v0.7.1 — Developer Experience & Security Hardening

What's New in v0.7.1

Developer Experience

• Web Settings — Settings page now has a working POST endpoint (was a no-op before)
• Session Cache Trim — Orchestrator now trims in-memory session cache (max 50) to prevent memory leaks
• Compaction Limit — Context compaction capped at 3 attempts to prevent infinite loops
• Cron History — Scheduler now supports save_history/load_history for execution persistence
• Telegram Hardening — Broadened error handling to catch all exceptions (was too narrow)
• Profile Switch — Now checks if profile exists before showing switch command
• Storage Migrations — Schema migrations now use PRAGMA user_version for incremental tracking

Security

• Enterprise Passwords — Default passwords can now be overridden via environment variables (PULSE_ADMIN_PASSWORD, etc.)

Documentation

• Added .env.example with all provider key templates
• Added Troubleshooting section to README
• Added Uninstall guide
• Added pulse version command
• Updated CONTRIBUTING.md test count (436+)

Fixes

• Init wizard now warns when --yes + cloud provider + no api-key is provided
• README React SPA label corrected to vanilla JS SPA

v0.7.0 — Enterprise RBAC, Audit Logging, SSO, i18n

Enterprise Features

• Audit Logging: centralized audit trail with file persistence and SIEM hook (pulse/enterprise/AuditLogger)
• RBAC/ABAC: role-based access control with 5 predefined roles (viewer/operator/developer/admin/auditor), 13 granular permissions
• AuthManager: session-based authentication with token management
• SSOProvider: stub for OIDC/SAML integration

Internationalization (i18n)

• pulse/i18n/: English (en) and Chinese (zh) support with 70+ translated strings
• Covers chat, skills, memory, settings, auth, audit, evolution modules
• Fallback to English for missing keys

Testing & Quality

• 424 tests across 32 test files
• Consolidated JSON parsing (safe_parse_json) and HTTP retry (http_request) into pulse/net.py
• Checkpoint integration in write_file/edit_file tools
• Fixed CI lint errors (W292/W293)

License Compliance

• Restored pure Apache 2.0 license (removed Section 10 commercial restriction)
• Added SECURITY.md with security model and vulnerability reporting process
• Fixed README licence badge

CI Improvements

• Added Python 3.13 to test matrix (matches classifiers)
• Added type-check job (mypy)
• Added security audit job (pip-audit)
• Added format check (ruff format)

Self-Evolution Framework

• pulse/evolution/: EvolutionAnalyzer detects repeated failures, skill gaps, prompt drift
• pulse evolve analyze/status/apply CLI commands
• Auto-draft skills for recurring task patterns

v0.6.1 - Security + Session Search + Curator + Analytics

Full Changelog: v0.6.0...v0.6.1

v0.6.0

Full Changelog: v0.5.2...v0.6.0

v0.5.2 — Social Gateways + Production Ready

v0.5.2 — Social Gateways + Production Ready

New: Social Media Gateways

Connect Pulse Agent to external chat platforms:

• FeishuGateway — Feishu/Lark bot via webhook
• WechatGateway — WeChat public account via webhook
• WhatsAppGateway — WhatsApp Business Cloud API via webhook

Setup:

from pulse.gateways.social import FeishuGateway
from pulse.cli.runtime import bootstrap

rt = bootstrap()
feishu = FeishuGateway(app_id="...", app_secret="...")
feishu.start(rt)
# Mount feishu.handle_webhook in your Flask/FastAPI endpoint

Deployment

Dockerfile — Containerize Pulse Agent:

docker build -t pulse-agent .
docker run -p 10000:10000 --env PULSE_HOME=/data pulse-agent web start

requirements.txt — Core dependencies listed.

Security

Web UI Authentication — Bearer token protection:

pulse web start --token your-secret-token

Plugin Sandbox Integration

Plugins run through sandbox (import whitelist, permission system, restricted builtins) — activated at bootstrap.

E2E Tests

Full stack tests in tests/test_e2e.py:

• Basic conversation flow
• Cross-turn session memory persistence
• Multi-tool trajectory execution
• Streaming output mode
• User feedback injection
• Error handling robustness

File Logging

Logs write to ~/.pulse/logs/pulse.log with daily rotation (7 days retained).

Sub-agent Recursion

pulse fork uses recursive sub-agents with retry + recovery and full tool loop isolation.

