Skip to content

Ally v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@Bronya0 Bronya0 released this 12 Jul 18:35
v0.3.0
19d0b24

New Features

  • Splash screen avatar: Startup animation now shows the Ally robot avatar with blinking and looking-around animations alongside the wordmark, with faster animation cycles tuned for the 3.6s splash duration
  • AllowPrivateNetwork setting: New toggle in Settings → General to control SSRF protection for http_request and web_fetch. Defaults to enabled (allow intranet access) for internal development use

Bug Fixes

  • Data race in goal mode: getActiveGoal now returns a heap copy instead of a raw pointer, preventing concurrent reads of mutable GoalState fields
  • Ask cancel/submit race: pendingAsk now uses a cancelled flag under mutex, preventing user answers from being silently dropped when a run is cancelled
  • remote_edit TOCTOU: Eliminated double SSH read in remoteEditOne; the backup read is now reused for editing, removing the time-of-check-to-time-of-use window
  • SSRF protection: allowPrivateNetwork now defaults to true and is configurable via settings, rather than being hardcoded
  • remote_run_command safety: Added 17 high-risk command pattern checks (mkfs, dd, shutdown, fork bomb, etc.) and shell parameter whitelist (bash/sh/zsh only)

Improvements

  • Command safety regex precompilation: All 20+ regex patterns in checkCommandSafety are now package-level precompiled variables, eliminating per-call compilation overhead
  • remote_create_file performance: Removed redundant post-write SSH read confirmation
  • Error code consistency: remote_edit, remote_run_command, remote_delete_path, http_request, web_fetch, list_files, and readTextFile now all use structured codedToolError error codes
  • run_command delete whitelist: git rm, docker rm, kubectl delete, npm remove and similar safe commands are no longer blocked by the delete command filter
  • Goal creation guard: createGoal now rejects creating a new goal when an active goal already exists
  • Todo validation: todo_write validates Status enum values (pending/in_progress/done) and non-empty titles
  • Skill file size limit: Skill tool now enforces the 2MB file size limit on skill files
  • Calculator nesting limit: calculate now enforces a 200-level nesting depth limit to prevent stack overflow
  • remote_edit rollback: Rollback failures are now collected and reported instead of being silently ignored

Full Changelog: v0.2.0...v0.3.0

Assets 5
Loading