v0.1.10

Added

• Agents can author their own tools. The new built-in create_custom_tool lets an
  agent write a small program when no existing tool fits - a Java Tool.run(Map), a Python
  run(input), or a JavaScript/TypeScript run(input) (new sandbox languages). The program is
  compiled and statically verified by the tool-sandbox service and stored as a DISABLED draft; a
  custom_code_tool.enable approval request (default-gated, so no approval-policy or autonomy
  tier can bypass it) is what enables it, for every agent in the workspace at once. Rejected
  programs stay on disk as drafts with the verifier's diagnostics. Personal and lite installs get
  tool-sandbox automatically with the tools profile (so --no-tools declines it); --native-core
  keeps it off since a host JVM cannot reach the container-only sandbox network.
• Custom code tools now support JavaScript and TypeScript in the console editor, the
  AI-generate flow and the sandbox. JS/TS tools run under Node 22 with --experimental-permission
  (fs, child_process, worker, addons and wasi calls throw) plus an identifier policy that rejects
  import/require, process, globalThis, the eval family, the network globals and
  .constructor access; vault-secret grants are currently Java/Python only.
• continue_in_background agent tool: when a task needs more tool calls than a
  single chat reply's budget, the agent hands it to a multi-turn background job
  instead of stopping with a partial answer. The job re-runs the same agent under
  the normal per-turn ceiling and approval gates; AgentJobStartRequest.maxTurns
  (capped by APP_AGENT_JOBS_MAX_TURNS_CAP, default 8) controls how many turns it
  may use. Opt-in per agent via the tool allow-list.

Changed

• Fresh personal, lite and full installs now start the out-of-box tool surface by
  default: private web search (SearXNG), the MCP connector runner (built-in STDIO
  servers and tenant MCP connectors) and the Assistant's browser
  (browser-runner, giving agents browser_navigate, browser_screenshot,
  browser_read_page_text and friends plus the takeover view). Decline per
  install with --no-search / --no-tools / --no-browser or the matching
  VEGADUTA_*=0 env var; --minimal still drops all of them. A remembered
  choice and installs that predate the defaults are left unchanged.

