llm-box v0.4.0

Changes

• a1f807f Merge remote main (release fix)
• 0e78f00 fix(release): remove failing goreleaser job, use simpler build pipeline
• 5036493 Merge pull request #46 from alib8b8/dependabot/npm_and_yarn/vscode-extension/typescript-eslint/eslint-plugin-8.64.0
• 660ccf6 Merge pull request #45 from alib8b8/dependabot/github_actions/actions/setup-go-7
• 19a076c Merge pull request #44 from alib8b8/dependabot/github_actions/actions/upload-artifact-7
• 79425c2 Merge pull request #43 from alib8b8/dependabot/go_modules/go-minor-patches-4317cb2774
• d2a8083 Merge branch 'main' of https://github.com/alib8b8/llm-box
• 876dc1f Merge pull request #42 from alib8b8/dependabot/github_actions/actions/setup-node-7
• 1b13ead Merge remote main (Dependabot PR #47)
• 1dab707 Merge pull request #41 from alib8b8/dependabot/github_actions/golangci/golangci-lint-action-9
• f546b67 Merge pull request #40 from alib8b8/dependabot/github_actions/dependabot/fetch-metadata-3
• 8ab54ed Merge pull request #39 from alib8b8/dependabot/github_actions/actions/checkout-7
• 875aafb chore: reduce Dependabot PR frequency and limit
• fc03d09 chore(deps-dev): bump @typescript-eslint/eslint-plugin
• a98c130 Merge pull request #47 from alib8b8/dependabot/npm_and_yarn/vscode-extension/typescript-eslint/parser-8.64.0
• dd4177e Merge docs/demo-update into main (keeping main versions)
• cd7df1a Merge develop into main (resolved conflicts: keeping main versions)
• 4249da0 Merge add-code-review into main
• 66a57f9 chore: update G-Star project info
• f652b9f feat: OPPO ecosystem integration - AndesGPT, X-OmniClaw, 小布技能
• d8fc4a8 feat: WAIC 2026 aligned capabilities - 4 new nodes
• f396a7c chore: prepare RED Skill assets for Xiaohongshu
• b67d2e3 feat: phone built-in AI capabilities
• b7e8143 chore(deps-dev): bump @typescript-eslint/parser in /vscode-extension
• b461c79 ci(deps): bump actions/setup-go from 5 to 7
• 7d4dabd ci(deps): bump actions/upload-artifact from 4 to 7
• 60e46f4 chore(deps): bump github.com/mattn/go-isatty
• 159651b ci(deps): bump actions/setup-node from 6 to 7
• 536a26d ci(deps): bump golangci/golangci-lint-action from 6 to 9
• c6688aa ci(deps): bump dependabot/fetch-metadata from 2 to 3
• 5b7e609 ci(deps): bump actions/checkout from 4 to 7
• f06d95f chore: update installation experience and security fixes
• 7d79ef4 feat: borrow 7 capabilities from SpaceX Grok Build open-source
• aabf697 feat: add Ascend NPU model adaptation capability
• ac20932 docs: update README with v0.5 features (ReAct, memory, skill evolution, HarmonyOS, ecosystem)
• 5791010 security: fix 61 vulnerabilities found in security audit
• e94d8e9 feat: join GitCode G-Star, HarmonyOS Agent Skills, and ohpm ecosystem
• 3e9b243 feat: integrate ReAct engine, layered memory, skill evolution, and HarmonyOS multi-device adaptation
• 2673349 feat: add HarmonyOS (鸿蒙) platform support
• 443d64f security: audit and fix vulnerabilities in DID/agent messaging code
• 0aaf5fc feat: integrate awiki.ai DID identity and cross-domain agent collaboration
• 709be1d style: fix gofmt formatting in edge, mobile_nodes, security, protocol
• 84b10ab security: fix vulnerabilities in execute.go and security.go
• 071fded feat: add AI system integration capabilities for mobile/PC OS
• 9860690 docs: sync README with new features
• 4503bb0 ci: update CI Go version to 1.25
• ded0e17 style: gofmt format new node files
