Portal v0.34.0 — Live run output for agents and a tighter pack-argument boundary

An agent waiting on a run now sees the output as it arrives, pack arguments gained a boundary the loader enforces at authoring time, and the documentation was rebuilt around recordings of real CLI runs.

Security

• The runner and bridge installers keep credentials off process argv. A GitHub token, an API key, and a device code used to ride the curl command line, where any local process could read them from /proc; they now travel as headers on standard input.
• Five pack arguments could pass a leading dash through to the target binary as an option. Their patterns now anchor the first character to a non-dash class, and pip_show terminates option parsing with --.
• Runbook creation never casts status, so a client-supplied "published" cannot mint published content. Publishing at birth is its own transition, gated on manage permission.
• Authorizer row-scoping fallbacks fail closed with an empty query instead of an unscoped one, and a Credo check keeps them that way. The runner's trust gate refuses a run whose registered action has lost its pack.
• Bandit is patched for the WebSocket denial-of-service advisory (EEF-CVE-2026-65623), and OAuth registration rejects redirect URIs with no host or a fragment.
• Claiming an approved device grant writes an audit row per minted key, naming the approver — the grant row itself is swept within a day.

MCP

• wait_for_run takes an output cursor and returns the next one, reading the event log forward within the caller's scope. The tail is bounded by encoded bytes, fragments oversized events, wakes on new progress rather than a row timestamp, and can page a finished run's trimmed output back in.
• Pre-run dispatch rejections — contract changes, refusals, rate limits — log bounded, allowlisted fields, so a rejected call is visible in operations without putting model input into the log.

Packs

• The loader rejects open-ended substitutions in fixed shell programs at authoring time. Only finite enum/allowed choices and two-sided bounded numbers may render into program text; open-ended strings, paths, and arrays travel through execution.env or as whole positional argv elements.
• Curl-backed API actions fail on 4xx and 5xx responses instead of reporting transport success, and catalog metadata is validated against the same bounds the runner enforces.
• Risk tiers are consistent across the catalog: reload is high everywhere, scale is high everywhere. Behavior plans replaced generated cases, and pack compatibility matrices run in CI.

Console

• Operator input survives a re-render. A half-written approval note, a chosen grant scope, a cleared runner-scope draft, and a partially typed policy override are no longer lost to a co-approver's broadcast or a refused submit.
• A pack-trust conflict names the runners that disagree about an action instead of failing generically, and run detail titles the terminal-cause panel by what actually happened.
• Subscription reconciliation pages through its work and isolates a failing row; inactive runners are cleaned up on a schedule.

Website and documentation

• The security page shows the approval loop as a console recording driven by a real run, and the docs carry terminal casts captured the same way.
• Documentation is reorganized by task: single sign-on and directory sync split apart, cloud and CLI agent connection split apart, containers separated into Kubernetes and Nomad with a host-install page, and operational limits and autoscaling fleets given their own pages.
• Body text reads at 16px on a capped measure, screenshots are cropped to the feature and open fullscreen, and an llms.txt index plus a Keycloak setup guide were added.

Verify this release

git tag -v v0.34.0

Runner and bridge binaries ship on their own runner-v* / mcp-v* releases with SLSA-3 provenance and SHA256SUMS.