Security

• The console moves to Next.js 16.4.2. Next.js 16.0.0 through 16.4.0 are affected by two critical advisories, unauthenticated remote code execution in the Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw) and in 'use cache' functions that return typed arrays (GHSA-673q-mjm6-r5xr), and by a high-severity denial of service in the App Router with Server Actions (GHSA-p3m5-59mp-jv5r, CVE-2026-94482); the first patched release is 16.4.1. The console, published up to 0.1.9, shipped 16.3.6. web/package.json now asks for ^16.4.2 and the lockfile resolves next and its @next/* packages to 16.4.2; no application code changed.
• Tenant, project, workspace and git-ref ids no longer accept a trailing newline. The allowlist checks in app-builder, code-intel and rl-trainer used re.match with a $ anchor, which also matches before a final newline, so abc\n passed as a valid id; they now use re.fullmatch. The same fix covers the voice agent's LiveKit room-name patterns.
• A monorepo subdir can no longer inject a second shell command. app-builder's repo import interpolates subdir into cd <subdir> && ... (and into the generated GitHub Actions workflow), and its allowlist accepted a trailing newline (a/b\n/ became cd a/b\n && npm install). It is now matched in full, refuses control characters and a leading -, and is shell-quoted where it is interpolated.
• Two tenants with the same project id can no longer share an app-builder preview route. With the legacy local preview on (APP_BUILDER_LOCAL_PREVIEW_ENABLED, off by default), the Caddy route was keyed by the project id alone, and project ids are unique only per tenant, so tenant B starting shop replaced tenant A's shop route. Routes, preview paths and preview hosts now carry a per-tenant prefix: the URL is <base>/preview/<tenant key>/<project id>/ (or https://<tenant key>-<project id>.<preview domain>). A preview started before the upgrade keeps running and is removed by preview/stop.
• app-builder no longer returns database error text to the caller. backend/provision, backend/schema and backend/tables put the Postgres driver's message (role, schema and connection details) in the response reason; they now log it and return a generic reason with the SQLSTATE code, for example schema apply failed (SQLSTATE 42601); see the app-builder service log.
• Caller-controlled values are logged without CR/LF in app-builder's preview ingress and tool-sandbox's execute and error logs (toolName and the request path could forge a second log line).
• The voice-agent image ships aiohttp 3.14.5 and the sidecar image pypdf 6.21.2. aiohttp 3.14.3 had eight open advisories (three High; fixed in 3.14.4) and pypdf 6.19.0 five (fixed through 6.21.1). Both requirements.lock files were regenerated with services/lock-requirements.sh; only those two packages moved.
• Core generates and reads DOCX/XLSX/PPTX with Apache POI 5.5.1 (was 5.3.0). 5.4.0 fixed the advisories listed for poi-ooxml (CVE-2025-31672 among them). The version is one property, poi.version in core/pom.xml, for core/documentgen and core/omnichannel; the commons-io pin rose from 2.17.0 to 2.21.0 because POI calls into it. PoiVersionAndRoundTripTest guards the floor and writes then reads back an XLSX and a DOCX.
• App Builder starters scaffold patched build tools. node-react and capacitor-app use vite ^7.3.7 (was ^5.4.0) and astro-site uses astro ~7.3.8 (was ^4.16.0, one Critical advisory and seventeen more). Astro stays on 7.3 because 7.4.2 and later need Node 22.23.4, newer than the workspace runner's; each starter was built with npm install && npm run build on Node 22.23.3. The React 19, Capacitor 8 and TypeScript 7 majors in Dependabot pull request #43 are not part of this.