• 69d9c27 docs: remove coverage badge from README
• 67c7ded fix: replace Codecov badge with local coverage badge
• 5071156 fix: add path security validation to new nodes + CI badge
• fdf1763 feat: add 6 new nodes + 5 vertical SOP workflows
• 10f815a fix: use codecov-action v3 for GitHub App auth
• 62bc042 fix: add Codecov upload step to CI
• 7a11470 feat: add 100+ workflow templates across 25+ categories
• fa90734 ci: exclude webui from coverage to fix covdata tool error
• 8b6ff8b ci: remove coverage tests to stabilize CI
• 051ce4a ci: add back coverage reporting as informational only
• 445e7d3 ci: remove coverage check and codecov upload
• 418feb9 ci: combine test and coverage into single step
• 2eb6bfd ci: run coverage tests individually to identify failing package
• f5b1e2c ci: add test cache cleanup before coverage generation
• e1bfc34 ci: clean up debug output
• e1724db ci: add debug output for coverage generation
• 7d586fe ci: disable cache to fix tar restore failure
• 889b709 ci: re-run CI to verify fix
• 2894d6e fix: add SSRF protection to MCP client
• 73e2275 ci: fix coverage check, use awk instead of bc for portability
• 4a7d2c9 docs: refactor README to index, enhance contributing guide, add benchmarks
• 9176c7c test: add regression tests for distributed auth security
• 5eb41ef fix: skip network-dependent fuzz test in short mode
• 85f2ab1 fix: format code for CI
• 1f7efa9 docs: expand README sections for unresolved P2 items
• 8f7951b docs: add P2 recommended improvements
• dd70738 docs: add P1 important missing documentation
• 03a5982 docs: add vars field and distributed execution quick start
• 4aeb8e0 docs: add P0 missing documentation
• 6826d0f security: fix critical vulnerabilities found in self-audit
• 52c9e5f docs: complete P2 improvements - webui, visualizer, mcp, plugins, tenants, custom-nodes, create command, version
• af49379 docs: complete P1 improvements - dataflow, scheduling, troubleshooting, node docs
• e81d449 docs: complete P0 improvements - secrets YAML reference, distributed docs, audit logs
• 79c73eb security: comprehensive audit and fix of vulnerabilities
• ac85b74 docs: add P2 recommended improvements
• dc4da9e docs: add P1 important missing documentation
• b8e7c02 docs: add vars field and distributed execution quick start
• bd93295 docs: add P0 missing documentation
• 9007bdd security: fix critical vulnerabilities found in self-audit
• e10857b docs: complete P2 improvements - webui, visualizer, mcp, plugins, tenants, custom-nodes, create command, version
• 0c06741 docs: complete P1 improvements - dataflow, scheduling, troubleshooting, node docs
• acd4951 docs: complete P0 improvements - secrets YAML reference, distributed docs, audit logs
• 16bc473 security: comprehensive audit and fix of vulnerabilities
• a1dae76 docs: update demo to viral scenarios
• d1b2e2b docs: update demo to more viral scenarios (DevOps, AI Research, Crypto)
• 47385fe docs: update homepage slogan
• 927a678 docs: update homepage slogan — split positioning from tagline
• b4b90ee fix: address security audit feedback — execute hardening + README transparency
• d8129b8 fix: address security audit feedback — execute node hardening + README transparency
• 1f85e17 fix: comprehensive audit and fix of 10 bugs across all agent nodes
• 6a2e179 fix: comprehensive audit and fix of 10 bugs across all agent nodes
• afcd716 feat: add 5 more agent nodes (critic, evaluator, reflector, supervisor, human_in_loop)
