v0.1.0-alpha.3

AgentOS v0.1.0-alpha.3

A correctness and containment release. Unlike alpha.2, which touched only
supply-chain metadata, this one changes runtime behaviour: agent ids no longer
reach the filesystem unfiltered, trace and vault writes are durable, and the
plugin sandbox now has a committed test suite proving its boundaries hold.

Security

• Agent ids can no longer steer a write outside the data directory. Ids
  flow into persistence, and trace_path built its path by interpolating the
  id straight into data_dir/traces/{id}.json. An id containing ../ walked
  out of the data dir. Both journal_path and trace_path now flatten
  anything outside [A-Za-z0-9_-] to _, which is sound precisely because an
  id is an opaque label — nothing meaningful is lost by collapsing separators
  that were never part of the identity. AgentId carries a doc comment saying
  it is deliberately not a path, and recording the one trap for later: if ids
  ever need real structure, the flattening has to be replaced by
  canonicalise-then-contain, not widened in place, or distinct ids silently
  collapse onto one file. (#111)

• Four expression injections removed from the workflows, and the class is now
  audited automatically. ${{ ... }} is substituted into a run: body as
  text before bash parses it, so values that looked like variables were program
  text. All four now pass through env:. A workflow-audit job re-checks this on
  every change so the fix does not decay. (#97)

• The unauthenticated-bind guard has a regression test. The guard that stops
  the runtime binding a non-loopback address without authentication was
  previously only exercised by hand. (#114)

Correctness

• Trace and vault writes are closed and flushed. Both wrote through handles
  that were dropped without an explicit flush, so a process exiting promptly
  after a write could lose it. Data that exists to be replayed later is
  worthless if it is not on disk. (#120)

• BusClient.connect() works on Node. The TypeScript SDK assumed a global
  EventSource, which browsers provide and Node does not, so the documented
  entry point threw immediately outside a browser. It now resolves an
  implementation explicitly. (#113)

Features

• Google Gemini is supported through its OpenAI-compatible endpoint. No new
  provider abstraction — Gemini is reached through the existing OpenAI client
  path against Google's compatibility surface. (#99)

Testing

• The plugin sandbox boundary suite is committed. Ten tests covering what
  the sandbox is supposed to deny: filesystem access, network access, WASI
  availability, memory growth past the limit, an infinite loop stopped by fuel,
  and a trap contained rather than unwound into the host. Getting the fuel test
  passing exposed a real defect rather than a flaky assertion: invoke()
  formatted wasmtime errors with {e}, which prints only the outer "error while
  executing" line and drops the trap reason underneath. Every plugin failure —
  fuel exhaustion, memory limit, explicit trap — arrived looking identical.
  Formatting with {e:#} keeps anyhow's cause chain, so the reason survives to
  the caller. (#116)

• Supervisor rejection and shutdown paths are covered. (#108)

Build and CI

• The Rust toolchain is pinned, so the gates are reproducible and a new
  compiler's lints cannot turn main red without a deliberate change. This had
  already happened once: a newer Clippy's result_large_err failed unrelated
  pull requests. (#115)
• The check script and coverage pipelines now fail the job instead of
  reporting a problem and exiting green. (#118)
• The dashboard image is built and smoke tested in CI. (#125)
• CI and the dashboard image moved to Node 24 LTS, then the dashboard image to
  node:26-alpine. (#119, #72)

Dependencies

wasmtime 46.0.2 → 47.0.3, serde 1.0.229, clap 4.6.6, futures-util 0.3.34,
tokio-stream 0.1.19, async-trait 0.1.92, http-body-util 0.1.5, jsdom 30, plus
GitHub Action digest updates. All arrived through Dependabot with CI green.

Still not production

Unchanged from alpha.2: the built-in APIs are trusted-network interfaces.
Deployments still need authentication, authorization policy, TLS termination,
secret injection, backups, and network segmentation in front of them.

v0.1.0-alpha.2

AgentOS v0.1.0-alpha.2

A security and supply-chain release. No runtime behaviour changes for existing
users: nothing in crates/ changed except dependency versions. What changed is
what you can now verify about the artifacts you download.

