Stravia v0.5.2

Added

• Public generate and StraviaRead calls now return a durable stravia://tool-executions/<id> reference after their bounded synchronous wait (60 seconds by default), while fast calls retain their original results and errors. Query through StraviaRead with optional URI wait seconds; completed results survive restart, unfinished work is interrupted without replay, and query cancellation never cancels the original execution. MCP, explicit calls, and transparent injection share Core behavior; internal Agent reads remain synchronous. Source-request cleanup cancels and invalidates non-MCP executions without deleting independent Artifacts; MCP retains existing history policy. SQLite/PostgreSQL migration 0023 adds the durable associations and publication fences. Stop and back up the complete data directory and external database before upgrading; rollback requires restoring that backup. See Media Generation.
• Added a deterministic credential-detection HTTP benchmark with cold/warm phases, 50k/100k/150k-token inputs, concurrency 1/4, process CPU/RSS measurements and full match-position consistency checks. Experimental cache budgets require explicit confirmation from an instrumented binary; ordinary product binaries cannot silently produce mislabeled budget results.
• Added a reproducible devenv development environment with Rust/Bun, Clang/mold and perf on Linux, managed PostgreSQL, persistent per-workspace server ports initialized on shell entry, optional direnv activation, and serialized copy-on-write worktree initialization.
• Added Antigravity native image generation and reference-image editing through image Routes and the existing generate tool. Model discovery registers the account's advertised imageGenerationModelIds as real image-output models without inferring generation support from image input; image-only models do not gain chat capability. Generation reuses the selected Provider's OAuth/project and exact Target model, with bounded single-image SSE results and existing Artifact delivery. Rebuild and re-import the standalone antigravity plugin, synchronize models, then bind an image Route; account eligibility and quota remain upstream-controlled.
• Debug performance exports now include timestamped host CPU/RSS and managed-resource histories for active inference, observation queues, local and last-observed Redis cache usage, Wire buffers, and SQL pools, with explicit buffer capacities, drops, epochs, freshness, and measurement limits. Full bounded memory batches move to a bounded background writer, append to anonymous temporary files, and release their allocations instead of retaining a rolling history. Exports merge disk and pending memory data; storage failures and real losses remain visible. Turning Debug off clears the performance session and temporary files, so export first; restarts never restore old sessions. Process-lifetime metrics and raw Wire trace retention are unchanged.
• SQL diagnostics are collected centrally through shared pool, connection, and transaction handles without wrapping individual queries. Timelines include template fingerprints, driver outcomes, safe error codes, row counts, and successful, failed, or cancelled acquisition timings; SQL text, bind values, and formatted database errors remain excluded.
• Split key admission, write-gate, upstream-header, and observation-queue waits from processing, and link background commands to their originating Debug epoch without retaining request spans. Documented explicit Windows CPU/heap profiling workflows; performance timelines are still not CPU or heap profiles.