• ff31a1f feat: Add 5 agentic AI nodes and rebrand as Agentic Workflow Engine
• 4542d9a feat: add 5 agentic AI nodes and rebrand as Agentic Workflow Engine
• a92e8bb feat: add loop-engineering methodology and triage skill
• 6d084bd fix: apply gofmt formatting
• a3a446b Merge security hardening into main
• 978f011 ci: re-run to refresh status
• 0d18c18 ci: add GitHub Actions workflow for build and test
• 7233847 fix: security hardening batch 2
• 34b4589 fix: code review issues L1-L5
• 8d16130 feat: add distributed execution, web UI, autoupgrade and security fixes
• 079500f fix: security audit and race condition fixes
• cee9a87 feat: batch 4&5 - visualizer and multi-tenant isolation
• 17a8524 feat: batch 3 - AI assistant for workflow optimization
• b5f56a0 feat: batch 2 - platform integrations, MCP extension, fuzz testing
• a17da06 chore: remove accidental file
• e6841fa feat: batch 1 completion - test coverage, i18n, webhook, versioning
• 603cdcc ci: add auto-merge workflow for Dependabot PRs
• 2e593fa chore(deps): merge dependabot PR #27
• 27c3c19 Merge pull request #24 from alib8b8/dependabot/npm_and_yarn/vscode-extension/vscode/test-electron-3.0.0
• 22591e2 Merge pull request #23 from alib8b8/dependabot/github_actions/softprops/action-gh-release-3
• 2480490 Merge pull request #25 from alib8b8/dependabot/github_actions/actions/download-artifact-8
• 860adfe chore(deps-dev): bump @vscode/test-electron in /vscode-extension
• ed7bfa0 Merge pull request #26 from alib8b8/dependabot/github_actions/github/codeql-action-4
• bac10cb Merge pull request #28 from alib8b8/dependabot/github_actions/actions/upload-artifact-7
• 4b90987 Merge pull request #29 from alib8b8/dependabot/github_actions/golangci/golangci-lint-action-9
• c8728f5 Merge pull request #30 from alib8b8/dependabot/npm_and_yarn/vscode-extension/typescript-eslint/eslint-plugin-8.63.0
• 9a5f3ab chore(deps-dev): bump @typescript-eslint/eslint-plugin
• cf5c9bd ci(deps): bump golangci/golangci-lint-action from 7 to 9
• 03eea4e ci(deps): bump actions/upload-artifact from 4 to 7
• a9d68d7 ci(deps): bump github/codeql-action from 3 to 4
• 7578395 ci(deps): bump actions/download-artifact from 4 to 8
• c71a94d ci(deps): bump softprops/action-gh-release from 2 to 3
• 7d6c197 feat: major upgrade - logger, history/audit, cache, scheduler, debugger, templates, plugins, secrets, CI enhancements
• d6e2bea fix: gofmt formatting
• 4cfe63b fix: security fixes - input validation, log injection, env var restriction
• a333c64 fix: update CI Go version to 1.25 to match go.mod
• 75f42db Merge pull request #15 from alib8b8/dependabot/npm_and_yarn/vscode-extension/types/node-26.1.1
• 9df4e78 Merge pull request #18 from alib8b8/dependabot/npm_and_yarn/vscode-extension/eslint-10.7.0
• b50b258 chore(deps-dev): bump @types/node in /vscode-extension
• ffea3fb chore(deps-dev): bump eslint from 8.57.1 to 10.7.0 in /vscode-extension
• 2c9efd2 Merge pull request #20 from alib8b8/dependabot/npm_and_yarn/vscode-extension/typescript-7.0.2
• 7473b4f Merge pull request #21 from alib8b8/dependabot/npm_and_yarn/vscode-extension/webpack-cli-7.2.1
• 0482668 Merge pull request #22 from alib8b8/dependabot/npm_and_yarn/vscode-extension/vscode/vsce-3.9.2
• 0fdd71d fix: resolve merge conflicts in package.json and package-lock.json
• 1c6a12d Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/contrib/openclaw/types/node-26.1.1'