Security

• Every GitHub Action is pinned to a commit SHA. Tags are mutable — whoever
  controls an action repository can repoint v4 at different code, which then
  runs inside CI holding this repository's token. Pinning by digest removes that
  path entirely. Dependabot's github-actions ecosystem keeps the pins current,
  so this is not a frozen dependency tree.
• Explicit least-privilege token scopes. ci.yml and release.yml had no
  permissions: block and inherited the repository default. ci.yml runs on
  pull_request, which includes pull requests from forks. Both now default to
  contents: read, with write scopes granted per job only where needed.
• persist-credentials: false on every checkout. The job token was written
  into .git/config, in the same workspace where cargo build runs dependency
  build scripts — arbitrary code with filesystem access.
• The gitleaks download is verified before it executes. It was piped from
  curl straight into tar, inside the job whose purpose is finding secrets in
  this repository. It is now checksum-verified against a pinned digest first.
• Container images ship provenance and an SBOM. All three images build with
  provenance: mode=max and sbom: true, so image contents and origin can be
  audited.
• Container base images are pinned by digest — rust:1-slim-bookworm,
  debian:bookworm-slim (both stages), node:20-alpine, and
  nginxinc/nginx-unprivileged:alpine. Dependabot's docker ecosystem was
  added to keep those digests current.
• The bus WebSocket parser is fuzzed. WsMessage is deserialized straight
  from socket text before any topic check, so every byte is attacker-controlled
  and a panic there is a remote denial of service. A cargo-fuzz target runs
  weekly and on demand; crash reproducers are kept as artifacts. As of this
  release the handshake is also authenticated (below), so reaching the parser
  requires the token — the fuzzing still matters because the parser runs before
  any authorization decision about what a client may publish or read.
• js-yaml forced to ^4.3.1 (GHSA-5p4m-2wfm-xmqj). Quadratic CPU
  consumption in !!omap resolution; it arrives transitively through eslint, so
  there was no direct dependency to bump. Development-only exposure — eslint is
  not shipped in the dashboard bundle.
• h2 bumped to 0.4.16 (RUSTSEC-2026-0258). Versions below 0.4.16 accept
  an unbounded stream of empty HTTP/2 DATA frames, letting a remote peer drive
  CPU and memory use without ever advancing the stream — a denial of service.
  It reaches AgentOS through hyper, so every HTTP surface the supervisor and
  dashboard expose is on the affected path, not just an internal code path. The
  advisory was published on 2026-08-17, after the rest of this release was
  prepared; cargo audit is clean as of this tag.
• Secrets can no longer be printed by Debug. SecretValue implemented a
  redacted Display but derived Debug, so {:?} rendered the credential in
  cleartext — and because Vault derives Debug, one {vault:?} would have
  dumped every stored secret at once. ApiToken had the identical defect for
  the bearer token. Both now render redacted, with tests that fail if a future
  derive reintroduces it. No call site did this, so nothing leaked; the point
  is that these types exist to make such a leak impossible rather than
  unlikely.
• The WebSocket bus surface now requires the API token. It had no
  authentication at all while AGENTOS_API_TOKEN protected HTTP, gRPC and SSE,
  so an anonymous peer could Publish onto any topic and Subscribe to every
  agent's traffic. The check runs during the handshake, before the upgrade
  completes, and ahead of the Origin check — Origin is a browser hint and
  says nothing about the non-browser client an attacker would use. The runtime
  never started this server, so no shipped binary exposed it; consumers of the
  agentos-bus crate did.
• Binding off-localhost without a token now fails instead of warning. The
  runtime printed a warning and started anyway. A warning scrolls past, is
  invisible under a process supervisor, and leaves every API reachable. Set
  AGENTOS_API_TOKEN, bind to 127.0.0.1, or set
  AGENTOS_ALLOW_UNAUTHENTICATED=1 when auth is terminated in front.
• OpenSSF Scorecard now runs on a schedule and on every push to main,
  with results in the repository's Security tab, so a regression in any of the
  above becomes visible instead of silent.

Verifying this release

Checksums prove a file is intact. Provenance proves where it came from. Both
are published for this tag:

gh attestation verify agentOS-v0.1.0-alpha.2-x86_64-unknown-linux-gnu.tar.gz \
  --repo WAHIB-EL-KHADIRI/AgentOS

Disclosure

SECURITY.md now points at GitHub private vulnerability reporting instead of
asking reporters to contact a username with no channel behind it, and commits to
response windows: 48 hours to acknowledge, 7 days to assess, 90 days to fix,
with an explicit safe-harbour clause for good-faith research.

Dependencies

Around thirty dependency updates landed since v0.1.0-alpha.1, including
tokio, anyhow, sha2, rustyline, prettier, postcss, undici, and
brace-expansion, plus the h2 security bump described above.

Documentation

• The README now leads with the problem and the three commands that carry the
  idea, rather than a feature list.
• Added an ownership and trademark section plus a NOTICE file. The code stays
  MIT OR Apache-2.0; the names AgentOS and agentOS are reserved by the
  author, since neither licence grants trademark rights (Apache-2.0 §6).

