v0.4.0 — DADL v0.2 Core Runtime

ToolMesh 0.4.0 implements the runtime side of the finalized DADL specification v0.2 — every feature the spec's §15.4 Core Runtime profile demands — plus the transport, discovery, and file-handling work accumulated since 0.3.0.

DADL v0.2 Core Runtime

• requires gate (§15.3, fail-closed). A file declaring requires: {toolmesh: ">=0.4.0", features: [redact, …]} loads only on a runtime that satisfies every entry; anything else is refused with the missing capability named. Unknown keys warn-and-ignore (deduplicated, visible in the log) instead of vanishing. With this release, requires.toolmesh ranges finally have real versions to bind to.
• response.redact (§9.3). Declared JSONPaths are masked with [REDACTED] after the transform pipeline and before any caller-visible output — Code Mode results, composite-internal calls, logs, audit. Redact lists merge additively across defaults and tool level and cannot be disabled by the caller. The JSONPath engine now implements the full §9.4 dialect (name, index, wildcard); descendant segments are rejected instead of silently misread.
• Semantic error codes (§8.2). Failed calls produce [not_found] HTTP 404: no such customer (provider_code=resource_missing) — a stable code from errors.map or the well-known default table (never absent), plus the provider's own code via the previously inert errors.code_path. Composite code can branch: catch (e) { if (e.code === "not_found") … }.
• Idempotency keys (§6.6). Tools declaring idempotency get a uuid_v4 key generated before the first attempt and replayed on every retry of that logical call; distinct calls and pagination pages get distinct keys. The header is managed by ToolMesh and cannot be overridden.
• OAuth2 jwt_bearer and authorization_code (§5.3). Service accounts per RFC 7523 (RS256 signed with the standard library, token_uri fallback from the key, optional subject for domain-wide delegation), and runtime renewal for setup-driven three-legged OAuth.
• returns, deprecated, replaced_by (§6.5/§6.7). Typed results and deprecation markers flow into generated TypeScript and into the live tool descriptors: descriptions lead with DEPRECATED: … — use X instead. and trail with Returns: <type>, so discover_tools, toolmesh.describe, and Code Mode all see them.
• api_key alias (§15.4) accepted and normalized to apikey.

Implemented feature identifiers: refresh_token, composites, file_url, redact, semantic_errors, idempotency, jwt_bearer, authorization_code, returns, deprecation.

Conformance: this is the spec's Core Runtime profile — not Full. Not yet implemented: health checks (§4.6), refresh_token_rotation, token_auth: basic, §8.1 proactive rate-limit throttling, and the interactive authorization_code consent tool. Files depending on those refuse cleanly via requires or warn visibly.

Breaking changes — read before upgrading

• Retry safety (§8, normative). Automatic retries now require an idempotent method (GET/HEAD/PUT/DELETE), a declared idempotency block, or retry_unsafe: true. A POST/PATCH with none of these fails on the first retryable error (429/5xx) instead of being retried — re-execution could duplicate the write. The error text names both remedies. Review write-heavy DADLs and opt back in deliberately where duplication is safe.
• Unknown enum values refuse the file (§15.3). pagination.behavior accepts only auto/expose, response.stream_handling only collect/skip; together with the existing checks the behavior-determining enum list is now enforced in full. DADLs carrying informal values (e.g. behavior: manual) must be corrected before upgrading — the registry copies are already clean.
• Strict backends.yaml and the discover_tools rename from the accumulated 0.3.x work also land in this release — see the changelog.

Also in this release

Streamed tools/call responses with keepalives (no more 60s client timeouts on long calls), per-backend first-use hints, include_tools/expose_tools surface control, progressive discovery with BM25 search, in-sandbox toolmesh.discover/describe, DADL §6.2 file handling (file_url in and out), composite sandbox lockdown hardening, and fail-closed authorization for composite child calls. Full details in CHANGELOG.md.

Docker image: ghcr.io/dunkelcloud/toolmesh:v0.4.0