• 2cf967b Merge remote-tracking branch 'origin/dependabot/go_modules/go-minor-patches-ee34ca3a29'
• 0d952c9 Merge remote-tracking branch 'origin/dependabot/github_actions/goreleaser/goreleaser-action-7'
• d6d908c Merge remote-tracking branch 'origin/dependabot/github_actions/docker/setup-buildx-action-4'
• b872869 Merge remote-tracking branch 'origin/dependabot/github_actions/docker/login-action-4'
• 02913ac Merge remote-tracking branch 'origin/dependabot/github_actions/docker/build-push-action-7'
• a915118 Merge remote-tracking branch 'origin/dependabot/github_actions/actions/setup-node-6'
• 5e5689c Merge remote-tracking branch 'origin/dependabot/github_actions/actions/setup-go-6'
• 3b55e67 Merge remote-tracking branch 'origin/dependabot/github_actions/actions/checkout-7'
• de021b2 ci: enable dependabot automerge for all ecosystems
• c58a84b fix: gofmt autoupgrade files
• bb96242 feat: add comprehensive auto-upgrade engine for AI autonomous operation
• ced7124 ci(deps): bump actions/checkout from 4 to 7
• 6fa79c2 ci(deps): bump actions/setup-go from 5 to 6
• 0494f16 ci(deps): bump actions/setup-node from 4 to 6
• 243bd54 ci: fix go.mod version before go mod tidy
• 0407d96 ci: simplify to single job without cache
• b507819 ci(deps): bump goreleaser/goreleaser-action from 6 to 7
• 2b26ed7 ci: use Go 1.24 and run go mod tidy before all jobs
• fbff5cf fix: downgrade go.mod to 1.23.5 for CI compatibility
• 9e20355 ci: use go-version-file and improve openclaw-ci reliability
• d10f5c3 sec: harden version package security
• 229690a chore(deps-dev): bump @vscode/vsce in /vscode-extension
• bf4e382 chore(deps-dev): bump webpack-cli in /vscode-extension
• 2c1dc6c chore(deps-dev): bump typescript in /vscode-extension
• ae0febb chore(deps-dev): bump @types/node in /contrib/openclaw
• 03097c8 chore(deps-dev): bump typescript in /contrib/openclaw
• 39fc97c ci(deps): bump docker/build-push-action from 6 to 7
• 1ea9e6e ci(deps): bump docker/setup-buildx-action from 3 to 4
• 0e1001c chore(deps): bump github.com/mattn/go-isatty
• 18cf366 ci(deps): bump docker/login-action from 3 to 4
• f39f402 feat: add auto-maintenance and self-update capabilities
• dc7ee0f fix: make openclaw-ci continue-on-error
• d8c297b fix: make security job continue-on-error to prevent CI red cross
• 3cec21b chore: remove Chinese and Russian README, keep English only
• 3892b7f fix: update README language links to zh/en/ru only; fix gofmt formatting
• 6e66c2f feat: add advanced workflow features and security hardening
• ef47ae4 fix: resolve 38 bugs found in deep code audit
• 400ae12 feat: add TRAE skill (llm-box-workflow) for CLI and IDE
• 42866dc feat: add VSCode extension for llm-box
• af9eb88 security: fix multiple security vulnerabilities
• 1bdb9b1 fix: gofmt formatting issues in security.go and generator.go
• 9b3913e fix: resolve P0-P3 issues across expression engine, nodes, and CLI
• 4c70e17 fix(security): fix all gosec findings and improve code quality
• d582d3e feat: add Gemini CLI extension support
• a03d759 fix(grok-mcp-server): fix CI failures - unused stdin var, formatting, and http timeouts
• 89d37c5 feat: add Grok Build plugin marketplace configuration (.grok-plugin/market.json)
• d2e61ea docs: update grok SKILL.md with Chinese natural language invocation patterns
• 721ed8f fix: update install.sh to work with tar.gz archives and checksums.txt from goreleaser
