v0.6.1 - Patch release

Idun Engine v0.6.1 — Password-mode chat fix + per-user scoping

Patch release. Fixes the password-mode chat surface that v0.6.0's security hardening accidentally locked behind /login, and propagates a stable per-session user_id end-to-end so chat history and traces can be scoped per user without a full OIDC ladder.

📋 Full changelog: docs.idun-group.com/changelog

Install

pip install --upgrade idun-agent-engine==0.6.1
idun setup
idun serve

Open http://localhost:8000 — your agent runs at /, admin at /admin, traces at /admin/traces.

Highlights

• Chat works under password auth again. The chat root no longer calls the admin-gated api.getAgent(), which after #614's bind-all guardrail caused a 401-redirect-to-/login even on the open chat surface. Onboarding routing now reads agentReady / bootFailed from /runtime-config.js synchronously at hydration.
• Per-user scoping end-to-end. The chat SPA mints a stable per-session user_id (SSO email when present, else fresh UUID, cached in module state) and attaches X-Idun-User-Id on every /agent/* call. The engine reads it, binds it to a current_user_id ContextVar that adapter code consumes, and falls through to uuid4() if absent — so chat history and traces can be scoped per user without OIDC.
• bootFailed is a boolean now. The raw boot-error string was previously echoed back to anonymous browsers on /runtime-config.js and could leak DB URIs, file paths, and parse traces. The SPA only needs truthiness — boolean is sufficient and safe.

What's added

Engine

• _resolve_user_id on /agent/*: SSO claim (email > sub) > X-Idun-User-Id header > fresh uuid4().hex. Always returns a non-empty string. The header is trusted only when SSO claims are absent (#671).
• _bind_user_id ContextVar wraps adapter calls in list_sessions and get_session so the LangGraph adapter can read current_user_id to scope checkpoint metadata (#671).

Standalone

• /runtime-config.js now carries agentReady (bool) and bootFailed (bool) so the SPA can decide between rendering chat and redirecting to /onboarding synchronously, with no extra HTTP roundtrip (#671).
• Chat SPA mints a stable per-session user_id and attaches X-Idun-User-Id on every /agent/* call. Active id renders in the History sidebar (#671).

What's changed

Engine

• X-Idun-User-Id is validated: capped at 256 chars; control bytes 0x00–0x1F and 0x7F are rejected; on rejection the resolver falls through to the uuid4 fallback so the caller still gets a usable id (#671).

Standalone

• _is_public_runtime_path lets /agent/sessions and /agent/sessions/{id} through the password gate. useChat hits these on every chat page load; without this they 401 and the SPA's global handler hard-navigates to /login even though chat itself is open under auth_mode: password (#671).
• BrandedLayout and InspectorLayout drop the duplicated brand from their own chat-area headers; brand (logo + app name) and the active user_id move into the sidebar top, above History/New (#671).

Docs

• Idun Engine rebrand finalized on docs.idun-group.com (#663).
• Launch-grade v0.6.0 release notes backfilled in CHANGELOGs (#664).

Fixed

• Password mode no longer hard-redirects to /login on the chat surface. The chat root no longer calls api.getAgent() (admin-gated under password mode, the source of the 401-redirect-to-/login bug); onboarding routing now reads agentReady / bootFailed from /runtime-config.js synchronously (#671).

Upgrading from 0.6.0

No config changes required. Plain in-place upgrade:

pip install --upgrade idun-agent-engine==0.6.1

If you use the [guardrails] extra, upgrade with the extra preserved:

pip install --upgrade 'idun-agent-engine[guardrails]==0.6.1'

idun setup is not required for this patch (no migration changes). Existing sessions and traces are preserved.

Standards composed

LangGraph · Google ADK · AG-UI · OpenTelemetry · MCP · OIDC · FastAPI · Pydantic

---

Source: GitHub · Docs: docs.idun-group.com · Community: Discord · Book a call: calendar.app.google

🤖 Release notes prepared with Claude Code