v0.3.0 — the runtime trust plane, versioned packs, and a friction-free lifecycle

agentstack 0.3.0 — the runtime trust plane, versioned packs, and a friction-free lifecycle.

Highlights

The gateway now proxies stdio MCP servers. Zero-files mode is no longer HTTP-only: stdio children spawn lazily in their own process group, get ${REF}s resolved into their env per session, and are tree-killed when the session ends (stdin-EOF → SIGTERM → SIGKILL). Code-mode bindings cover stdio tools too.

MCP firewall — [policy.tools]. Per-server tool rules enforced at the runtime gateway:

[policy.tools]
github = ["get_*", "list_*", "!list_secrets"]

Plain globs allow, ! denies; with allow patterns the list is an allowlist. A denied tool is invisible — filtered from tools_search and code-mode bindings — and refused with the rule named if called anyway. doctor validates the rules; explain <server> shows the effective policy.

Call audit log. Every call the gateway brokers is appended to ~/.agentstack/audit/calls.jsonl — timestamp, run id, server, tool, argument digest (never values), outcome, latency. Read it with agentstack audit --calls [--since <days>] [--json], or in the dashboard: each run's trust footprint on the Runs panel (agentstack run now exports AGENTSTACK_RUN_ID so calls attribute to runs). Logging is best-effort and size-rotated — it can never fail a call.

Versioned packs from any git host. Any repo with a pack.toml is an installable pack, pinned to a version tag:

agentstack add from git:github.com/acme/agent-pack@v1.2.0 --write
agentstack upgrade acme --write   # finds the newest tag, previews the diff, re-pins

[policy] allowed_sources is enforced before anything is fetched; the clone's content passes the same hidden-Unicode scan gate as install; the ledger records source/version/commit and extracted skills stay digest-pinned so install --locked reproduces. agentstack pack init scaffolds a publishable pack. (Semver ranges and transitive dependencies are deliberately out of v1.)

Context-cost lens. agentstack stats --live measures each server's tools/list token footprint through the gateway and caches it; stats, explain, and the dashboard's sortable context column show what every server taxes each session — and stats flags dead weight (high-cost, never-activated servers) with the exact remove command.

The dashboard closes the loop. Doctor runs from the Health tab (the same checks as the CLI, rendered); servers gain Remove from stack…; --read-only is enforced centrally for every mutating endpoint and pinned by a route-matrix test; Discover installs packs from a git URL. The full UI-only lifecycle is documented in docs/dashboard.md.

agentstack lock — pin without materializing. Clean-at-rest repos reference library capabilities by name and keep no generated files on disk; locking those refs used to require an activate-then-deactivate dance. agentstack lock [--profile <name>] resolves every profile's skill + server refs and pins them in agentstack.lock — no configs rendered, no skills materialized. install is profile-aware to match, so library-profile pins survive its reconcile pass.

Trust is visible from inside the session. An untrusted (or edited-since-trusted) project used to degrade the gateway to control-plane-only with only a stderr whisper. Now tools_search says so and names the exact agentstack trust <dir> command, the agentstack_doctor MCP tool reports a Trust (auto mode): line, and CLI doctor warns when a harness has the bridge registered but the project is untrusted.

Small operations feel instant. Read-only MCP skill loads (agentstack_list_loadable / agentstack_load) no longer hash the library at all — on a 373 MB library that's seconds → milliseconds. A persistent stat-fingerprint digest cache (~/.agentstack/digest-cache.json, per-file size+mtime folded into the fingerprint, any mismatch re-hashes) collapses repeat digests for use/lock/doctor; session start resolves the profile once instead of twice; the gateway is built once per process; doctor's full content scan moved behind --deep (--ci always includes it). And lib add warns when a skill exceeds ~10 MiB — vendored node_modules don't belong in a skill.

A first-class home for personal instructions. agentstack init --global seeds ~/.agentstack/agentstack.toml plus an instructions/ dir — the machine-level layer for cross-project operational knowledge. Its [instructions.*] fragments merge in beneath every project (global scope only: personal rules never land in a repo's committed CLAUDE.md, and servers/skills deliberately don't inherit). instructions is un-hidden and wired into apply/setup/doctor; a bundled agentstack house-rules fragment teaches every agent the manifest-first workflow; and the using-agentstack manual is always loadable through the gateway — even in untrusted, control-plane-only sessions.

agentstack self link. The supported from-source install: symlinks the running binary into your PATH (/usr/local/bin or ~/.local/bin, AGENTSTACK_PREFIX honored); self which catches stale shims. Retire your hand-rolled shell functions — they break in non-interactive agent shells.

Drift is a guided decision now. doctor names the exact servers a write would remove and offers both paths — keep them: agentstack adopt · prune them: agentstack apply --write. Cross-manifest prunes are guarded: servers recorded by a different manifest are kept on write, tracked as kept_foreign (still reported by doctor/diff), and pruned only by an explicit apply --prune-foreign.

Also

• Lifecycle hygiene: the managed .gitignore block is directory-level and survives deactivation (no more churn or stripped committed blocks); an emptied managed skills dir is removed with rmdir semantics (user content always survives); session end restores the filesystem exactly.
• lib add says "copied", notes the library copy is canonical, and warns when the source is a temp dir (dangling provenance).
• Missing instruction fragment sources now block apply --write and instructions --write instead of silently deleting previously compiled content.
• audit --calls column alignment fix (pad before coloring).
• Runnable, fully sandboxed closed-loop demo: agentstack-test/demo-closed-loop.sh.
• Docs site refreshed with the new capabilities. 423 tests.

Install

curl -fsSL https://raw.githubusercontent.com/Tarekkharsa/agentstack/main/install.sh | sh
# or: cargo install agentstack
# or, from a checkout: cargo build --release && target/release/agentstack self link