• The console's lockfile takes the fixed vitest, vite, js-yaml, browserslist, brace-expansion, source-map-js and baseline-browser-mapping releases (vitest 4.1.12, vite 7.3.7, js-yaml 4.3.2, browserslist 4.29.4, brace-expansion 1.1.21, source-map-js 1.2.2, baseline-browser-mapping 2.11.30). Everything except the last two is a dev dependency; package.json changes only the two vitest ranges, and next and sharp are left to the pull request that patches them.
• Pathological text can no longer tie up a request thread in a regular expression (CodeQL java/redos and java/polynomial-redos). The consent keyword reader (ConsentText.normalize, fed by inbound channel text) took about 8 s on 50,000 characters of punctuation; it now reads at most 512 characters and treats anything longer as "not a keyword" (never as consent). The pasted GitHub skill-folder link (SkillRegistryClient) was matched with a nested optional-slash group that backtracks exponentially (22 s at 50,000 characters); it is now a linear pattern and links over 400 characters are refused before matching. The email patterns in PiiGuardrail, LlmGatewayPiiRedactor, SensitiveDataMasker, SkillDraftScrubber, HookRedactor and TurnRedaction (13-19 s at 50,000 characters; PolicyPackPatternMatcher, which only detects, keeps a 64-character-bounded pattern that already matches any address) and the PEM private-key patterns in the step-event redactor, PatternBasedGuardrailService, SensitiveDataMasker and SkillDraftScrubber (quadratic on text full of BEGIN lines) are replaced by one linear scanner, TextRedaction in core/security: a regular expression bounded to 64 characters before the @ finds the address and the match is then widened in code over the rest of the local part, so an address with a 65, 70 or 300-character local part is still redacted whole; a private-key block is found with indexOf and spans the first BEGIN to the first matching END, as before.
• WorkspaceFiles.saveUpload checks the file name itself. It relied on the controller to strip directories; it now refuses a name containing /, \ or NUL, or equal to . or .., so no caller can write outside the chosen folder.
• The browser-runner image clears the high-severity image scan. It no longer carries the base image's npm, whose bundled tar 7.5.19, undici 6.27.0, ip-address 10.2.0 and brace-expansion 5.0.7 had high advisories with fixes (GHSA-r292-9mhp-454m, GHSA-rfgv-xxqx-mfg5, GHSA-mwp4-54f8-5fhr, GHSA-rgw5-rvv9-x895 and three more); the server starts with node, not npx. Playwright 1.49.0 (GHSA-7mvr-c777-76hp) is replaced by 1.63.0 (see Fixed), and the image upgrades the base image's openssl (CVE-2026-84782).
• The web console image no longer ships known High vulnerabilities with fixes available. next 16.3.6 -> 16.4.2 (GHSA-cjq9-62q9-8jv4, SSRF in the image optimiser, already limited to the hosts in images.remotePatterns; and, published 2026-10-22, the Critical GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (unauthenticated remote code execution) and the High GHSA-p3m5-59mp-jv5r, all fixed in 16.4.1) and sharp 0.35.4 -> 0.35.5 (GHSA-wq5f-xc86-pv6w). The runtime stage also deletes the node base image's npm, corepack and yarn, which the console never runs and whose bundled brace-expansion, ip-address, picomatch, pacote and sigstore carried 10 more High advisories; grype --only-fixed now reports nothing for the image. scripts/ci/web-image-deps.sh keeps both fixes from regressing.
• **The core images ship the fixed releases of six Java de...