Changed

• Media generation removes the redundant saved-route reference row and its separate unlink button. To unlink, choose No route selected and save; this still clears the binding and disables media generation.
• Media generation moves saved-configuration validation from a persistent warning card to the enable switch's tooltip, including when the switch is unavailable. Hover, keyboard focus, touch, and Escape are supported; load and save failures remain inline.
• Console Chat only offers text-output Routes, including automatic selection, restored conversations, retries, and setup guidance; image input remains supported by eligible text models. Removed the edit form's persistent resend explanation without changing how edits replace later turns.
• task dev:server now starts Vite with wildcard listening (equivalent to --host) and admits its exact printed Local/Network origins without bypassing management-entry or CSRF checks. Both Server and Desktop development tasks build and install all current workspace Vendor plugins at startup, including same-version rebuilds, while leaving identical components untouched. Updates requiring data discard still need manual import and confirmation; production plugin distribution is unchanged. Development HTTP exposes source and management access to the network, so use trusted networks only.
• Credential detection removes three reviewed, policy-equivalent bundled identities before compilation: Bittrex secret key uses bittrex-access-key, JFrog uses kingfisher.artifactory.2, and the duplicate Plaid rule uses kingfisher.plaid.2. Component references migrate without collapsing distinct prerequisites; confidence, visibility, filtering and checksum differences remain distinct. Upstream snapshots and historical rule IDs are preserved, with no database migration. Cache-budget measurements retain the existing regex default rather than trading substantial CPU for a small RSS reduction.
• Credential protection and streamed restoration now borrow unchanged text and JSON tokens, preserving shared canonical text until a real replacement is needed. Ordinary observation redaction also reuses unchanged text across stages and avoids per-word lowercase and output allocations. Detection, expiry, reference-atom boundaries, escaping and fail-closed behavior are unchanged.
• HTTP Wire capture shares transport bytes until synchronous queue encoding; visible-content observation borrows shared terminal text. Public-protocol SSE, Devin Connect, Kilo and client WebSocket framing reuse buffers or borrow complete frames, and media/Responses encoding moves owned payloads instead of copying them. Capture limits, Authorization masking, byte fidelity and delivery ordering are unchanged. Rebuild Vendor components to receive guest-side improvements.
• History envelopes and RAW storage payloads reuse owned or borrowed representations, SQL parameters take ownership, and last-use restoration moves JSON subtrees. Debug Trace storage borrows already encoded payloads rather than materializing and serializing whole bodies again, with bounded deduplication and output capacity based on known encoded lengths. Canonical/persisted fingerprints, storage formats, zstd level 1 and retention remain unchanged; no database migration is required.
• The real HTTP protocol benchmark now uses seeded, tokenizer-counted 50k–150k text-token inputs, 0–10 PNG images, 1–10s first-token delays and 30–100 token/s generation lasting 10–60s. Every request includes two new synthetic credential probes, repeated values and streamed reference restoration; protected model tokens and restored client tokens are counted separately. Real multi-turn routing, all four Wire-body digests, ordinary redaction, credential discoveries and published mappings, usage, delivery and decoded SQLite/PostgreSQL history ancestry are verified per request; missing evidence fails the run. Schema 4 requires Debug capture and reversible credential protection and is intentionally incomparable with earlier workloads. Wire retains its existing Authorization-header-only redaction contract. Debug inference roots now export their internal request identity for exact concurrent Run attribution, without adding metric labels or changing protocol, fingerprint or database contracts.
• Shared history and Observation storage now uses zstd level 1 instead of level 3, retaining checksums, raw fallback and the existing binary format. Existing level-3 payloads remain readable without rewriting stored data; canonical fingerprints and persisted content keys are unchanged.
• Generation Chain discovery, replay and prefix rebuilding now hash borrowed canonical history units instead of copying their text into owned JSON values. Final client-history commits reuse the fingerprint's semantic-unit count after output rewrites and compaction replacement. Canonical ordering, length prefixes, hash domains and persisted fingerprint versions are unchanged.
• The real HTTP protocol benchmark now records encoded history/observation payload bytes and SQLite database/WAL/shared-memory file lengths outside measured traffic. Counts and encoded payload sums share one read snapshot; file lengths are separate file-level observations, not allocated disk space or cumulative write volume.
• SQLite route scheduling now uses filtered aggregates in a single 24-hour scan, avoiding hourly accumulator updates for older attempts without adding a statistics cache. Inclusive window boundaries, unknown usage, confirmed successful-attempt metrics and stale-on-error behavior are preserved; SQL operation counts and PostgreSQL behavior are unchanged.
