agentkai 0.6.5

Fixed

• Security: transcribe_audio input files are now confined to the agent workspace. The tool accepted an unconstrained audio_path, so a model could point it at any audio file on the host and have the transcript fed back to it. Inputs are now confined like the media tools: relative paths resolve against <home>/workspace, absolute paths must already live inside it, and .. traversal or symlink escapes are refused with a clear ERROR: (the gateway hook preprocess_voice_note is unchanged). 8 new tests in tests/test_voice.py.

Docs

• docs/voice.md: added a Path confinement note for transcribe_audio / speak_text.

Full test suite: 450 passed, 4 skipped. PyPI: agentkai 0.6.5.

v0.6.4

Fixed

• Security: speak_text output paths are now confined to the agent's voice directory. The low-risk speak_text tool accepted an unconstrained out_path, so a model could point it at any process-writable file (e.g. ~/.bashrc) and have it overwritten with synthesized audio bytes. Output paths are now confined exactly like the media tools: relative paths resolve against <home>/voice, absolute paths must already live inside it, and .. traversal or symlink escapes are refused with a clear error (surfaced as ERROR: ... by the tool). The default output location is unchanged (<home>/voice/tts-<stamp>-<id>.wav). Seven new tests in tests/test_voice.py cover absolute-path, traversal, tilde, and symlink escapes plus inside-voice-dir acceptance and the default path.

Full suite: 443 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.6.4/

v0.6.3

Fixed

• Security: edit_image input files are now confined to the agent workspace. The image and mask arguments were previously resolved against the raw filesystem, so a model could point the tool at an arbitrary file (e.g. ~/.ssh/id_rsa, /etc/passwd) and have its bytes exfiltrated to the remote image-editing provider. Input paths are now confined exactly like the file/shell tools: relative paths resolve against home/workspace, absolute paths must already live inside it, and .. traversal or symlink escapes are refused with a clear error. The tool's description documents the confinement. Six new tests in tests/test_media.py cover absolute-path, traversal, symlink, and mask escapes plus inside-workspace acceptance.

Full suite: 437 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.6.3/

agentkai v0.6.2

Fixed

• Permission gate: the in-memory audit log no longer grows without bound. PermissionGate._audit appended one entry per tool decision for the whole process lifetime — and gateway agents (plus their gates) live as long as the gateway runs, so a long-running gateway leaked memory on every tool call (verified: 50,000 decisions -> 50,000 in-memory entries). The in-memory audit_log() now keeps the most recent AUDIT_CAP = 2000 decisions with oldest-first eviction, the same window used for the WhatsApp bridge's seen-id cache; when audit_path is configured, the JSONL file remains the durable, complete record of every decision. Two new tests in tests/test_core.py verify the bound/eviction and that the JSONL file still records everything.

Full suite: 432 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.6.2/

v0.6.1

agentkai 0.6.1

Fixed

• WhatsApp bridge: the seen-message-id dedup cache no longer grows without bound. WhatsAppBridge._seen collected every sidecar event id it ever dispatched, so a gateway left running for weeks would keep the full history in memory forever. The cache is now capped at SEEN_CAP = 5000 ids with oldest-first eviction (safe: the sidecar only returns events at/after the since watermark). New test in tests/test_channels.py covers the bound, oldest-first eviction, and within-window dedup.

Tests: 430 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.6.1/

v0.6.0

agentkai 0.6.0 — browser request gate

0.5.6 closed the navigation-time SSRF gap but left a documented limitation: redirect hops, subresources, XHR/fetch, and websockets fired by a loaded page were followed by Chromium itself with no re-validation. This release closes it:

• BrowserSession now registers a context-wide Playwright route handler (**/*, covering all tabs) that aborts any request to a non-public or unresolvable host — the same _assert_public_host() boundary as fetch_url — hop by hop.
• file:// requests are aborted at the network layer too, so a page can never read the local disk, even via iframe/subresource.
• Harmless schemes (data:, blob:, about:, chrome:…) pass through untouched; the handler fails closed.
• 11 new tests; full suite green (429 passed, 4 skipped).

