v1.15.0

[1.15.0] - 2026-10-06

Tracks the REST surface changes in Symbiont runtime v1.21.0, and is the first
release published through an automated workflow.

All nine packages now share one version. They had drifted apart (some at
1.13.0, some at 1.14.3) and npm still carried 1.11.0, because the repository
had no release workflow and every version after 1.11.0 was built but never
published. .github/workflows/release.yml closes that gap: a v*.*.* tag now
verifies, publishes each package to npm and opens a GitHub Release.

Added

• Release workflow. Tagging vX.Y.Z runs the test matrix, checks the tag
  against the root package version, publishes every workspace package to npm
  (skipping any version already there, so a re-run is safe) and creates a
  GitHub Release from this changelog.
• WebhookRunAudit and new optional fields on WebhookCompletedResponse
  (termination_reason, iterations, audit, invocation_id, replayed,
  total_usage, budget), matching the runtime v1.21.0 HTTP Input response.
  The Zod schema accepts them as optional, so responses from earlier runtimes
  still validate.
• executeAgent(..., { idempotencyKey }) sends the Idempotency-Key
  header that runtime v1.21.0 treats as the durable invocation identity.
  Reusing a UUID with the same request returns a saved completion or an
  explicit in_progress / unresolved / reconciled / conflict state
  instead of running the agent twice. A key is generated when omitted, which
  makes that call non-retryable; pass your own to retry safely. A reconciled
  invocation answers HTTP 409 with the operator's signed resolution.

Changed

• WebhookInvocationStatus.EXECUTION_STARTED and
  WebhookExecutionStartedResponse are documented as pre-v1.21.0 only. The
  runtime retired that handoff on the HTTP Input route, but both are retained
  so this SDK still parses responses from earlier runtimes.
• All packages unified at 1.15.0; SKILL.md synced.

Known issues

• symbi-core and symbi-agent depend on each other, so the packages have no
  total publish order. This does not block an npm release, but it should be
  broken before the dependency ranges are tightened from ^1.0.0.

v1.13.0

Tracks Symbiont runtime v1.13.0.

Added

• .symbi agent file extension in the symbi agent create CLI: .symbi is the canonical extension as of Symbiont runtime v1.12.0; the CLI now accepts .symbi alongside .json and the legacy .dsl. Existing .dsl workflows continue to work indefinitely.

Changed

• Version bump to track Symbiont runtime v1.13.0. The HTTP surface is unchanged since v1.11.x — no other client code changes required to consume new runtime features:
  • symbi fmt subcommand for canonical .symbi formatting
  • tree-sitter grammar v2 covering the full DSL surface
  • LLM API keys via SecretStore (OPENROUTER_API_KEY_REF, OPENAI_API_KEY_REF, ANTHROPIC_API_KEY_REF)
  • SecurityTier::Hosted variant for E2B
  • ToolClad agent_summary typestate fence
  • symbi-invis-strip 0.2.0 with expanded INJECTION_MARKERS
  • slack signature timestamp overflow fix

Editor stack went standalone in this cycle

• tree-sitter-symbiont v0.1.0 on npm and crates.io
• vscode-symbiont v0.1.0 with a TextMate grammar (.vsix attached to its release)

v1.11.0 — track Symbiont runtime v1.11.0

[1.11.0] - 2026-04-24

Tracks Symbiont runtime v1.11.0.

Changed

• Version bump to track the Symbiont runtime v1.11.0 release, which
  introduces the symbi shell (Beta) interactive TUI, symbi repl shim
  subcommand, symbi init Docker ergonomics (--dir, docker-compose
  generator, auto-generated SYMBIONT_MASTER_KEY), cross-instance agent
  messaging, symbi-approval-relay crate, and the symbi schemapin /
  symbi policy CLI subcommands. The SDK's HTTP surface is
  backward-compatible with v1.10.x; no client code changes required.
• Node.js ≥ 20 required: Dropped Node 18 from the CI matrix and
  tightened engines.node to >=20. Node 18 reached end-of-life and
  was blocking CI progress.

Fixed

• InMemoryStore: stopped asserting deep-equality on timestamps in a
  flaky test.
• TypeScript errors and ESLint no-redeclare findings cleaned up;
  added a reusable CI workflow for type-check + lint on PRs.

Docs

• New per-package READMEs for every symbi-* workspace package.
• Top-level README rewritten to align with the Symbiont main repo and
  symbiont.dev voice.

Internal

• Renamed rollup.config.js → rollup.config.mjs for Node 18+
  ESM-config compatibility.

v1.10.1 — rename @symbi/* packages to symbi-* for npm publishing

Packaging-only release that renames the workspace packages so they can actually be installed from npm.

Why

The @symbi/* scoped names advertised in the README and used across all import examples were never published to npm — external users following the install docs hit 404s. The @symbi scope is also not owned by the publishing account, so those names can't be claimed.

