v0.14.0

Added

• An adapter can give a prompt run a home of its own: runner.launch may return
  home, an existing directory that becomes the run's HOME (a warm session's
  too). Without it, a run's HOME is still the add-on's, which the console
  shares, so what the console's user installed there (skills the engine picks up
  by itself) can reach every read. A home that is not an existing directory
  named by an absolute path fails the run before the agent starts. The README
  documents what an engine needs from HOME to stay signed in. The session check
  (session-check.js) now holds launch's result to the same rules as a read
  does, and frees what launch allocated when it stops early; so does a warm
  session that fails to start.
• A read refused for the engine's sign-in now says which credential was refused,
  when the adapter names it on the result (credential: durable for the one
  set in the add-on's options, login for the engine's stored sign-in): on the
  degraded answer and on /api/status as auth.credential. Absent means
  unknown, as before. The adapter API version does not change: both are optional.

v0.13.1

Fixed

• With prompt_keep_warm on, a read after Home Assistant refused the token was
  answered by the warm agent with prose, and was recorded as healthy, instead of
  the notice and the degraded outcome a fresh read gives. A warm session is now
  neither served nor kept while Home Assistant does not accept the connection
  (refused or unreachable): the read runs fresh and is judged like any fresh read.
  Because a warm turn makes no request that could show a change, the server asks
  Home Assistant about the token (one request) before it offers a read to a warm
  session; a token already known to be refused is not asked about again.
• A streamed answer that a notice replaces (a device that matches more than one,
  or none) used to stop mid-word where the stream's hold-back ended, and the
  notice followed. The model's text now goes out whole before the notice.
• The hook audit lines (cc-hook-audit, cc-hook-backup) were stamped in local
  time while the prompt server's lines in the same file are UTC. The shell writers
  now take the stamp from one function, audit_timestamp (UTC, the prompt
  server's format), and a test discovers every writer of the file and runs each
  under a zone far from UTC.

v0.13.0

Added

• The option prompt_keep_warm (off by default) lets a read be answered by an
  agent that is already running, so it skips the agent's start and its connection
  to Home Assistant. The engine's conversation is reset before every read and the
  read is sent only after the reset is confirmed. Between reads the agent cannot
  call a Home Assistant tool or read a camera. A session serves only reads from the
  same client with the same model, language and surface, never a camera question,
  a web read, an automation edit or a retry. At most two run at once, each costing
  the memory of one agent process. People who talk through one integration share
  its session.
• An engine adapter may declare runner.session to support it, and
  server/prompt/session-check.js checks that the bundled engine still resets a
  session.
• An engine adapter may declare runner.userText(text), the engine-safe form of a
  read's text. The core applies it to every read before the engine sees it, on a
  fresh run and in a warm session alike, so a question can never be taken for one
  of the engine's own commands.

Changed

• Every answer, including a voice command through Assist, arrives sooner: a read now
  answers as soon as the agent reports its result, instead of after the agent has
  finished shutting down, which added most of a second to each request. The answer is
  decided by the same rules as before. Anything the agent writes after its result is
  dropped: it is not streamed and its tool calls are not counted, and the add-on log
  notes it once per request, without the content.

v0.12.1

Fixed

• A device whose live-context entry ends with its areas (a light that is off, a switch
  or a button in an area) was refused as matching more than one device, with itself as
  the only candidate, and no action was proposed. Its entry is now compared without the
  blank line Home Assistant ends its answer with, so it no longer depends on where the
  device sits in an answer. The same difference could also single out one of two devices
  that print the same, instead of refusing both; they are refused again.
• A streamed answer whose text the core replaces, such as a device that was not found,
  now streams the replacement whole after what already went out. The streamed part used
  to end mid-sentence, or run into the end of the replacement, and the replacement could
  be lost. The final line and the conversation keep the replacement alone.
• A secret longer than the stream's hold-back window, such as a long-lived access token,
  could stream in part before the rest of it arrived and was redacted. Text that may
  still become a secret now stays back until it is complete: a run of key characters
  that has not ended, Bearer or Token before it, and the start of a configured
  secret value. Text written without blanks still streams.

v0.12.0

Added

• GET /api/status publishes protect_secrets_level, read from the
  PROTECT_SECRETS_LEVEL environment variable, or null without one.
• A run with Home Assistant tools gives its adapter toolTimeoutSeconds, 90. An adapter
  must set its engine's timeout for a tool of that server to it.
• The list of protected files is shipped by the core at
  /usr/share/agent-core/protected-paths.txt. An add-on that carries its own copy
  must drop it: the assembly refuses a path both sides claim.

