Skip to content

MIRA v0.350.0

Choose a tag to compare

View all tags
@tarekedOz tarekedOz released this 31 Aug 12:22
· 1 commit to main since this release
v0.350.0
f3ad12a

MIRA v0.350.0 — public beta. Introduces Restricted Mode: a fail-closed, config-driven way to safely expose MIRA to guests, kiosks, or a public "try it" instance — and to shrink the blast radius of prompt injection. It's off by default, so existing installs behave exactly as before; safe to upgrade in place (no config or on-disk migration).

Self-hostable single binary, AGPL-3.0-or-later, signed with the vexillon.ai release key.

Install

# Linux / macOS
curl -fsSL https://get.vexillon.ai/install.sh | sh
# Windows (PowerShell)
irm https://get.vexillon.ai/install.ps1 | iex

New: Restricted Mode

Turn on a restriction profile and MIRA runs fail-closed — every side-effecting capability is denied unless it's on an explicit allow-list. The check sits at each chokepoint (the tool registry, the skill→builtin path, outbound HTTP, and the proactive/companion message senders), so there's no back door around it. The built-in hardened profile permits chat, memory, and the wiki, and denies shell, code execution, filesystem writes, outbound channel messages, care-network escalations, home actuation, and arbitrary web fetch.

Enable it under the new restricted_mode config block:

  • profile — the active profile (e.g. "hardened"). Unset = Restricted Mode off. An unrecognised name is a fatal startup error, never a silent fall-through to unrestricted.
  • caps — server-enforced resource and cost caps, applied while a profile is active: per-user message rate, per-turn token cap, context budget, global concurrency, and a global daily token ceiling. Every field defaults to 0 (unlimited); a tripped cap degrades gracefully with a friendly in-chat reply instead of an error.
  • guest — ephemeral, sandboxed anonymous sessions via the new public endpoint POST /api/auth/guest. Fail-closed: a guest is only ever minted when a profile is also set. Each guest is a throwaway account with its own seeded, isolated memory + wiki, wiped on a TTL, on a periodic global reset, and unconditionally on restart.

Toggling Restricted Mode is read once at startup and held immutably — changing it requires a service restart, and no runtime path can widen it.

Admin visibility

A read-only Restricted Mode panel in admin Settings surfaces the active profile, what's denied, the configured caps, and guest status. (Editing stays in config + restart, by design.)

Docs & testing

  • New how-to guide: Restricted Mode (docs/guides/restricted-mode.md).
  • A Dockerised Playwright end-to-end suite (mock LLM, no external calls) covering the capability gate, caps, guest sessions, isolation, and fail-closed behaviour.

Verify (optional)

Every archive is signed with the vexillon.ai minisign key committed at verification/release-pubkey.minisign:

minisign -Vm mira-0.350.0-<target>.tar.gz -p verification/release-pubkey.minisign
Assets 14
Loading