v0.3.0-beta.4

Rakitsu v0.3.0-beta.4

This beta improves monitor steering, request validation, A2A execution timing, and the frontend.

• Oversized session-message bodies now return 413 before decoding, delivery, or retry-key reservation (17 KiB total body; 16 KiB decoded text). Boundary and cancellation/abnormal-exit regressions verify these paths.
• Session-message requests can use Idempotency-Key to retry safely after a wait timeout without enqueueing another message. Conflicting payloads return an explicit error.
• Abnormally interrupted keyed deliveries retain an explicit uncertainty response so retries do not silently enqueue again.
• Monitor messaging documentation explains queued work, reply retrieval, and the difference between delivery and completion.
• A2A execution honors the configured timeout.
• Frontend fixes align the Vue runtime security patch and improve execution-tree display.
• An unused vulnerable test dependency is removed.

Known limits

Message-key replay is local to one server process, limited to 1,024 keys, and retained for 10 minutes after the first response. It does not survive restart. A timed-out wait does not interrupt an active turn; steering can remain queued behind that turn. Retrieve completion through the chat tree and turn endpoints. A repeated keyed POST replays the original response rather than providing fresh completion status.

Controlled timer-to-message-to-persisted-reply validation passed. The exact cause of the earlier deployed monitor stall remains unexplained. The ongoing hourly test uses an earlier candidate and includes a maintenance pause; it is not an uninterrupted soak of this release commit.

Interactive A2A clarification continuation remains unsupported.

CLI run --hub streams to the chosen hub but does not negotiate or inherit that serve instance's history directory. run and serve resolve their own --sessions-dir/config/default independently, so live visibility does not guarantee that the chosen hub can browse the saved CLI history. Multiple hubs require explicit URL selection; automatic serve-instance discovery/selection remains deferred. Avoid sharing session directories across concurrent writers, as documented.

Rakitsu v0.3.0-beta.3

Rakitsu v0.3.0-beta.3

This beta release brings the reviewed beta.3 snapshot to the public repository.

Unattended monitoring

Rakitsu can run scheduled, low-cost checks and wake an agent only when a check changes or raises an alarm. The release CI suite passed end-to-end, stress, and fault-injection tests for wake sessions and persistent monitors.

Try the long-running monitor sample. It includes a wake watcher, an allowlisted task trigger, and monitor deployment examples.

Documentation

• v0.3.0-beta.3 docs
• Latest Rakitsu docs

Other highlights

• Expanded the CLI and feature reference, with command usage and guidance for configuration, providers, tools, orchestrators, sessions, memory, monitors, health checks, A2A, wake timers, and ACP.
• Added interactive walkthroughs for the web UI, start_task, messaging, monitors, wake timers, and rakitsu ask.
• Updated wake monitoring, A2A redirects, image handling, and CLI behavior.

Downloads

Prebuilt binaries are attached for Linux and macOS (amd64 and arm64) and Windows (amd64). checksums.txt, LICENSE, and NOTICE are included with the release assets.

This is a beta prerelease; behavior may change before the stable release.

v0.3.0-alpha.19

Highlights

This is the first release since v0.3.0-alpha.14. A v0.3.0-alpha.18 tag was started but its Windows binary failed to build, so it was withdrawn and never released. Everything that was in it is included here, plus the build fix.

• Native wake timer for rakitsu serve chat sessions (opt-in, settings.wake). A server-owned clock runs cheap checks (file age, file contents, HTTP status, a number from an HTTP JSON response). Quiet ticks make zero model calls. When a check reports a change or alarm, one agent turn is injected into the same session. Limits: an hourly turn cap (default 6), backoff between quiet ticks, a kill-switch file, a heartbeat file, and a per-session audit log. See docs/wake-timer.md.
• start_task: a woken session can launch independent runs of task configs you list under settings.wake.allow.configs. Only listed configs, fixed prompt text, and typed parameters (enum, relative path, bounded integer) are accepted. Caps: tasks per hour, concurrent tasks, per-task timeout.
• Monitors: monitors: in a serve config autostarts long-running sessions (monitor-<id>) that resume after a restart. /healthz reports their state, and rakitsu healthcheck probes it for Docker. Alerts go through a send_alert tool to webhook or ntfy sinks with a host allow-list, redaction, and a rate cap. Sample supervisor files are in deploy/monitor/. See docs/monitor-autostart.md.
• Control: GET /api/chat/{id}/wake/status, POST .../wake/stop, POST .../wake/resume, the /wake status|stop|resume chat command, and a status card in the web UI.
• New --sessions-dir flag (serve, run, sessions) and settings.sessions_dir, so concurrent instances can keep separate session files.
• Files as input: --attach now takes audio as well as images (native on Gemini, transcribed on OpenAI-compatible providers, rejected on Anthropic). Image or audio files named in the query and located in the workdir are attached automatically; --no-auto-attach turns that off. Large images (over 1 MiB by default) are downscaled and re-sent as JPEG; RAKITSU_IMAGE_SHRINK_BYTES=0 disables this.
• Models that write tool calls as text (Qwen3-Coder style <function=...> blocks) are now parsed into real tool calls, only for tools registered in that request. A turn that leaves such a block unparsed is no longer reported as a success.
• ACP: conversation memory (settings.memory.conversation) now works for ACP sessions, and the ACP server reads input lines through a size-bounded reader (16 MiB limit) instead of an unbounded one.

