v0.8.0

What's Changed

• fix: serialize chat run state mutations by @chubes4 in #457
• fix: make bootstrap glob discovery portable by @chubes4 in #460
• fix: preserve conversation ownership REST statuses by @chubes4 in #462
• Add request-scoped workflow controller by @chubes4 in #464
• build(deps): bump actions/checkout from 6.0.3 to 7.0.1 in the actions-major group across 1 directory by @dependabot[bot] in #387
• Document successful pre-tool completion by @chubes4 in #466
• Security: make importer-derived agent provenance authoritative by @lezama in #467
• Security: reject duplicate artifact identities in agent packages by @lezama in #468
• Security: fail closed on non-truthy package artifact import results by @lezama in #469
• Security: make CPT conversation lock release value-conditional (TOCTOU) by @lezama in #470
• Security: enforce autonomous deny-by-default in the default authorization policy by @lezama in #471
• Security: redact workflow run metadata for non-manager readers by @lezama in #472
• Security: bound preserved citation metadata in tool result truncator by @lezama in #473
• Security: reject leaf symlinks in safe execution workspace file I/O by @lezama in #474
• Security: serialize non-atomic bridge queue read-modify-write under a lock by @lezama in #475
• Security: authorize task run actions against stored owner, not client-asserted session_owner by @lezama in #476
• Security: bind conversation session owner to authenticated principal and enforce workspace boundary by @lezama in #477
• Security: enforce exact-once terminal semantics for runtime-tool lifecycle by @lezama in #478
• Security: bind branch reconcile to stored suspension state and fail closed on lock loss by @lezama in #479
• Security: enforce exact-once run claim on JSON-RPC chat streaming by @lezama in #480
• Remove accidental absolute vendor symlink by @chubes4 in #481
• Fix principal-owned default chat sessions by @chubes4 in #483
• Honor explicit chat session principals by @chubes4 in #484
• fix: unify canonical chat authorization by @chubes4 in #494
• Expose host provider-turn dispatch through the default adapter by @chubes4 in #496
• Expose resolved host dispatch model context by @chubes4 in #498
• Resolve runtime profiles in default chat by @chubes4 in #500
• Expose JSON-RPC host projection by @chubes4 in #502
• Add principal memory layer vocabulary by @chubes4 in #504
• Resolve registered agent config per chat request by @chubes4 in #506
• Stream default chat provider deltas by @chubes4 in #508
• Preserve stateless JSON-RPC history by @chubes4 in #510
• Suspend client tools in the default chat runtime by @chubes4 in #513
• Accept typed chat continuations by @chubes4 in #515
• fix: emit provider-safe host tool names by @aaronware in #511
• Fixes #518 by @chubes4 in #519
• Add structured provider output by @chubes4 in #517
• fix: preserve normalized pending mediation requests by @chubes4 in #522
• Add external turn actors to execution principals by @chubes4 in #523
• Fix Composer discovery for public package classes by @chubes4 in #525
• Fix Composer discovery for all public classes by @chubes4 in #527
• Return typed workflow errors for run-control contention by @chubes4 in #530
• fix: make workflow fanout admission atomic by @chubes4 in #535
• fix: retry branch reconciliation without re-executing effects by @chubes4 in #534
• Fix reconcile lock expiry during aggregation by @chubes4 in #536
• Surface failed partial package adoption as incomplete by @lezama in #490
• Map task run failure into the run-result envelope error field by @lezama in #491
• Make generic run-control mutations atomic (workflow cancel/finish race) by @lezama in #492
• Security: fail closed when the conversation loop body throws by @lezama in #487

New Contributors

• @aaronware made their first contribution in #511

Full Changelog: https://github.com/Automattic/agents-api/blob/v0.8.0/CHANGELOG.md