A prompt-injected page can no longer steer the browser at http://169.254.169.254/, 127.0.0.1, or 192.168.x.x and read the response back into the agent's context.

agentkai v0.5.6

Fixed

• Browser navigation now refuses non-public hosts (SSRF gap closed). fetch_url has long refused hosts that resolve to loopback, private, link-local, or otherwise non-public addresses, but the real-Chromium browser tool's URL validation only checked the scheme and rejected credentials-in-URL — so browser_goto http://169.254.169.254/... (the cloud metadata endpoint), http://127.0.0.1:8501/, or http://192.168.1.10/... loaded happily (verified with a repro: all three passed validation while fetch_url refused them). A prompt-injected page could have steered the browser at internal services or metadata URLs and the response would have landed in the agent context. The non-public-host check is now extracted from tools._validate_url into a shared _assert_public_host() helper and enforced by browser._validate_url, so browser_goto (and new_tab with a URL, which routes through the same gate) refuses unresolvable hosts and every non-public address class with the same messages as fetch_url. Five new tests in tests/test_browser.py cover private, loopback, and link-local (metadata IP) refusals, unresolvable hosts, and the public-host allow path; the suite's DNS is now fully mocked so browser navigation tests never touch real DNS. Known limitation, unchanged: redirects within an already-loaded page are followed by Chromium itself and are not re-validated hop-by-hop the way fetch_url does.

Full suite: 419 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.5.6/

agentkai v0.5.5

Fixed

• --pin on skill installs now actually checks out the pinned commit. The 0.5.2 supply-chain hardening added --pin/pin to pin a remote skill install to a commit SHA, but the implementation only compared git clone --depth 1's HEAD against the pin afterwards and never checked the pin out — so pinning to any non-HEAD commit always failed with "pin mismatch" (verified with a repro against a real 3-commit git repo), and the feature's whole point (install the exact commit you reviewed) was silently broken. install_skill() now fetches the pinned commit and git checkout --detachs it before recording commit_sha in the manifest; the pin must be a full 40-hex SHA (required for fetch-by-SHA, and the strict shape also rules out option injection through the pin value), and an unfetchable commit fails the install with the half-cloned directory cleaned up, as before. Four new tests in tests/test_skills.py cover pinning to an older commit (checked-out tree, manifest SHA, and clean load), pinning to HEAD, invalid pin formats, and unfetchable commits.

Full suite: 414 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.5.5/

agentkai 0.5.4

Fixed

• Media out_path can no longer escape the media directory. The generate_image, generate_video, and edit_image tools joined a relative out_path to ~/.agentkai/media/ but never checked the result, so a path like ../../pwned.png wrote the generated file outside the media dir (verified with a repro: a stub provider wrote three files outside the dir). The traversal guard in generate_image was dead code — after joining, the path was always absolute, so the check could never fire — and the other two functions had no guard at all, quietly bypassing the filesystem sandbox the file/shell tools enforce. All three now resolve the path through one helper that collapses .. segments and symlinks and refuses anything landing outside the media dir; relative subdirectories (e.g. campaigns/hero.png) still work and get their parents created, and absolute paths are accepted only inside the media dir. Seven new tests in tests/test_media.py cover ../ traversal, absolute-path escape, symlink smuggling, and the legitimate cases.

Full suite: 410 passed, 4 skipped. PyPI: https://pypi.org/project/agentkai/0.5.4/

v0.5.3 — skill manifest verification fails closed

Fixed

• Skill manifest verification now fails closed. The 0.5.2 integrity check silently skipped verification whenever an installed user skill's manifest.json was unreadable, invalid JSON, or missing its content_sha256 — so corrupting the manifest switched the drift check off and let tampered tools.py code execute (verified with a repro before the fix). SkillLoader.load() now refuses such skills with a SkillError before any skill code runs, and agentkai skills list flags the broken manifest instead of showing the skill as healthy. Skills with no manifest at all (manually copied directories) keep loading as before.

Upgrade note: skills installed by agentkai ≤ 0.5.1 carry a manifest without an integrity hash and must be reinstalled once (agentkai skills install <source> --force) to stamp one.

Five new tests in tests/test_skills.py; full suite 403 passed, 4 skipped.