Fixes and hardening

• The wake timer's file lock is now implemented per platform, which fixes the Windows build that broke alpha.18.
• Stopping a wake session is now bounded in time and writes an audit line if something does not stop; resuming after a full stop is refused.
• Heartbeat is written independently of the backoff interval, so a long backoff no longer looks like a stalled session. A missing heartbeat file is reported as starting for a grace period and as stale after that.
• Fixed a flaky wake test that checked its result before the injected turn had run.
• Added red-team style tests for ACP, A2A, and MCP abuse cases.
• Third-party notices: NOTICE now includes elkjs (EPL-2.0, bundled unmodified) and records that jszip is used under its MIT option. web/package.json now declares BUSL-1.1.

Upgrade notes

• The wake timer, start_task and monitors are opt-in. Wake needs settings.wake.enabled: true, and it is refused for configs that use cli, fs, mcp_server, or a2a tools. The monitors: and healthz: keys only matter for serve --config.
• Two things are on by default: auto-attach of files named in a query (use --no-auto-attach to turn it off), and shrinking of images over the size threshold.
• I am not aware of breaking changes; existing configs should run as before.

Known limits

• v0.3.0 is still in progress; this is a pre-release.
• Alpha software, not production-ready.
• The native wake timer has run for hours on a test instance. A full 24-hour unattended run on this build is not finished yet.
• More than about 20 concurrent sessions has not been tested.
• start_task has been tested, but I have not seen it run live in real use yet.
• The Windows file lock has a compile-time check and a test, but it has not been run on a Windows machine yet.
• The wake example (examples/single/14-long-running-monitor) reads prices from CoinGecko's public API. That data belongs to CoinGecko: follow its terms of use and attribution requirements before you rely on or redistribute it. The example is a demo, not financial advice.

This is an alpha release. Review the changelog and license before upgrading.

v0.3.0-alpha.14

Highlights

• New example: examples/single/13-voice-orchestrator. Talk to a rakitsu worker agent by voice. It includes three external bridges: OpenAI Realtime, Gemini Live, and a local turn-based one (faster-whisper, Piper, Silero VAD). The bridges send your spoken request to the worker over A2A.
• A2A SendMessage is now asynchronous. It returns a submitted task right away and runs the agent in the background. Clients can poll GetTask and stop a run with CancelTask. Finishing a task no longer overwrites a cancel that arrived at the same time.
• Example READMEs (jev, providers, eval, advanced strategies) now load API keys inline through a small helper instead of export KEY=value lines, and inline # comments are out of the copy-paste command blocks.

Known limits

• The voice orchestrator is an example, not a product feature. The OpenAI bridge and the local bridge's push-to-talk mode were tested live. The Gemini bridge and the local bridge's automatic voice detection and interruption timing have not been tested with a real microphone yet.

This is an alpha release. Review the changelog and license before upgrading.

v0.3.0-alpha.13

Highlights

• Added Docker image publishing to GHCR and a Homebrew formula.
• MCP responses over the size limit now fail only that tool call instead of terminating the server.
• Fixed inline tool registration in single-agent runs and preserved empty message content for OpenAI-compatible providers.
• Added a confidence-gated escalation example.
• Corrected the BSL production-use summary on the license screen.

This is an alpha release. Review the changelog and license before upgrading.

v0.3.0-alpha.12

• feat: tools can return images, auto vision, optional run timeout (#109)
• fix(agent): vision:false and the auto-vision fallback cover user images
• feat: tools can return images, auto vision, optional run timeout

v0.3.0-alpha.9

• fix(telemetry,secret): redact tool-call output/error, add configurable keywords, guard provider API keys (#100)
• fix(telemetry,secret): redact tool-call output/error, add configurable keywords, guard provider API keys

v0.3.0-alpha.11

• fix(server,config,web): redact serve's live streams and chat history, serialize config loads, strip saved base_url credentials (#105)
• fix(server,config,web): redact serve's live streams and chat history, serialize config loads, strip saved base_url credentials

v0.3.0-alpha.10

• chore(ci): name the review model from the config, not a hard-coded string (#103)
• chore(ci): name the review model from the config, not a hard-coded string

v0.3.0-alpha.8

• feat(ci): add Jev grounding check to the automated PR review pass (#96)
• fix(ci): cap per-finding Jev verification to bound CI job time
• feat(examples/jev): add fact-checked review, severity scoring, enforced pipeline gate (#95)
• fix(config): reject infinite require_tool_call bounds, document browser SSRF risk
• feat(ci): add Jev grounding check to the automated PR review pass
• feat(examples/jev): add fact-checked review, severity scoring, enforced pipeline gate
• docs: record v0.3.0-alpha.7 release (#94)
• docs: record v0.3.0-alpha.7 release