Biorouter v1.90.0

Biorouter v1.90.0

A minor release. Two campaigns landed: driving every tool in the app across
providers, and a programming review run before the final drive.

Fixed by driving every tool

Twenty-four issues (#140–#163) found by exercising all 419 tool/mode
combinations in the running app:

• Knowledge bases could wedge until restart. An abandoned transaction held
  its base's write lock indefinitely; both waits on that path — the in-process
  queue and the on-disk flock — were unbounded.
• A tool call that asked for approval could hang forever over
  /agent/call_tool.
• Editing a .docx destroyed the images it already contained.
• A knowledge base id could become permanently unusable.
• Wrong tool arguments the model could not self-correct from, a registry id with
  a version baked into it, and a Windows-only path bug that made every existing
  raw file read as absent.

Fixed by a review run before the drive

• Security. A schedule id went straight into a path join, so a create
  request wrote outside the managed directory — and landed even when the request
  answered 400 or 409. An MCP extension chose the text of the CSP meant to
  contain it, and could read the daemon secret out of the proxy frame's URL. A
  private chat could write into a new public conversation with no crossing
  approval. A retired tool name was still dispatchable by a subagent.
  shell.openPath accepted any path at all.
• Correctness. An install with enable: false minted a row that read back as
  an operator pin the model could never undo. The workflow prompt was appended on
  every call, without bound, in three places. Declared-but-unarmed capabilities
  were advertised and then silently withheld.

Fixed by driving the app again, after the review

Two hangs that only real execution exposed:

• A knowledge write parked for twenty-one minutes on a transaction slot that
  had neither a deadline nor a cancellation check — nine call sites shared it.
• A merge ignored Stop across two 1800-second write deadlines.

Read-only knowledge operations — a merge preview, an export, a lint, a query —
no longer wait out the write deadline they were never doing a write against.

Interface

File paths the assistant mentions are links only when the preview panel could
actually open them; a path that is gone renders as ordinary text rather than a
control that does nothing. Chat cards that stated no type size no longer render
two pixels larger than the prose around them, and values of one kind — a session
id, a path, a command — now appear in one typeface rather than two.

Fixed by testing every tool on every model

The tool sweep was re-run against each provider in turn — UCSF Versa GPT,
UCSF Versa Claude and Claude Code — exercising all 85 tools per model in its
own fresh conversation.

• Connecting UCSF's private Versa also lit up the public Azure OpenAI card.
  Onboarding wrote that provider's own three keys (AZURE_OPENAI_ENDPOINT and
  siblings) on Versa's behalf, with values identical to the defaults Versa
  already falls back to. The write did nothing for Versa and made a Public
  provider the user never configured report itself Configured, one row from the
  Private one they did. Versa now reads and writes its own namespace, and still
  honours the old keys so a customised install resolves unchanged.
• The first settings load could ask the Keychain dozens of times. The
  secrets cache checked, released its lock, then read the store, so every
  provider row on a cold cache missed together and read together — against a
  guarantee of one read per process. On macOS that is a prompt storm, and a
  racing read that fails leaves the grid disagreeing with itself about
  credentials that are all in one blob.
• A dropped model connection mid-tool-call ends the chat. It is now
  treated as retryable.
• Delegation says when NOT to delegate, and that an explicit request from
  the user outranks that restraint. Measured afterwards on all three providers:
  eighteen of eighteen prompts routed correctly — ordinary work done in place,
  an explicit "spin up a subagent" honoured, and no failed dispatches.

Known limits

Claude Code carries no shell or editor tools by deliberate decision: the text
editor validates workspace paths by name before reopening them by name, and
that stays off the credential-bearing bridge until its I/O is
descriptor-relative. A chat on that provider will say it cannot run a command,
and that is the isolation working rather than a fault.