v0.4.0

Features

• (broker) Refuse an unlisted host and let the owner grant it (#107) (79b6aaa)
• (broker) Hold a provider key to its header and declared calls (#106) (0458261)
• (broker) Keep a receipt of every brokered provider call (#101) (31efaa5)
• (chat) List models as provider/model in !model (d8c1248)
• (commands) Add !gen-speech to read a text aloud (35c8320)
• (config) Give sessions kage's edit and music tools (38774bd)
• (config) Give sessions kage's speech tool (bbb9afb)
• (github) Mint each session an App token in place of the PAT (#108) (7aa20df)
• (session) [breaking] Give every session a project of its own (#110) (9e95a04)
• (session) Collect what a cold session left on disk (#105) (d9a4224)
• (session) Post the clips the agent makes (773a886)
• (session) Show what a running tool call is doing (9e1be92)
• (threads) Post what was said on the web in the thread (ec52f98)
• (web) Start from a home composer with model and command pickers (45f0af6)
• (web) Pick a session's model and complete commands (3c467d1)
• (web) Log in with Discord to act as your own account (56540fc)
• Address a channel picture to whoever asked for it (715e9b0)
• Let !gen-image name an effort (38323ab)
• Add !gen-image to run one prompt on the image model (b87e048)
• Generate images and post them to the thread (#35) (4a8011c)

Fixes

• (broker) Judge the dial, follow no redirect, require HTTPS (#70) (e876928)
• (broker) Scrub the credential from what a provider answers (#69) (f108fd5)
• (broker) Mint legible session secrets and scrub them by shape (#68) (c963f29)
• (broker) Give each session a broker and nonces of its own (#67) (9820a7e)
• (broker) Close refusals explicitly so git retries a 407 (e9737af)
• (broker) Require a proxy credential on CONNECT and forwards (#66) (ea629b7)
• (broker) Confine provider requests to configured origins (#58) (3ae5050)
• (chat) Make free-text upload captions inert (#60) (c73fe66)
• (commands) Narrow the help column to leave room under 2000 (18308eb)
• (config) Refuse a public interface that logs nobody in (57b26d0)
• (config) Reject unreachable image configurations (#62) (afdd54e)
• (provider) Stop reading an image answer at its cap (ebc31ba)
• (sandbox) Broker podman sessions and keep secrets off the argv (#103) (40252d6)
• (sandbox) Say what egress allows and refuse the Azure fabric (#98) (10ed2b2)
• (sandbox) Ask kage which provider ids it knows (#64) (5bcfee1)
• (sandbox) Use the google built-in provider id (#61) (d3d67c6)
• (session) Report a failed prompt as a failed turn (88d666d)
• (session) Push from a daemon-owned copy that borrows nothing (#102) (1df9f51)
• (session) Bound every read of a file the agent can grow (#100) (2e6eda5)
• (session) Refuse uploads that hold a secret, floor short tokens (#99) (a061819)
• (session) Wake a stopped thread only for who may take part (1ccb1b3)
• (session) Fetch a song the agent could only link to (da7cb43)
• (session) Tell the agent the image cap stopped its turn (#65) (746a943)
• (session) Interrupt turns that exceed the image cap (#63) (997f1ca)
• (session) Refuse symlinks when reading the agent session id (#59) (1ace712)
• (session) Keep a session alive while a tool call runs (65adcde)
• (session) Name the providers a shared model id is served by (0f48104)
• (session) Quote the failing line when a sandbox runs out of disk (206fc5a)
• (web) Name login cookies so sibling hosts cannot set them (ddd20b0)
• (web) Read projects and transcripts off the async workers (979fee3)
• (web) Ask again whether a visitor is still in the server (d34a4ba)
• (web) Harden the interface against strangers (012538b)
• (web) Show when each thing happened, not when it was replayed (bf7b611)
• Harden transcript links, bailey XDG and late provider keys (#109) (9935da9)
• Stop the agent memory reaching argv and name kills (759f05a)
• Resolve an image model to the provider that lists it (ad61174)
• Draw with the images endpoint, not a chat model (29d046c)

Tests

• (sandbox) Check a brokered bailey session on the real tool (#104) (cef95ee)
• Wait for the session to go idle instead of sleeping (#111) (60525a6)