Java Agent SDK 0.1.1

Java Agent SDK 0.1.1 (io.github.cd-lc:vegaduta-agent-*). Verify the jars with sha256sum -c SHA256SUMS and gh attestation verify <jar> --repo CD-LC/vegaduta. Maven Central availability is announced in CHANGELOG.md.

v0.1.9

Added

• Conversations follow you. GET /api/chat/threads lists the signed-in user's chat sessions (title, agent, last activity) and DELETE /api/chat/threads/{agentId}/{sessionId} removes one; the Assistant merges them into its thread list, so history shows on a new browser or device. Needs APP_CHAT_BRANCHING_ENABLED=true (404 otherwise; the console then keeps its local list). The Assistant now records its turns in the conversation tree, and reopening a thread older than the 24 h session window reads the stored tree.

Fixed

• Service and database images clear the release's critical-vulnerability gate again. Two advisories published after v0.1.8 stopped the v0.1.9 image scan: Pillow 12.3.0 (critical GHSA-8g5g-8vmr-9782, fixed only in 13.0.0) in the sidecar, voice-agent and code-intel images, and certifi 2026.10.18 inside the CloudNativePG base of the postgres:16-pgvector-age image. Pillow is now 13.0.0 in all three; code-intel needs services/code-intel/overrides.txt for that, since fastembed caps Pillow below 13 although code-intel only uses its text embeddings, and so installs its lock with --no-deps. The CNPG image replaces its certifi with the hash-pinned 2026.10.19 wheel at build time (deploy/postgres/replace-certifi.py), because its pip is removed upstream.
• Service images carry certifi 2026.10.19. certifi 2026.7.22, pinned in the app-builder, code-intel, rl-trainer, sidecar and voice-agent locks, has a critical advisory (GHSA-6q48-6c7w-9gw2) published after v0.1.8, and the release's image scan stopped on it. The five locks now pin 2026.10.19; nothing else changes.
• WhatsApp QR messages are no longer split between processes. The jobs and worker shapes ran a second WhatsApp QR receiver next to the API's, so on a full install with the bridge each took a share of a linked number's incoming messages. They now switch it off, like the Signal receiver (app.whatsappqr.receive.enabled: false in application-jobs.yml and application-worker.yml).
• The chat artifacts directive keys sit where the code reads them. The artifacts block in application.yml was nested under app.chat.branching, where nothing reads it; it now sits under app.chat.directives. Defaults and the APP_CHAT_DIRECTIVES_ARTIFACTS_* variables are unchanged.
• A personal install keeps chat history. The 0.1.8 note said personal installs already had it on; they did not: personal.yml never set APP_CHAT_BRANCHING_ENABLED and core defaults it to off, so the Assistant's history stayed in one browser and a conversation expired after 24 h. The personal profile now turns it on (app.chat.branching.enabled, still APP_CHAT_BRANCHING_ENABLED=false in deploy/compose/core.env to switch it off). Conversations that had already expired are not recovered.
• A personal install's local model answers again by itself after a secrets change. When the install kept its database but got a new .env (a re-install, or a repaired install), the local model's platform-pool entry was still listed as "in use" while every chat answered "No platform LLM is configured": its stored key no longer decrypted under the new APP_ENCRYPTION_KEY, so the chat path left it out. Core now repairs that entry (re-keys it, re-enables it, switches the pool back on) at every start and, when a chat still finds the pool empty, on the spot during that chat. The troubleshoot page says why the entry cannot be used instead of calling it in use, and the chat notice points to Troubleshoot.
• Windows: the personal install no longer stops with "required variable WORKSPACE_RUNNER_SECRET is missing a value". The PowerShell launcher (scripts/vegaduta.ps1, which the Setup app runs on Windows) generated a shorter list of secrets than scripts/vegaduta: it lacked WORKSPACE_RUNNER_SECRET, which personal.yml and lite.yml require, and SEARXNG_SECRET, which web search requires. It now generates both, and an existing install gets them on its next start. A test fails CI when the two lists differ again.
• No secret a compose file requires can stop an install again. Both launchers (scripts/vegaduta, scripts/vegaduta.ps1) now generate every secret-like variable any file under deploy/compose marks as required (so the opt-in WhatsApp QR and DefectDojo overlays no longer need hand-made secrets), not only the ones in their own table; and before up, each asks Docker Compose itself what is still missing and fills it, stopping with a plain "set X in .env" only for a value that is not a secret. The PowerShell launcher also no longer crashes on a Compose error written to stderr while it checks the database password. tests/install covers all three paths.

Images

Multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless), with SPDX SBOM and SLSA provenance attestations:

• ghcr.io/cd-lc/app-builder:0.1.9
• ghcr.io/cd-lc/browser-runner:0.1.9
• ghcr.io/cd-lc/code-intel:0.1.9
• ghcr.io/cd-lc/core-full:0.1.9
• ghcr.io/cd-lc/core-jobs:0.1.9
• ghcr.io/cd-lc/core-worker:0.1.9
• ghcr.io/cd-lc/core:0.1.9
• ghcr.io/cd-lc/mcp-stdio-runner-browser:0.1.9
• ghcr.io/cd-lc/mcp-stdio-runner:0.1.9
• ghcr.io/cd-lc/omnibus:0.1.9
• ghcr.io/cd-lc/postgres:16-pgvector-age-0.1.9 (CloudNativePG operand)
• ghcr.io/cd-lc/postgres:0.1.9
• ghcr.io/cd-lc/rl-trainer:0.1.9
• ghcr.io/cd-lc/sidecar:0.1.9
• ghcr.io/cd-lc/tool-sandbox:0.1.9
• ghcr.io/cd-lc/voice-agent:0.1.9
• ghcr.io/cd-lc/web:0.1.9
• ghcr.io/cd-lc/workspace-runner:0.1.9

Helm charts: oci://ghcr.io/cd-lc/charts (version 0.1.9).

Verify the download

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/CD-LC/vegaduta/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

Java Agent SDK 0.1.0

Java Agent SDK 0.1.0 (io.github.cd-lc:vegaduta-agent-*). Verify the jars with sha256sum -c SHA256SUMS and gh attestation verify <jar> --repo CD-LC/vegaduta. Maven Central availability is announced in CHANGELOG.md.

v0.1.8

Fixed

• The first chat no longer waits for the platform model to wake up. A hosted model that scales to zero took 70 s or more to answer the first message. The console now asks core to load it (POST /api/platform-llm/warm, a one-token request to the pool's top row, at most once every 4 minutes per core instance) as soon as someone signs in or opens a chat. If a reply still has not started after 8 seconds, the chat says the model is starting up and that later replies are fast. Off with APP_PLATFORM_LLM_WARM_ENABLED=false.

