Skip to content

MIRA v0.344.0

Choose a tag to compare

View all tags
@tarekedOz tarekedOz released this 21 Aug 12:27
· 4 commits to main since this release
v0.344.0
3d176c5

MIRA v0.344.0 — public beta. A security-hardening release: fail-closed messaging webhooks, admin-password recovery + a stronger floor, and tighter Guardian / app-actuation governance. One breaking change for Telegram/WhatsApp webhook users — read the migration note below.

Self-hostable single binary, AGPL-3.0-or-later, signed with the vexillon.ai release key.

Install

# Linux / macOS
curl -fsSL https://get.vexillon.ai/install.sh | sh
# Windows (PowerShell)
irm https://get.vexillon.ai/install.ps1 | iex

⚠️ Breaking: Telegram & WhatsApp inbound webhooks are now fail-closed

An inbound webhook for an account that has no per-account secret configured is now rejected, instead of being accepted unverified. This closes a hole where anyone who learned your (non-secret) account id could POST forged inbound messages.

Migrate — do one of these per account:

  • Recommended: set the account's secret — Telegram secret_token (include it in your setWebhook call), or WhatsApp app_secret — from the Channels page in the web UI.
  • Or explicitly opt into unverified inbound by setting the channel's allow_insecure_webhook = true (channels.telegram.allow_insecure_webhook / channels.whatsapp.allow_insecure_webhook, default false). Do this only if you cannot register a secret and accept the risk.

Telegram polling mode is unaffected — this only concerns webhook delivery.

Admin-password recovery + stronger floor

  • New CLI: mira reset-admin-password [--user <name>]. Locked out? Run it locally — it prompts for a new password, writes it through the auth service, and revokes existing sessions. Trust model: a local operator with filesystem access to the auth database (same as the rest of the CLI).
  • Minimum admin-password length raised 8 → 12, with a nudge toward a passphrase. Applied consistently to both first-run setup and the reset flow.

Tighter Guardian & app governance

  • Member-device anti-spoof is now enforced at a single shared chokepoint (fail-closed), so every actuation path — including direct app-tool calls — verifies that a device is really registered to the member it claims.
  • Guardian chat approvals were widened so a ward's designated guardian (not only the operator) can approve an action, and member-device approvals route to the web UI instead of silently failing.
  • App iframes now carry a runtime-enforced Content-Security-Policy (connect-src 'none' injected into the sandboxed document), so an embedded app can't make network calls even if its markup tries.

Docs

  • Corrected the video_generate tool docs: it's multi-backend (local ComfyUI / WAN2GP), not OpenAI-only.
  • New mira reset-admin-password reference in the CLI docs.

Verify (optional)

Every archive is signed with the vexillon.ai minisign key committed at verification/release-pubkey.minisign:

minisign -Vm mira-0.344.0-<target>.tar.gz -p verification/release-pubkey.minisign
Assets 14
Loading