Fixed

• The audit now says how a tool ended when its agent had already left, including
  (answered after its run ended) and (failed, after its run ended) for a tool that
  outlived its run, which used to read only (no answer).
• A tool answered over an event stream is also not stopped by its agent leaving, as a
  tool answered over JSON already was.
• A tool past Home Assistant's limit for one call was cut off with an empty 504, and
  all an agent could say was that its request failed. It now gets a tool error saying
  the tool was cut off and may have stopped halfway, and the audit marks it (failed).
• What 0.11.5 said of a tool whose agent left was too broad. It finishes only inside
  Home Assistant's limit of 60 seconds for one call (measured on 2026.10.4 and
  2026.11.0): past that Home Assistant cancels it wherever it has got to, agent present
  or gone. The hour is not how long a tool can run, only how long the relay waits for a
  Home Assistant that never ends a request.
• Only a tool call stays open for its tool and counts towards the 64 waiting for Home
  Assistant. Anything else closes when its agent leaves and is never refused for that.
• Stopping the relay closes the requests still open to Home Assistant at once and logs
  how many, so they cannot hold up the process. A tool still running on one of them is
  cancelled, as a script was when measured, and a device whose last step had not come
  stays as it is.
• Answers about many devices that were each very large could run the server out of
  memory, because what a lookup remembered counted against nothing. It now has its own
  budget of 16 MiB, and an answer that does not fit is asked for again.
• A lookup refused at its deadline went on asking Home Assistant about every device it
  had left, for an answer nobody waited for. It now stops there.
• Someone asking through Assist for a device on an install past the size bound was
  told to try again, which could not help. They are now told Home Assistant's answer
  is too large, in every supported language, and the audit marks such a lookup
  (lookup, answer too large).
• An event stream has the bounds a JSON answer has. An agent that does not read what
  was written to it loses the stream after 60 seconds, and Home Assistant going
  silent for 10 seconds in the middle of an event ends it. A stream with no event in
  progress may stay silent for as long as a tool takes.
• What was written to an agent and not yet taken by its socket now counts against the
  budget. It stopped counting the moment an event was complete, so several streams
  could each keep a large event in memory uncounted.
• An agent holding its answer could get a device lookup or a confirmed action refused
  as too large. The core's own answers now have a budget of their own.
• A console page whose stylesheets or scripts did not arrive stayed unusable until
  someone reloaded it, because its own script is what reconnects. It now loads again,
  up to five times over about 30 seconds, whatever answered in place of the files,
  and then says the console could not load.
• The console's menus opened partly off the screen on a narrow window. They now stay
  on it, and are never wider than the screen.
• The alert loop's shell error no longer reaches the log when its state file cannot
  be opened.

v0.11.5

Fixed

• When an agent stopped while one of its Home Assistant tools was still running, for
  example a run that ended during a script with a delay, Home Assistant cancelled the
  tool wherever it had got to. A script with several steps could stop halfway and
  leave a device on. The tool now finishes; its answer is discarded. A tool still
  running an hour after its agent left is given up on. With 64 requests waiting for
  Home Assistant to answer, new ones from agents are refused with an error that says
  why, and none of those waiting is closed for it. Affected version: 0.11.4.

v0.11.4

Fixed

• On a large install every confirmed action through Assist failed, because the
  states list used to look up a device passed the 1 MiB cap on what the relay
  reads. The states list is now read as it arrives, up to 64 MiB, and only entity
  ids and friendly names are kept. Affected versions: 0.7.9 to 0.11.3.
• The same cap also hit a large tool catalog, a large live context and a large
  tool answer. An agent got no answer to its call, and a confirmed action that
  Home Assistant had carried out was reported as failed.
  All other answers from Home Assistant now share one budget of 16 MiB across
  everything being read or delivered at the same time.
• An answer past its bound is refused the moment the bound is passed, and the
  connection to Home Assistant is closed. It is named as too large, with the
  bound, to the log and to the agent, instead of "answered with 200" or silence.
• An answer from Home Assistant that stops halfway now fails at once, for a lookup,
  an action and an agent reading it, instead of leaving them waiting on it.
• An agent that leaves now closes its request to Home Assistant, and an agent that
  stops reading a stream now slows it instead of filling memory.

v0.11.3

Fixed

• Changing the personal skills repository option now replaces the cached clone
  with a fresh clone of the new repository; before, the old repository kept
  being pulled.

v0.11.2

Changed

• The hass-mcp registration is reconciled with the current Home Assistant URL
  and token at every start: a changed token or URL replaces it, a removed token
  unregisters it. Needs the adapter to provide the optional
  engine_mcp_remove NAME hook; without it a warning is logged and the old
  registration stays. A hass-mcp the user added without a token is left alone.

v0.11.1

Security

• Update body-parser to 2.4.0, which fixes a denial of service where a
  compressed request body followed by extra bytes could terminate the process.

Fixed

• POST /api/prompt answers 400 with code unreadable_body when the request
  body cannot be decoded (for example a corrupt compressed stream), instead of
  500.