• Single-instance SQLite Gateways now preload Provider, Provider Model, eligibility and outbound-proxy configuration into one internal deep module, reducing repeated execution-path SQL reads without adding a database or changing persistent data. Configuration writes and plugin resets invalidate the projection centrally; version checks, authorization and OAuth refresh CAS remain intact. Interrupted writes with an uncertain commit outcome warn and use authoritative SQL reads until restart. PostgreSQL behavior and cross-instance support are unchanged.
• Migrated the WebUI to SvelteKit 3.1 and adapter-static 4, including native #lib subpath imports, Vite-based framework configuration, and updated navigation APIs. Refreshed Svelte, Vite, i18n, charts/tables, Markdown rendering, and browser tooling dependencies.
• Latency-chart tooltips now use LayerChart's touch/pen-aware placement and viewport containment instead of a fixed horizontal-position workaround. Enabled Paraglide's static-message-access lint rule to prevent dynamic catalog indexing from retaining every translation in the client bundle.
• Updated the backend Rust toolchain to 1.99.1, Wasmtime/WASI to 49.0.3, and RMCP to 3.5.1. Refreshed compatible Rust dependencies and upgraded the HTTP middleware, YAML, process metrics, JSON Schema, ZIP/Zstandard, CFB, and guest-binding release lines without changing persisted codec versions or the Vendor WIT contract.
• Upgraded the desktop Rust runtime and JavaScript API to Tauri 2.12.4, synchronized native/JS plugins, and updated the WDIO Tauri driver to 1.5.0; the CLI remains on the latest stable 2.12.3. The Windows WebView2 dependencies now share 0.39.1, removing the obsolete feature workaround while retaining the driver-discovery patch. Application data locations, permissions, and window-effects configuration are unchanged.
• Codex image eligibility now follows explicit source capabilities rather than model names or version rules. Codex accepts declared image output or hosted image_generation tool support; missing evidence remains unknown, so previously name-qualified image candidates may disappear after synchronization. Rebuild and re-import the standalone openai-codex plugin, then synchronize source-managed model specifications; administrator-edited specifications remain under administrator control.
• SQLite and PostgreSQL incremental migration 0022 automatically assigns text output to existing Routes with no configured output, including installations that already applied 0021; explicitly saved text/image choices remain unchanged. Route IDs, Targets, scheduling parameters, enabled preferences, and image-generation references are retained without rewriting earlier migrations. Provider Model output declarations and execution eligibility are still enforced; retained image-generation references to migrated text Routes require an eligible image Route. Stop the instance and back up the complete data directory and any external database before upgrading; rollback requires restoring that backup.
• The model editor now places Output type beside the display name and request strategy, using a single-select Text / Image menu with the same modality icons as model specifications. The closed control retains both its icon and text; the menu keeps its highlight without an additional checkmark. Multi-select indicators are unchanged.
• Media generation no longer repeats route-eligibility explanations or an empty-route panel below its selector. Configuration warnings, route selection, recovery actions in the warning, and supported-media details remain available.
• Output mismatches now use the destination card's existing status position instead of a duplicate badge or a misleading healthy status. The model editor lists blocking destinations only after Save, with an inline error and toast identifying the service and model; validation and failed drafts are preserved.
• Routes now have one text or image output purpose, validated against raw Provider Model output declarations rather than text display fallback or image input support. Missing and explicitly empty declarations do not qualify; dual-output models can serve either purpose. Only OneClick infers a new Route's purpose (text first, otherwise image); explicit binding requires an existing Route. Declaration drift retains Targets but excludes mismatches from execution while eligible Targets continue; other media adapter incompatibilities still reject. Image generation requires an image Route, and its reference blocks conversion to text even while disabled; explicitly unbind it, optionally disabling the feature in the same save. See Media Generation.
• Automatic and manual model discovery now share one fixed 60-second budget per provider configuration, covering credential preparation, all discovery pages and publication-fence acquisition. Different providers remain concurrent; joining an active check does not restart its budget. Slower discoveries now fail earlier while retaining the last confirmed inventory; optional catalog enrichment and inventory reconciliation remain outside this budget.
• Periodic model checks and allowance sampling now share one monotonic startup origin: models are checked immediately and every 60 minutes, while allowance sampling starts after 35 minutes and repeats every 30 minutes. Restarting resets the schedule. Only planned periodic starts are staggered; work may overlap, and manual actions, save-time sync and allowance-reset recovery remain immediate. The allowance read timeout stays at 30 seconds.

