Skip to content

v1.78.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Aug 01:41
· 528 commits to main since this release
v1.78.0
7684ba7

1.78.0 (2026-08-17)

  • refactor(api)!: mount the whole daemon surface under /api (8c16e01)

Bug Fixes

  • agent: stop truncating a project's own AGENTS.md (4c00430)
  • agent: tool-name sets drive safety, so stop writing them as literals (83a86a4)
  • apc: one frontmatter parser — the four disagreed on legal keys (6b47fbe)
  • api: session search accepted only an id or exact path (0499e09)
  • apx-mcp could not load, and memory_list threw on every call (a34fcbd), closes #interfaces #alias
  • http-tools: the tool call proxy never sent a bearer, so 33 of 35 tools 401'd (6e7435d)

Features

  • core: one JSON-file implementation, with the guarantees the copies lacked (d9d87bd)
  • lint: add ESLint and make the layering rule a build error (b20edfe)

BREAKING CHANGES

  • the old root paths are gone — /health is /api/health,
    /projects is /api/projects, and so on. The desktop WebSocket moves to
    /api/desktop/ws; its legacy /overlay/ws alias is dropped, since no client
    that speaks /api ever used it. Run apx restart and rebuild the panel after
    pulling. A daemon started before this commit cannot be stopped by the new
    CLI (it 404s POST /api/admin/shutdown) — kill it by pid once.

Also closes an auth bypass this made visible: isUnauthenticatedPath exempted
any GET whose path carried a file extension, so an artifact route such as
GET /projects/0/artifacts/report.html was served without a token. /api/* is
now checked before that static-asset exemption is ever consulted.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Assets 2
Loading