MCP Stability

• Exponential backoff reconnect (up to 5 retries)
• Background health-check polling (10s interval)
• stderr ring buffer for server log debugging
• Mid-request crash recovery

Dynamic Tool Loading

Drop .yaml, .json, or .py files into ~/.pulse/tools/ — auto-registered on startup.

Executable Skills

Skills can declare tools, self-test, and be hot-reloaded via BaseExecutableSkill + SkillHandle.

150/150 tests pass · Ruff lint clean

v0.4.1 — P0-P2 Reliability Audit

P0 — Destructive fixes

• Version sync: __init__.py 0.3.1 → 0.4.1 (was showing wrong version to MCP servers)
• Thread-safe Storage: per-thread SQLite connections + WAL mode; all reads now under lock (was crashing on concurrent TUI + Telegram access)
• Windows compat: signal.pause() replaced with threading.Event().wait() (was exiting immediately on Windows)
• Cron stop: stop_event promoted to instance attribute for immediate scheduler shutdown

P1 — Important fixes

• Router now catches AnthropicError (Anthropic provider fallback was broken)
• 7 modules now catch LLMError+AnthropicError (was only RuntimeError/OSError)
• Context compaction uses Router.chat() with fallback chain + rate limiter
• Skill evolution: dedup check prevents overwriting promoted skills; now passes LLM for prose refinement
• Health endpoint: caches Runtime across requests (was rebuilding everything on every probe)
• Sub-agents now execute tool calls in a loop (up to 3 rounds) instead of single-shot

P2 — Quality improvements

• Token estimation consistent at ~3.2 chars/token everywhere
• pulse init now lists Anthropic as a provider option
• MemoryStore file appends guarded by threading.Lock
• Observability.events capped at 5000 (prevents memory leak in long-running services)
• Cron */N step syntax now actually matches (was parsed but never evaluated)
• decompose heuristic handles numbered lists + comma-separated items

138/138 tests pass · Ruff lint clean

Pulse v0.3.1 — 对接任意 OpenAI 兼容端点

Pulse v0.3.1 — 对接任意 OpenAI 兼容端点

一个对标 Nous Research Hermes Agent、但重建了轻量内核的「自我进化」个人 AI Agent，可靠性优先。

---

Pulse 是什么（重头介绍）

Pulse 的出发点很直接：Hermes Agent 很强，但有三个让人头疼的短板——不稳定、技能质量没把关、上手门槛高、强依赖云端。Pulse 是一个从零重写的、本地优先的替代品，核心原则只有一条：先稳定，再智能。

它不是一个只会调 API 的壳，而是一个完整的本地 Agent 运行时：

• 可靠性优先的编排器：带错误自愈（按错误类型重试 / 降级到 fallback 模型）、Token 预算硬上限、可观测追踪（每次任务有 trace_id）。任务不会因为一次模型 503 就整段崩掉。
• 经过「评估」的技能自我进化循环：Agent 在使用中归纳出候选技能，但不是直接上线——必须通过一个 golden task 回放评测，通过才 promote，失败可 rollback。技能和版本都显式、可逆、可审计。这是它和 Hermes 最本质的区别：Hermes 的技能是「写就上线」，Pulse 是「评过才上线」。
• 零配置上手：pulse init --yes 默认本地 Ollama，自动探测运行中的 Ollama，给出 Rich 可视化反馈；pulse doctor 一键自检。
• 本地优先 / 隐私友好：默认全部本地（Ollama + SQLite + 本地技能目录），API Key 只进 .env（0o600 权限），绝不写进 config.yaml。
• 标准兼容：兼容 agentskills.io 开放标准与 Hermes 扩展技能格式，生态里的现成技能可直接复用。

---

本次更新重点：可以对接任意 OpenAI 协议端点

这是 v0.3.1 唯一但关键的能力升级。

之前的问题

v0.3.0 里，openai / openrouter / deepseek 这三个内置 provider 在代码里硬编码了官方 URL（https://api.openai.com/v1 等），并直接忽略你在配置里写的 model.base_url。结果就是：