What changed

The 9 workspace packages are now published under unscoped names:

Before (never published)	After (on npm)
@symbi/core	symbi-core
@symbi/types	symbi-types
@symbi/agent	symbi-agent
@symbi/cli	symbi-cli
@symbi/mcp	symbi-mcp
@symbi/policy	symbi-policy
@symbi/secrets	symbi-secrets
@symbi/testing	symbi-testing
@symbi/tool-review	symbi-tool-review

Rename applied mechanically across 105 files: each package's name + intra-workspace dependencies keys, all TypeScript source imports, tsconfig.json / vitest.config.ts path aliases, README, SKILL.md, context7.json, ARCHITECTURE.md, IMPLEMENTATION_GUIDE.md, and apps/docs/guides/*.md.

The root monorepo package symbiont-sdk-js is also republished at 1.10.1 to stay in version lock-step.

Install

npm install symbi-core

Notes

No public type or runtime behaviour changes from 1.10.0 — this is a packaging-only release. All 1082 tests across 35 test files continue to pass after the rename.

v1.10.0 — align with Symbiont runtime v1.10.0

Aligns the JavaScript/TypeScript SDK with Symbiont runtime v1.10.0.

What's new

HTTP Input LLM invocation types (Symbiont v1.10.0)

Zod-schemaed types for the Symbiont v1.10.0 HTTP Input handler:

• WebhookInvocationResponse — discriminated union on status covering both response shapes:
  • WebhookExecutionStartedResponse — returned when the target agent is in the Running state and the request is dispatched on the runtime communication bus.
  • WebhookCompletedResponse — returned when the agent is not running and the request is served by the on-demand LLM invocation path, which runs an ORGA tool-calling loop against ToolClad manifests. Includes response, tool_runs, model, provider, latency_ms.
• WebhookToolRun — per-tool ORGA execution preview. output_preview is truncated on a UTF-8 character boundary to at most 500 bytes by the runtime.
• WebhookInvocationRequest — caller payload with prompt / message / optional system_prompt (capped at 4096 bytes by the runtime) plus pass-through of additional fields.
• WebhookInvocationStatus — const object + type with EXECUTION_STARTED and COMPLETED.

Alignment

• All @symbi/* packages bumped from 1.8.1 to 1.10.0.

Notes on Symbiont v1.9.0 / v1.9.1 runtime changes

Symbiont v1.9.0 and v1.9.1 introduced ToolClad v0.4.0 runtime features (session and browser execution modes, HTTP and MCP proxy backends, output parsers, custom types, secrets injection, W3C traceparent propagation, bounded channels, rate limiting, optional LanceDB feature flag). These changes are runtime-side and do not break the existing SDK type surface; ToolManifestInfo.backend simply accepts additional string values ("http", "mcp", "session", "browser").

Install

npm install symbiont-sdk-js@1.10.0

Published to npm: https://www.npmjs.com/package/symbiont-sdk-js/v/1.10.0

Tests

• npx vitest run — 1082/1082 tests pass across 35 test files.

v1.8.1 — ToolClad, CommunicationPolicyGate, Agent Lifecycle

What's New

ToolCladClient (@symbi/core)

• client.toolclad.listTools() — discover manifests
• client.toolclad.validateManifest(path) — validate .clad.toml
• client.toolclad.testTool(name, args) — dry-run with validation
• client.toolclad.getSchema(name) — MCP schema generation
• client.toolclad.executeTool(name, args) — execute with evidence envelope
• client.toolclad.reloadTools() — hot-reload manifests

CommunicationClient (@symbi/core)

• client.communication.listRules() — list inter-agent policy rules
• client.communication.addRule(rule) — add governance rule
• client.communication.removeRule(ruleId) — remove rule
• client.communication.evaluate(sender, recipient, action) — policy evaluation

Agent Lifecycle (@symbi/agent)

• client.agents.reExecuteAgent(agentId, input) — reset and re-run

ORGA-Adaptive (@symbi/core)

• client.reasoning.getToolProfiles(agentId) — tool execution stats
• client.reasoning.getLoopDiagnostics(agentId, loopId) — stuck-loop detection

New Types (@symbi/types)

• communication.ts — Zod schemas for CommunicationRule, CommunicationEvaluation
• toolclad.ts — Zod schemas for ToolManifestInfo, ToolValidationResult, ToolTestResult, ToolExecutionResult

All packages bumped to v1.8.1.

Install: npm install @symbi/core@1.8.1

Release 1.6.1

[1.6.1] - 2026-02-28

Added

Reasoning Loop

• ReasoningClient — Full ORGA (Observe–Reason–Ground–Act) cycle client with 15 methods and 45 tests
• Reasoning Loop types with Zod schemas for all ORGA cycle types
• Cedar policy evaluation, journal system, circuit breaker, knowledge bridge types

Changed

• Version alignment with Symbiont runtime v1.6.1

symbiont-sdk-js v0.6.0

What's New in v0.6.0

Aligned with Symbiont Runtime v1.4.0.