Fixed

• Updated the Chat and Codex connection-reuse acceptance fixtures to declare text output and hosted image capability explicitly, matching the current Route and Provider Model contracts without weakening eligibility checks.
• CI formatting checks now exclude Inlang's generated .lix directory and accept the development launcher formatting. Model-history browser acceptance follows the populated-list toolbar while still verifying retained deleted-service history, and lets Playwright own browser-context cleanup. The real development setup acceptance has a dedicated cold-compilation budget for all workspace Vendor components; production timeouts and management-entry/CSRF checks are unchanged.
• Gemini streaming credential restoration no longer treats response-level metadata between text fragments as a new content item. Reversible references split across chunks are restored in both delivered text and committed client history; metadata and real item boundaries remain intact.
• Anthropic streaming usage now merges explicitly reported message_start and message_delta fields before publishing cumulative snapshots, so a final output count replaces the initial known zero without losing input or cache usage. Explicit zero revisions remain valid; missing fields do not erase known values. Rebuild Vendor components to update upstream parsing. Existing stored observations are not rewritten.
• Observation admission now reserves separate capacity for admission, delivery receipt, execution Finish and final cleanup before preparing request evidence. Rejected admissions no longer emit orphan Run commands, and SQL admission failures discard uncommitted grouping/input evidence. Confirmed Client Output Commit facts survive ordinary queue overflow in the reserved Finish, without deriving them from HTTP success. Missing Model Turn starts produce an explicit observation gap instead of rolling back an event batch on an orphan Target attempt; real attempt-finish usage is retained. Request delivery, committed history, and incomplete observation remain distinct, with no schema or retention change.
• Browser acceptance tests now isolate Chromium from inherited environment proxies without relaxing certificate trust, and settings/credential-discovery fixtures follow their API response contracts.
• Desktop acceptance tests now use native evaluation across document reloads and keyboard Select interactions. Installation checks retain the update-state transition assertion instead of a stale copy-visibility assertion that contradicted the existing installation overlay.
• Allowance lifecycle tests now invalidate and repair credentials through the storage interface rather than external SQL writes, keeping the runtime configuration projection coherent while retaining stale-cache, guard and in-flight evidence checks. Production credential rules are unchanged.
• Background search query tests now wait for the actual query-wait registration before advancing virtual time, avoiding races with SQL authorization and execution reads. The synchronization observer is compiled only for tests; production deadlines and authorization are unchanged.
• Removed a flaky stream-metadata assertion that could mistake a randomly generated chunk ID for leaked obfuscation; the regression now checks JSON fields with a fixed adversarial ID. The real RPM management browser test now declares its Route output purpose and waits for successful queue-setting saves before reading or reloading persisted values. Production behavior is unchanged.
• Saving No route selected now clears the image-generation binding and disables media generation even when it was enabled. Model binding queries are refreshed, and an already-opened model editor uses the latest binding state without discarding its draft, avoiding stale “still referenced” errors after unlinking.
• Standalone WebUI and Desktop development frontends bind explicitly to 127.0.0.1, preventing Windows from assigning the same numeric localhost port to separate IPv6 and IPv4 listeners. Vite continues to increment occupied ports. Restart existing development frontends and use the printed URL to apply the new binding.
• Historical Route destinations whose model aliases resolve through the saved service inventory can now be explicitly reconfigured for a supported output without replacing their original aliases or scheduling settings.
• Interaction Observation now links a request resumed after client-side compaction to the turn it actually continues, instead of an earlier turn whose retained answer happened to be longer. Among matching delivered sources, the one ending latest in the replayed history wins; reasoning replayed with unchanged encrypted content or signature no longer cuts off the final turn, while changed or missing opaque state still blocks the match. Only newly admitted requests are affected; existing Observations are not regrouped. See Interaction Observation.
• SQLite Turn Chain content cleanup now selects orphan candidates outside the write lock and deletes them in bounded transactions, reducing contention that can fail History Marker writes with database is locked. Deletion atomically rechecks references; live history, expiry rules, lock timeouts, and PostgreSQL behavior are unchanged. No database migration is required.
• CI now reuses successful complete checks for the exact same commit across dev, main, and Release, or waits for an existing automatic CI run instead of starting another full test matrix. PR merge checks and explicit manual/cache-warm runs remain independent; failed, cancelled, partial, or unavailable evidence cannot authorize a release.

---

Full Changelog: v0.5.1...v0.5.2