你想把请求走自己的 vLLM / LiteLLM 网关、公司内网代理、或某个非官方厂商 —— 做不到，base_url 设了也白设。

现在的行为

v0.3.1 重写了 LLM 路由装配逻辑（pulse/llm/config.py 的 _make_compat()）：

• 只要 base_url 被显式设置（且不等于默认的本地 Ollama 地址），内置 provider 就尊重你的 base_url，打到你想去的任何 /v1/chat/completions 端点。
• base_url 没设或还是默认值时，仍然回落到官方厂商 URL —— 完全向后兼容。
• pulse init 新增 --base-url 参数，一步到位；它会被持久化到 config.yaml 的 model.base_url，路由每次 build_router() 都会读回。

一句话：Pulse 现在能连任何「说 OpenAI 协议」的端点——自托管网关、代理、第三方厂商，全部打通。

---

完整变更（Changelog）

Added

• pulse init --base-url <URL>：为任意 provider 指定自定义 OpenAI 兼容端点。
• 任意 OpenAI 协议端点：openai / openrouter / deepseek 现在尊重显式设置的 base_url，覆盖原先硬编码的官方 URL（_make_compat() 内）。
• model.base_url 成为一等配置字段：pulse init --base-url 写入，build_router() 每次读回。

Fixed

• 修复 _make_compat() 对内置云厂商忽略 model.base_url 的 bug——原先配置的自定义端点被静默丢弃。现在显式 base_url（非默认本地地址）优先，未设置时回落官方 URL。

Stats

• 新增 8 个测试（base_url 优先级、fallback 链继承、init 向导持久化）。130 → 138 个测试全部通过（Python 3.11 & 3.12），ruff 零告警。

---

快速开始

pip install -e .
pulse init --yes                       # 默认本地 Ollama，零配置
pulse chat "帮我总结这篇论文"

升级

git pull
pip install -e .                       # 版本号已 bump 到 0.3.1

使用示例：把请求打到任意端点

# 1) 走你自己的网关 / 反向代理
pulse init --provider openai --model gpt-4o-mini \
  --base-url https://my-gateway.example.com/v1 --yes

# 2) 自托管 vLLM / LiteLLM（暴露 OpenAI 协议）
pulse init --provider openai --model meta-llama/Llama-3-8b \
  --base-url http://10.0.0.5:8000/v1 --yes

# 3) 把 Ollama 指向非默认主机
pulse init --provider ollama --model qwen2.5:7b \
  --base-url http://ollama.internal:11434/v1 --yes

也可以在 ~/.pulse/config.yaml 里直接改 model.base_url。

---

与 Hermes 的对比（一句话版）

维度	Hermes Agent	Pulse
可靠性	偶发崩溃	编排器自愈 + Token 预算
技能质量	写就上线	评过才上线（promote/rollback）
上手	门槛高	pulse init --yes 零配置
云端依赖	强	默认全本地
可扩展性	—	MCP 连任意 stdio 工具 + 生态技能兼容

---

完整变更见 CHANGELOG.md。欢迎试用、提 Issue、贡献技能。

Pulse v0.3.0

Pulse v0.3.0

The headline feature of this release is Model Context Protocol (MCP) integration — connect any stdio MCP server and expose its tools to the orchestrator, with reliability-first engineering throughout.

✨ New: MCP integration

• Lightweight stdio client — newline-delimited JSON-RPC 2.0 over a subprocess (initialize / tools/list / tools/call). No hard dependency on the official mcp SDK, keeping Pulse self-hosted and dependency-light.
• Tool adapter + manager — every MCP server tool becomes a first-class Pulse Tool, prefixed {server}__{tool} to avoid name collisions; broken/disabled servers are skipped gracefully.
• CLI — pulse mcp list|add|remove|test|export for full lifecycle management (config in config.yaml, secrets stay in .env).
• Runtime wiring — chat, tui, serve, fork, team automatically make configured MCP tools available.

🚀 MCP reliability & UX

• Lazy, parallel discovery — servers are probed in parallel at startup to fetch their tool lists, then disconnected; each server is only (re)spawned on first actual tool use, so startup stays fast even with many servers.
• Automatic reconnection — if a server process crashes, the next tool call transparently reconnects.
• Argument validation — calls are checked against each server's inputSchema (required fields + JSON types) before being sent, returning a clean error instead of a server-side failure.
• pulse mcp list now shows a live per-server health check (tool count + ok / unreachable).
• pulse doctor probes each enabled MCP server.