Changed

• Chat history is kept by default on full installs and in the Helm chart. APP_CHAT_BRANCHING_ENABLED now defaults to true in deploy/compose/docker-compose.yml (lite and personal already had it) and the chart gains core.branchingEnabled (default true), so each message is stored in Postgres for 30 days instead of expiring from Redis after 24 h. Conversations that had already expired are not recovered. Set it to false to go back.
• Local models answer sooner. The Compose local-ai overlay now loads the model when the stack starts and keeps it in memory (OLLAMA_KEEP_ALIVE=-1, OLLAMA_FLASH_ATTENTION=1), so the first reply no longer pays a cold start, and sends reasoning_effort: none so reasoning models skip their hidden thinking pass (LOCAL_LLM_REASONING_EFFORT changes it; new core property app.llm.ollama.reasoning-effort, blank by default outside the overlay). The Assistant shows a short note when it runs on a local model, with a link to Agent settings where it can be tuned for speed or quality.
• Academy links everywhere, Academy source nowhere. The Academy is a separate, proprietary deployable, so the open-source console links to it but carries none of its content: the in-console /learn index, the screen→lesson map (consoleLessonMap.ts), the curriculum index and every lesson-id deep link are removed, and per-screen "Learn this" buttons become plain links to the Academy. The OSS landing header and footer, the docs site nav and every tier's compose/Helm defaults point at the hosted academy.vegaduta.ai (WEB_ACADEMY_URL/NEXT_PUBLIC_ACADEMY_URL, still overridable; "" hides the links on a fork). The personal tutor stays at /learn/tutor.

Images

Multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless), with SPDX SBOM and SLSA provenance attestations:

• ghcr.io/cd-lc/app-builder:0.1.8
• ghcr.io/cd-lc/browser-runner:0.1.8
• ghcr.io/cd-lc/code-intel:0.1.8
• ghcr.io/cd-lc/core-full:0.1.8
• ghcr.io/cd-lc/core-jobs:0.1.8
• ghcr.io/cd-lc/core-worker:0.1.8
• ghcr.io/cd-lc/core:0.1.8
• ghcr.io/cd-lc/mcp-stdio-runner-browser:0.1.8
• ghcr.io/cd-lc/mcp-stdio-runner:0.1.8
• ghcr.io/cd-lc/omnibus:0.1.8
• ghcr.io/cd-lc/postgres:16-pgvector-age-0.1.8 (CloudNativePG operand)
• ghcr.io/cd-lc/postgres:0.1.8
• ghcr.io/cd-lc/rl-trainer:0.1.8
• ghcr.io/cd-lc/sidecar:0.1.8
• ghcr.io/cd-lc/tool-sandbox:0.1.8
• ghcr.io/cd-lc/voice-agent:0.1.8
• ghcr.io/cd-lc/web:0.1.8
• ghcr.io/cd-lc/workspace-runner:0.1.8

Helm charts: oci://ghcr.io/cd-lc/charts (version 0.1.8).

Verify the download

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/CD-LC/vegaduta/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

