v0.25.0

What's new

A tool can call a Google API as a service account. A .tool file names the service account's key in the Secrets Vault and the scopes it needs, and the platform signs in to Google for every call. This is how a team shares one connection to Google Ads, Tag Manager, BigQuery and most other Google APIs without each person signing in. The key is never sent to Google and never shown in an error. It works on the hosted platform and on the local hexis-mcp server.

Fixes

• Two agents editing the same text with edit_file at the same moment no longer both report success while one edit is lost. Whichever edit lands first stays, and the other is told the text was not found.
• edit_file writes the replacement exactly as sent. Text containing $& or $$ used to be changed on the way in.

Upgrading

Nothing to do for a deployment already on 0.24. A deployment on an older version takes the steps of 0.24 on its way: see UPGRADING.md.

For integrators

• A deployment built on these packages can now encrypt personal data in its own tables with the same step Hexis uses for its own, in place of writing one.
• A blind index beside an empty optional value is now empty too. It used to hold the index of the empty text.