels, always surfaced when correlating on that entity regardless of the read window.

Removed

alerts and static connectors — superseded by prometheus_alerts / alertmanager and reference respectively.

Changed

Prometheus — pick the metrics, no PromQL. Discover now lists the server’s metrics and labels; you pick what to ingest (by name or by label) and NavFlow writes the query. The metric value is stored as a number-typed value label, so triggers can aggregate it. Added bearer / basic auth.

Changed

Postgres — the connection URL (dsn) is a required per-source config field, stored as a secret; the driver ships in the base package (no [postgres] extra); you can select which columns to pull. Dropped key_column (the key is a primary label) and cursor_type (inferred from the value).

Removed

changelog and config connectors — dummy, demo-only connectors that had outlived their use. Also drops the demo api-server’s unused /admin/changelog and /admin/config endpoints and renames its fault switch /admin/inject → /demo/inject.

Added

include_payload on read/query — opt-in flag that returns the full lossless stored record as raw on each row, alongside the summary text. Exposed over HTTP and the MCP read/query tools; covers all connectors.

Fixed

Claude Code plugin install — publish a root marketplace.json (/plugin marketplace add glassflow/navflow) and fix plugin.json load errors on Claude Code 2.1 (duplicate hooks ref, missing ingest_token default, navflow_url required flag hiding its default).
Double-ingest for claude_code — the first pushed event flips a poll-mode source to push mode, so a source fed by the plugin no longer also tails files and ingests every event twice.

Added

First public (soft-launch) release.

Added

read(selector, window) primitive — a correlated, time-ordered read across all sources matching a strict-AND conjunction of label=value constraints, with no view required. Exposed over HTTP (POST /read) and MCP (the read tool). Views become an optional narrowing lens; triggers still attach to a view.
Console redesign — a selector-first Explore (pick an entity, add filters, read across every source, with a human/agent view toggle), a ⌘K Ask command palette, a three-act navigation, and separate Views / Triggers pages.
Agents → Reads — a client filter (defaults to mcp) over the read activity log.

Changed