v0.1.7

Fixed

• Windows Setup no longer fails with "A required privilege is not held by the client". The release package carried one symlink (deploy/models/catalog.txt), which Windows only lets administrators or Developer Mode create, so Setup stopped while unpacking. The release now ships the file itself, and Setup copies the file whenever the system refuses a symlink.
• A database left by an earlier install no longer stops the start. Installing into a new folder generates a new database password, but the data volume kept the earlier install's one, so db-roles failed ("password authentication failed", exit 2) and nothing came up. personal and up (bash and PowerShell) now notice this, set the database to this install's password (the data is kept) and start again.
• Re-installing never locks you out of your own data. The install's secrets (database passwords, APP_ENCRYPTION_KEY) are also kept outside the install folder (~/.config/vegaduta/secrets.env, %LOCALAPPDATA%\VegaDuta\secrets.env on Windows and WSL), so a new folder reuses them. When Docker holds an earlier install's data and no copy exists, that data is left untouched and the new install starts under its own project (VEGADUTA_PERSONAL_PROJECT).
• Windows: re-running Setup with VegaDūta already running works. The personal checks no longer fail on ports 3000/8080 held by VegaDūta's own containers, use WEB_HOST_PORT/CORE_HOST_PORT, and also catch ports Windows reserves (Hyper-V/WinNAT), which look free but cannot be used. Setup stops with the fix instead of retrying a port conflict three times.
• Windows: personal installs get Valkey and the tools runner, as on macOS/Linux. vegaduta.ps1 now adds the valkey profile and, with the Tools or Browser add-on, routes STDIO connectors to mcp-stdio-runner.
• A failed model download no longer stalls the install for an hour. The Ollama container retries the download and restarts after five failures instead of staying up but never healthy.

Images

Multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless), with SPDX SBOM and SLSA provenance attestations:

• ghcr.io/cd-lc/app-builder:0.1.7
• ghcr.io/cd-lc/browser-runner:0.1.7
• ghcr.io/cd-lc/code-intel:0.1.7
• ghcr.io/cd-lc/core-full:0.1.7
• ghcr.io/cd-lc/core-jobs:0.1.7
• ghcr.io/cd-lc/core-worker:0.1.7
• ghcr.io/cd-lc/core:0.1.7
• ghcr.io/cd-lc/mcp-stdio-runner-browser:0.1.7
• ghcr.io/cd-lc/mcp-stdio-runner:0.1.7
• ghcr.io/cd-lc/omnibus:0.1.7
• ghcr.io/cd-lc/postgres:16-pgvector-age-0.1.7 (CloudNativePG operand)
• ghcr.io/cd-lc/postgres:0.1.7
• ghcr.io/cd-lc/rl-trainer:0.1.7
• ghcr.io/cd-lc/sidecar:0.1.7
• ghcr.io/cd-lc/tool-sandbox:0.1.7
• ghcr.io/cd-lc/voice-agent:0.1.7
• ghcr.io/cd-lc/web:0.1.7
• ghcr.io/cd-lc/workspace-runner:0.1.7

Helm charts: oci://ghcr.io/cd-lc/charts (version 0.1.7).

Verify the download

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/CD-LC/vegaduta/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

v0.1.6

Fixed

• The local model follows Ollama when it moves. Installing Ollama on the computer after an install that used the Ollama container now switches personal to it (Windows and macOS/Linux launchers) instead of keeping the container, and core repoints its own "Local model (Ollama)" pool row to the new address and model. Before, the row kept calling the old Ollama, so the console showed a local model in use while every chat failed. A row whose model is not on its Ollama (never pulled, or removed) switches to the configured model when that one is there, and an Ollama that is installed but not running (after a restart, or its app was closed) is started; if it still does not answer, the container takes over.
• No GPU, no GPU mode. Docker on WSL2 lists the nvidia runtime even on a laptop without a graphics card, which switched the Ollama container to GPU mode and made it fail to start ("no adapters were found"). The GPU overlay is now used only when nvidia-smi reports an adapter.
• Installing from a checkout or a download of main just works. An empty VEGADUTA_VERSION used to stop personal with an error; it now uses the latest published release and records it in .env.