Install

Prebuilt binaries for Linux x64, Linux arm64, macOS Intel, macOS Apple Silicon,
and Windows are attached to this release.

export AGENTOS_VERSION=v0.1.0-alpha.2
curl -fsSL https://raw.githubusercontent.com/WAHIB-EL-KHADIRI/agentOS/main/install.sh | bash

Windows PowerShell:

$env:AGENTOS_VERSION = "v0.1.0-alpha.2"
iwr -useb https://raw.githubusercontent.com/WAHIB-EL-KHADIRI/agentOS/main/install.ps1 | iex

From source:

git clone https://github.com/WAHIB-EL-KHADIRI/agentOS
cd agentOS
cargo build --workspace

A cold build of the full workspace takes roughly 24 minutes on a typical
machine. The prebuilt binaries above exist so that is not the first thing you
have to do.

v0.1.0-alpha.1

AgentOS v0.1.0-alpha.1

A follow-up alpha release with no behavior changes for existing users — the
release pipeline now covers Linux arm64 as well.

Changed

• Switched the HTTP client's TLS backend from native-tls to rustls-tls.
  native-tls pulled in openssl-sys on Linux, which needs a real OpenSSL
  install for whatever target you're building — fine natively, but it can't
  cross-compile from an x86_64 CI runner to arm64 without a full arm64
  sysroot. rustls is a pure-Rust TLS stack with no system OpenSSL
  dependency on any platform.
• Restored aarch64-unknown-linux-gnu to the release build matrix
  (dropped in v0.1.0-alpha for exactly the reason above). rustls's crypto
  backend still needs a real C cross-toolchain for a few target-specific
  assembly shims, so the release workflow now installs
  gcc-aarch64-linux-gnu for that one job — the standard way to
  cross-compile Rust to arm64 Linux from an x86_64 runner.
• Allow-listed CDLA-Permissive-2.0 in the license policy for
  webpki-roots (rustls's bundled Mozilla CA root store) — a data license
  for the certificate bundle itself, not code.

Verified

• 283 workspace tests pass with no regressions from the TLS backend switch.
• All five release targets (Linux x64, Linux arm64, macOS Intel, macOS
  Apple Silicon, Windows) build successfully in CI for this tag.

Install

Build from source:

git clone https://github.com/WAHIB-EL-KHADIRI/agentOS
cd agentOS
cargo build --workspace

Install this tagged release with the install script:

export AGENTOS_VERSION=v0.1.0-alpha.1
curl -fsSL https://raw.githubusercontent.com/WAHIB-EL-KHADIRI/agentOS/main/install.sh | bash

Windows PowerShell:

$env:AGENTOS_VERSION = "v0.1.0-alpha.1"
iwr -useb https://raw.githubusercontent.com/WAHIB-EL-KHADIRI/agentOS/main/install.ps1 | iex

v0.1.0-alpha

AgentOS v0.1.0-alpha

This is the first public alpha release of AgentOS. It is meant for local
evaluation, contributor feedback, and validating the runtime direction. It is
not a production-hardened release.

What Works Today

• Rust workspace with focused crates for kernel, bus, memory, trace, vault,
  registry, LLM integration, CLI, SDK, plugins, examples, and benchmarks.
• CLI-first local workflow for running and inspecting agents:
  run -> ps -> logs -> trace -> replay.
• Local demo script and smoke check based on real command behavior.
• Workspace tests and a unified repository check script:
  bash scripts/check.sh.
• React dashboard production build check.
• Security, support, contribution, release, and AI-assisted development docs.
• Cross-platform release workflow for CLI binaries.

Experimental

• Dashboard as a live debugging and inspection surface.
• WASM plugin runtime and plugin templates.
• Docker and Docker Compose packaging.
• LLM provider integrations.
• Python and TypeScript SDK packaging.
• Marketplace commands and plugin distribution ideas.

Known Limitations

• AgentOS is alpha software. APIs and behavior may change before a stable
  release.
• agentOS fork is a placeholder and currently reports that trace forking is
  not implemented yet.
• Restart and recovery behavior should not be described as production-ready
  until stronger tests and public guarantees are in place.
• WASM plugins are experimental and should not be treated as a strong security
  boundary yet.
• Docker artifacts are intentionally not published for this alpha release.
• Install scripts can install this tagged alpha release, but source builds
  remain the most reliable path for contributors during early development.

Install

Build from source:

git clone https://github.com/WAHIB-EL-KHADIRI/agentOS
cd agentOS
cargo build --workspace

Install the tagged alpha release with the install script:

export AGENTOS_VERSION=v0.1.0-alpha
curl -fsSL https://raw.githubusercontent.com/WAHIB-EL-KHADIRI/agentOS/main/install.sh | bash

Windows PowerShell:

$env:AGENTOS_VERSION = "v0.1.0-alpha"
iwr -useb https://raw.githubusercontent.com/WAHIB-EL-KHADIRI/agentOS/main/install.ps1 | iex