v0.23.0

New features

Self-tuning cache thresholds: outcome evaluation with history UI (#225)

The cache proposals feedback loop is now closed. After a threshold proposal is applied, a background evaluator waits 15 minutes, measures whether the adjustment actually helped, and writes a verdict — improved, degraded, or neutral — back to the proposal record. The recommendation engine uses accumulated verdicts to block signals that have historically led to degradation on a given cache.

In the UI, the proposals history table gains an Outcome column with a verdict badge, and the detail panel shows a structured evaluation section with the signal name, evaluation window, and a before/after metrics comparison. The evaluation window and tick interval are configurable via OUTCOME_EVAL_WINDOW_MS and OUTCOME_EVAL_TICK_MS.

Confidence scores and cost-weighted threshold recommendations (#224, includes #227)

Threshold recommendations now carry a confidence_score with a breakdown of three components — sample volume, signal strength past the decision boundary, and sample freshness — combined as a geometric mean so one weak component drags the score down. Populated for tighten/loosen recommendations only. Tighten/loosen decisions are now also cost-weighted, with cost flowing from similarity-window samples into the recommendation. This is
step 1+2 of the self-optimization track; auto-approval gating will build on the observed confidence distribution.

Retry for unavailable runtime capabilities (#213)

When a capability like SLOWLOG is blocked by the provider (e.g. Upstash, ElastiCache), the monitor previously cached it as permanently unavailable. A new POST /connections/:id/capabilities/:capability/retry endpoint re-probes the capability and clears the cached state on success. Capability-gated pages such as Slow Log now show a status banner with the verbatim server error, the disable reason and timestamp, and a retry action — instead
of a blank unavailable overlay. Upstash-style "command is not available" errors are now recognized and auto-disable the capability instead of erroring repeatedly.

Security

52 Dependabot alerts resolved — including two criticals (shell-quote command injection, protobufjs arbitrary code execution). Vulnerable transitive dependencies are now forced to patched versions via pnpm.overrides: axios, hono, react-router, handlebars, dompurify, fast-uri, fast-xml-builder, langsmith, lodash, path-to-regexp, picomatch, postcss, qs, serialize-javascript, uuid, yaml, and others.
Example app lockfiles audit clean.

Two alerts remain open upstream: torch (no patched release yet) and file-type (fix is ESM-only and incompatible with its CJS consumer ibm-cloud-sdk-core).

Dependency updates

• turbo bumped from 2.8.20 to 2.9.14

What's Changed

• feat(cache-benchmark): add semantic cache replay harness and latency … by @KIvanow in #221
• Feat/benchmarking by @KIvanow in #223
• feat(runtime-capabilities): capability retry endpoint + unavailable-capability UI by @jamby77 in #213
• build(deps-dev): bump turbo from 2.8.20 to 2.9.14 by @dependabot[bot] in #219
• Feature/cache benchmark ts harness by @KIvanow in #226
• Fix/libs telemetry by @KIvanow in #229
• feat(cache-proposals): proactive outcome evaluation with UI and histo… by @KIvanow in #225
• feat(cache-proposals): confidence score + cost-weighted threshold optimization by @jamby77 in #224
• feat(semantic-cache): built-in keyword-overlap rerank factory by @KIvanow in #232
• fix(agent-cache): include tool definitions in cache key for Vercel an… by @KIvanow in #233
• build(deps): bump aiohttp from 3.13.5 to 3.14.0 in /packages/cache-benchmark by @dependabot[bot] in #231

Full Changelog: v0.22.0...v0.23.0