Changed

• The local model's context window follows Docker's memory. Under 6 GB the container model runs with an 8192-token window, under 10 GB 16384, otherwise the 32768 default (LOCAL_LLM_NUM_CTX overrides), so a small laptop is not pushed into out-of-memory kills by the model's working memory.
• Local AI stays the default on small machines. personal no longer drops to the cloud-key path below 8 GB of RAM: it picks the smallest catalog model (CPU only is fine) and warns that the first reply is slow; only machines under 4 GB keep the cloud-key path. The model is now sized to the memory Docker actually has when it runs in the Ollama container (a WSL2 or Docker Desktop VM is often much smaller than the machine), with a hint to raise Docker's memory for a bigger one. --local-ai given by hand now gets a model sized the same way instead of Docker's qwen3.5:4b default, and under WSL2 the script offers (with a yes, a backup and the one restart step) to give Docker 8 GB through %UserProfile%\.wslconfig.

Images

Multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless), with SPDX SBOM and SLSA provenance attestations:

• ghcr.io/cd-lc/app-builder:0.1.6
• ghcr.io/cd-lc/browser-runner:0.1.6
• ghcr.io/cd-lc/code-intel:0.1.6
• ghcr.io/cd-lc/core-full:0.1.6
• ghcr.io/cd-lc/core-jobs:0.1.6
• ghcr.io/cd-lc/core-worker:0.1.6
• ghcr.io/cd-lc/core:0.1.6
• ghcr.io/cd-lc/mcp-stdio-runner-browser:0.1.6
• ghcr.io/cd-lc/mcp-stdio-runner:0.1.6
• ghcr.io/cd-lc/omnibus:0.1.6
• ghcr.io/cd-lc/postgres:16-pgvector-age-0.1.6 (CloudNativePG operand)
• ghcr.io/cd-lc/postgres:0.1.6
• ghcr.io/cd-lc/rl-trainer:0.1.6
• ghcr.io/cd-lc/sidecar:0.1.6
• ghcr.io/cd-lc/tool-sandbox:0.1.6
• ghcr.io/cd-lc/voice-agent:0.1.6
• ghcr.io/cd-lc/web:0.1.6
• ghcr.io/cd-lc/workspace-runner:0.1.6

Helm charts: oci://ghcr.io/cd-lc/charts (version 0.1.6).

Verify the download

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/CD-LC/vegaduta/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

v0.1.5

Changed

• Personal installs come with a free local model. personal (bash and vegaduta.ps1, so the Setup app too) now picks the model that fits the machine's RAM from the shared catalog and downloads it without asking: free open-weights models, no account or subscription. On macOS (Homebrew) and Windows (winget, per-user) Ollama itself is installed and started when missing, so the model runs natively and can use the GPU; Linux and WSL, and any failed install, use the Ollama container. Previously it only adopted an Ollama that was already installed, so most machines ended up with no model. --cloud (-Cloud) opts out and is remembered; machines under 8 GB of RAM keep the cloud-key path; installs that never chose get the model on their next run. The first start waits up to an hour for the download, and the Setup app gives Docker room for the model.

Changed

• Setup app repairs the machine instead of stopping. Clicking Install now installs Docker Desktop (silently accepting its licence, so no first-launch screen), starts it, turns on WSL2 on Windows (one permission prompt; after a required restart Setup reopens by itself), gives Docker's WSL2 VM enough memory through %USERPROFILE%\.wslconfig when the computer can spare it, and turns on Docker's start-at-sign-in so the stack returns after a reboot. A failed start is classified (stale registry login, full disk, stopped engine, interrupted download, slow first boot), repaired and retried up to three times. Missing or stopped Docker no longer blocks the Install button. The setup app also accepts the SHA256SUMS.txt asset name used by v0.1.0.
• Merged landing page and release-aware public copy. The signed-out homepage keeps the OSS landing's technical spine (capabilities, standards, SDK-as-dependency, install paths) under the marketing chrome (ambient backdrop, display typeface), and adds direct "Download the release" and "Try it live" calls to action. Install instructions now use the signed release artifacts (desktop installers, pinned GHCR images, the published Helm chart) instead of a source build, and every public license mention follows the Business Source License 1.1 relicensing (SDK stays Apache-2.0).
• Tenant surfaces stop offering server-side controls. On a full install (NEXT_PUBLIC_DEPLOY_ENV=full) /add-ons leaves the rail and renders an "all add-ons included" notice instead of switches, since every extra already ships. The local-model wizard (/providers/local-model), its entry points on /providers, the local-model card on /troubleshoot and the Assistant's model warm-up are now personal-install only (localModelAllowed) — on lite and full the LLM pools are operator-managed infrastructure a tenant can browse but not change.

