v0.24.1
Highlights
Preserve substantive replies — Fixed a bug where the email/Slack reply dropped the substantive part of the agent's response when the model emitted a short closing remark after tool calls (e.g. "Memory saved…" following the real reply). The reply builder now anchors on the latest substantive text and concatenates everything after it. (#574)
GraphQL repository scoping hardening — Follow-up to the v0.24.0 scope checker: createCommitOnBranch bypassed repo-scope checks because it targets the repo via branch.repositoryNameWithOwner instead of repositoryId/*Id fields. The proxy now extracts every repositoryNameWithOwner value and matches it case-insensitively against the installation's repo full names; empty allowed set is fail-secure. (#570)
Other Changes
- Dropped GCS bucket fallback for Claude Code binary downloads; upstream's bootstrap script now uses
downloads.claude.aias its sole source. (#575) - Bumped all
uv.lockdependencies to latest upstream versions. (#567)
Upgrade
airut update
If airut check reports a pending config schema migration after updating, run airut migrate.