What's Changed since v1.1.0
Runtime stability and analyzer lifecycle
- Fixed oversized
workflow.analyze.statusresponses so pruning keeps schema-valid structured content and reports pruning through warnings. - Fixed static Python worker envelope handling so tools such as
entropy.analyzereturn flat schema-valid data instead of nesteddata.datapayloads. - Preserved staged-analysis
job_idvalues across queued/running/completed states so recovery logic no longer misclassifies active stages. - Added idle eviction for persistent runtime workers so idle
static_worker.pyprocesses terminate after their configured TTL. - Added task status visibility for external analyzer subprocess RSS/process counts.
- Materialized PE
.pdataruntime function entries into the function index frompe.pdata.extract.
Analyzer / Runtime split
- Added the
@rikune/runtime-node,@rikune/windows-host-agent,@rikune/shared, and@rikune/plugin-sdkworkspace packages. - Standardized runtime contracts and runtime control-plane types across plugins, the runtime client, and runtime node.
- Added runtime backend capabilities, toolkit manifest probing, sidecar upload support, task event streaming, and runtime tool support diagnostics.
- Delegated behavior capture, runtime deobfuscation tools, and managed fake C2 workflows to the runtime node.
- Prefer runtime contracts in the delegation bridge and removed legacy local dynamic worker policy routing.
Plugin and SDK surface
- Reworked the plugin system into discovery/orchestration modules and made
@rikune/plugin-sdkthe public contract surface for plugin authors. - Hardened built-in plugin discovery and contract validation.
- Added tool readiness diagnostics, runtime support mapping, richer plugin listing, and MCP registry/script resource support.
- Fixed the workspace package identity for
@rikune/plugin-sdkso CI no longer attempts to fetch the private SDK from the public npm registry.
Deployment, Docker, and agent connectivity
- Added the Rikune agent connector gateway and
rikune-agentbinary entrypoint. - Improved Docker analyzer/runtime profile generation and fixed non-root analyzer startup.
- Included static asset copying in Docker builds.
- Updated install/deployment scripts for the analyzer/runtime split and hybrid sandbox runtime workflows.
Documentation
- Reworked README, Chinese README, install, deployment, architecture, plugin, troubleshooting, SDK, worker, script-resource, and MCP client setup docs to match the current architecture.
- Clarified dynamic runtime readiness, deployment profile selection, and Analyzer/Runtime responsibilities.
Tests and CI
- Added regression coverage for response pruning, staged run
job_idpreservation,.pdatafunction materialization, runtime worker idle eviction, runtime contracts, plugin SDK behavior, runtime toolkit manifest validation, and worker pool behavior. - Stabilized Windows CI unit tests by making Speakeasy unit coverage use an injected worker response instead of launching a real emulator.
- Fixed ESM test path handling and runtime contract schema validation.
Release hygiene
- Bumped the root package version to
1.2.0.
Full comparison: v1.1.0...v1.2.0
What's Changed
- Beta by @Last-emo-boy in #24
- Beta: stabilize analyzer runtime and refresh docs by @Last-emo-boy in #29
Full Changelog: v1.1.0...v1.2.0