Security

• Browser images ship the current stable Chrome. core-full and mcp-stdio-runner-browser install Chrome-for-Testing stable at build time (behind a fixed current path for PUPPETEER_LAUNCH_OPTIONS) and drop the Chrome 131 builds puppeteer@23.11.1 downloads for itself, so the release image scan no longer fails on fixed critical CVEs.
• Release images move off Debian bookworm. Node services to *-trixie-slim (22.23.3 / 24.21.0), Python services to 3.12.15-slim-trixie, the JRE to eclipse-temurin:21.0.12.1_1-*-noble, PostgreSQL to postgres:16.15-trixie and CloudNativePG to 16.15-system-trixie. The release's critical-vulnerability gate now fails only where a fixed package exists (only-fixed), and .grype.yaml records the scoped wont-fix exceptions (re-matched automatically the day Debian ships a backport).

Changed

• The OSS landing now sells the whole suite. / leads with three ways in - run the platform (Personal, Lite, Full, Kubernetes), build on the SDKs (Java, Python, REST clients), extend with plugins and apps (IDEs, browsers, mobile, MCP) - plus a "Get VegaDūta" section with per-OS installer cards, the terminal installer, Helm and the verification step.

Fixed

• Downloads page shows the brand name correctly. Headings use the BrandName wordmark (orange "Dūta") instead of plain text.

Images

Multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless), with SPDX SBOM and SLSA provenance attestations:

• ghcr.io/cd-lc/app-builder:0.1.5
• ghcr.io/cd-lc/browser-runner:0.1.5
• ghcr.io/cd-lc/code-intel:0.1.5
• ghcr.io/cd-lc/core-full:0.1.5
• ghcr.io/cd-lc/core-jobs:0.1.5
• ghcr.io/cd-lc/core-worker:0.1.5
• ghcr.io/cd-lc/core:0.1.5
• ghcr.io/cd-lc/mcp-stdio-runner-browser:0.1.5
• ghcr.io/cd-lc/mcp-stdio-runner:0.1.5
• ghcr.io/cd-lc/omnibus:0.1.5
• ghcr.io/cd-lc/postgres:16-pgvector-age-0.1.5 (CloudNativePG operand)
• ghcr.io/cd-lc/postgres:0.1.5
• ghcr.io/cd-lc/rl-trainer:0.1.5
• ghcr.io/cd-lc/sidecar:0.1.5
• ghcr.io/cd-lc/tool-sandbox:0.1.5
• ghcr.io/cd-lc/voice-agent:0.1.5
• ghcr.io/cd-lc/web:0.1.5
• ghcr.io/cd-lc/workspace-runner:0.1.5

Helm charts: oci://ghcr.io/cd-lc/charts (version 0.1.5).

Verify the download

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/CD-LC/vegaduta/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

VegaDūta 0.1.0

First tagged release.

Setup app (checks Docker, downloads the release, opens the console):

• macOS: VegaDuta-Setup-0.1.0.dmg (unsigned - Gatekeeper warns once)
• Windows: vegaduta-setup-windows-amd64.zip (unsigned - SmartScreen warns once)
• Linux: vegaduta-setup-linux-{amd64,arm64}.tar.gz

Terminal: curl -fsSL https://raw.githubusercontent.com/CD-LC/vegaduta/main/install.sh | sh

Source: vegaduta-0.1.0.tar.gz - verify against SHA256SUMS.txt.

Container images for this tag were built but their publish is held by the image vulnerability gate; pull them by digest from ghcr.io/cd-lc once the gate is resolved.