Markdown Memory Persistence

• MarkdownMemoryStore for facts, procedures, and learned patterns
• Atomic writes, daily logs, retention-based compaction

Webhook Verification

• HmacVerifier with HMAC-SHA256 and constant-time comparison
• JwtVerifier with HS256 JWT token verification
• WebhookProvider presets for GitHub, Stripe, Slack, Custom

Agent Skills

• SkillScanner with 10 ClawHavoc security rules
• SkillLoader with YAML frontmatter parsing

Metrics Collection & Export

• MetricsApiClient for metrics endpoints
• FileMetricsExporter with atomic JSON writes
• CompositeExporter for multi-backend fan-out

Type Definitions

• Full TypeScript types for webhooks, memory, skills, and metrics in @symbiont/types

Install

npm install symbiont-sdk-js@0.6.0

npm: https://www.npmjs.com/package/symbiont-sdk-js

v0.3.1

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.3.1] - 2025-08-16

Added

Comprehensive Test Suite

• 940 test cases across 28 test files with 100% pass rate
• Complete test coverage for all core system components
• Authentication system tests (JWT, RBAC, security utilities)
• Configuration management tests (environment, auth, client config)
• Memory management tests (hierarchical memory, in-memory store)
• Security enhancement tests (crypto utils, input validation, secure logging)
• Vector operations tests (Qdrant integration, embeddings, search)
• HTTP endpoint management tests (metrics, middleware, lifecycle)

New Core Components

• Authentication System

  • AuthManager.ts - Centralized authentication management
  • JWTHandler.ts - JWT token generation and validation
  • RBACManager.ts - Role-based access control
  • SecurityUtils.ts - Timing-safe security operations
  • TokenValidator.ts - Token validation utilities

• Configuration Management

  • AuthConfig.ts - Authentication configuration schemas
  • ClientConfig.ts - Client configuration management
  • DatabaseConfig.ts - Database connection configuration
  • EnvManager.ts - Environment variable management
  • LoggingConfig.ts - Logging configuration
  • VectorConfig.ts - Vector database configuration

• Memory Management

  • HierarchicalMemory.ts - Multi-level memory storage
  • InMemoryStore.ts - High-performance in-memory caching
  • MemoryManager.ts - Memory lifecycle management
  • MemoryStore.ts - Abstract memory store interface

• Security Enhancements

  • CryptoUtils.ts - Cryptographic utilities
  • InputValidator.ts - Input validation and sanitization
  • SecureLogger.ts - Security-aware logging
  • SecurityConfig.ts - Security configuration
  • SecurityManager.ts - Centralized security management

• Vector Operations

  • CollectionManager.ts - Qdrant collection lifecycle
  • EmbeddingManager.ts - Embedding generation and management
  • QdrantManager.ts - Qdrant client management
  • SearchEngine.ts - Vector search operations
  • VectorOperations.ts - CRUD operations for vectors

• HTTP Endpoint Management

  • EndpointMetrics.ts - Performance metrics collection
  • HttpEndpointManager.ts - HTTP endpoint lifecycle management

Type Definitions

• http.ts - HTTP endpoint and metrics type definitions
• memory.ts - Memory management type definitions
• vector.ts - Vector operations type definitions

Fixed

Critical Security Issues

• InputValidator: Fixed email validation to reject domains without dots and corrected SQL injection sanitization output format
• SecurityManager: Resolved nested sensitive data redaction in audit logs and fixed XSS validation regex state pollution through proper lastIndex reset
• SecureLogger: Fixed debug logging configuration, URL sanitization with double-encoding issues, hash regex pattern matching, empty user ID handling, and circular reference handling
• CollectionManager: Implemented error message nesting prevention with root error message extraction

Test Infrastructure Issues

• Resolved all 67 initial test failures across 12 test files
• Fixed mock configuration issues for Express and QdrantClient
• Resolved memory system circular reference issues
• Fixed configuration schema validation for OAuth, URL, and JWT schemas
• Corrected EnvManager number parsing for tokenRefreshThreshold
• Fixed HTTP EndpointMetrics RPM calculation issues
• Resolved HTTP EndpointManager authentication middleware integration

Changed

Test Coverage Improvements

• Achieved 67.8% statement coverage with comprehensive logic testing
• Achieved 86.98% branch coverage with excellent conditional path testing
• Achieved 81.15% function coverage with strong method-level testing
• Test execution time optimized to 6.69 seconds for entire suite

Development Infrastructure

• Enhanced test configuration with test-config.js
• Added debugging utilities with debug-security.js
• Updated project documentation with update-plan.md

Performance

• Test Execution: 940 tests complete in 6.69 seconds
• Memory Management: Optimized hierarchical memory with TTL and size-based eviction
• Security Operations: Timing-safe operations implemented across authentication components
• Vector Operations: Batch processing optimized for large-scale embedding operations

Security

• Input Validation: Enhanced SQL injection and XSS protection
• Authentication: Secure JWT token lifecycle with proper refresh mechanisms
• Audit Logging: Comprehensive security event logging with sensitive data sanitization
• Cryptographic Operations: Secure key generation and management utilities
• Access Control: Role-based permission system with proper authorization checks

---