🐛 Fixed

• load_settings() now preserves the requested config_dir when reloading an existing config.yaml, so save_settings() writes to the correct location (previously reverted to ~/.pulse and silently dropped changes).

📊 Stats

• 130 tests passing on Python 3.11 + 3.12, ruff clean, ~75% coverage.
• Full details in CHANGELOG.md.

Getting started

pip install -e .
pulse init --yes --provider ollama --model qwen2.5:7b
pulse mcp add fs "npx -y @modelcontextprotocol/server-filesystem /tmp"
pulse chat "list the files in /tmp using the fs server"

Pulse v0.2.0 — Plugin sandbox, security, benchmarks

Pulse v0.2.0 — Plugin sandbox, security, benchmarks, diagrams

Highlights

• Plugin sandbox — import isolation + permission whitelist. Plugins run in a restricted execution context; they declare __permissions__ in source and cannot import dangerous modules (os, subprocess, socket, ctypes, etc.) or call open/eval/exec/compile.
• .env chmod 600 — API key files now have 0o600 permissions by default. pulse doctor and load_env() warn on overly permissive files.
• Benchmark suite — scripts/benchmark.py measures orchestrator latency, token consumption, sub-agent throughput, skill evaluation speed, and memory recall latency.
• Mermaid diagrams — README now includes architecture flowchart, skill evaluation state machine, and multi-agent team pipeline.
• TUI demo — Rich-rendered terminal screenshot in README.

Changes since v0.1.0

Added

• pulse/plugins/sandbox.py — PluginSandbox, SandboxImportHook (sys.meta_path-based), parse_permissions_declaration
• 8 permission types: tools.register, memory.read/write, skills.install, scheduler.add, fs.read/write, network
• scripts/benchmark.py — 5 benchmarks with --quick, --json, --bench flags
• 11 new sandbox tests (96 → 107)
• docs/tui_demo.txt — Rich TUI rendering sample
• 3 Mermaid diagrams in README

Improved

• Plugin loader now parses __permissions__ from source without execution
• Bundled plugins get full permissions; user plugins get conservative defaults
• load_env() detects and warns about overly permissive .env files
• Lint and test pipeline green (ruff + 107 tests)

Statistics

• 107 tests passing
• ~5400 lines of Python across 56 modules
• 73% test coverage
• 75% docstring coverage
• Apache 2.0 license, fully self-hosted default stack

Install / Upgrade

pip install --upgrade pulse-agent
# or
pip install -e .

Quick Start

pulse init --yes --provider ollama --model qwen2.5:7b
pulse chat "write a Python sorting function"
pulse doctor

Benchmark (mock provider)

Benchmark	Metric	Typical
Orchestrator latency	mean	~100ms
Token consumption	mean/task	~24 tokens
Sub-agent throughput	tasks/sec (4 workers)	~7,000
Skill evaluation	mean	~0.04ms
Memory recall (FTS5)	mean	~0.37ms

python scripts/benchmark.py --quick

See the README for full documentation.

Pulse v0.1.0 — Engineering Maturity

v0.1.0 — P1 工程化改进

基于第三方审计的 P1 优先级项全部完成。

改进指标

指标	v0.0.1	v0.1.0	变化
测试数	42	96	+54
测试覆盖率	66%	73%	+7%
Docstring 覆盖	19%	75%	+56%
宽泛 except Exception	28	15	-13
工程文件	0	3	+CONTRIBUTING+Dockerfile+Makefile

新增文件

• CONTRIBUTING.md — 开发流程、编码规范、PR 流程
• Dockerfile — 容器化部署（python:3.11-slim）
• Makefile — 常用命令快捷入口
• tests/test_coverage_boost.py — 38 个新测试
• tests/test_cli_coverage.py — 14 个新测试

异常处理改进

• 插件加载器：except Exception → except (ImportError, SyntaxError)
• Telegram 网关：except Exception → except (URLError, OSError)
• 技能注册表：except Exception → except (OSError, YAMLError)
• 子代理池：except Exception → except (RuntimeError, OSError, ValueError)
• 编排循环：技能选择加 try/except 保护

提交历史

58a6877 feat: P1 engineering improvements for v0.1.0
e1c77da chore: bump version to 0.0.2
cf2fcd1 fix: P0 engineering fixes for v0.0.2
faed24e feat: Pulse — Hermes-style self-improving AI agent (M1-M5)