• 814c864 feat: add Grok ecosystem integration (MCP, Skill, xAI function calling)
• 9640bf4 feat: align Claude plugin with official directory format
• 298a60f fix: align Claude Code plugin with official documentation
• f1e8e8b feat: add Claude Code plugin support
• 7e50ba9 fix: remove references to deleted maintenance scripts
• c816c44 chore: fix Codex Marketplace scan violations
• cfa26eb chore: reduce security scan false positives
• 1a3c29b fix: resolve Codex marketplace security scan false positives
• b92a381 fix: align plugin structure with Codex marketplace spec
• ece1097 feat: add Codex plugin with MCP server mode
• 0536255 security hardening: 4 low-priority improvements
• 944c3da fix: correct json_parse path example to use array index dot notation
• a6ee615 fix: update Go version to 1.25 in Dockerfile and READMEs, move test files to tests/
• eff5e34 fix: resolve Q12 and Coze node issues
• 3696570 chore: upgrade to Go 1.25 (golang.org/x/text v0.38.0 requires Go 1.25)
• b3abdd3 fix: resolve remaining code review issues (Q11/Q12/Q14/Q16/Q17)
• 6c2dfd7 Sync with main
• 6610c79 Sync with main
• 6d3c2a8 Fix code review issues:
• 2f5cb21 fix: address AI code review feedback (24 issues)
• d320a24 feat: add condition, vars support + address PR review feedback
• 2190bfc fix: comprehensive security hardening audit (SSRF, path traversal, RCE, DoS)
• 89ed9bc feat: add 7 new languages and fix code review issues
• b24f1de feat: add i18n support with Chinese and English locales
• 37b534d feat: P2/P3 features - streaming, schema, parallel, chaining, registry, i18n
• 5153036 chore: comprehensive improvements
• 541f5e0 fix: apply gofmt formatting to all files
• 2d4a710 chore: add code review infrastructure

Checksums

d1af71832298ff64bae133d514af3b79e81695a7847fcdf4d3ffe21876431473  install.ps1
9b012e47ac0278f272497ff676afc3d5153fd7802cb77f6b66a3327f0c3cacfb  install.sh
3ccacff3aaed7ab6f6b1c542a389bd5e0d8d4e2bd8791a10f2db5d0912a06b09  llm-box-darwin-amd64
8b4ebddf5a166180e9c9e25afbec06544a842464dc17f4af6b7248331e392777  llm-box-darwin-arm64
0f49122aecea427a8e6313219321701be19909d7b781274632e2a95019a8dd2a  llm-box-linux-amd64
9ff7b6c01ea90dc10c80d1ec39566b7412d82707a8caaffb3d6e68f614fe7aa0  llm-box-linux-arm64
38fb2891028b6066ef2c75b8c53304670473b306527003ca062ca9ee60d99609  llm-box-windows-amd64.exe

What's Changed

• ci(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #8
• chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22 in the go-minor-patches group by @dependabot[bot] in #9
• ci(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #10
• ci(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #11
• ci(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #12
• ci(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #13
• ci(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #14
• ci(deps): bump goreleaser/goreleaser-action from 6 to 7 by @dependabot[bot] in #16
• chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /contrib/openclaw by @dependabot[bot] in #17
• chore(deps-dev): bump @types/node from 22.20.0 to 26.1.1 in /contrib/openclaw by @dependabot[bot] in #19
• chore(deps-dev): bump @vscode/vsce from 2.32.0 to 3.9.2 in /vscode-extension by @dependabot[bot] in #22
• chore(deps-dev): bump webpack-cli from 5.1.4 to 7.2.1 in /vscode-extension by @dependabot[bot] in #21
• chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /vscode-extension by @dependabot[bot] in #20
• chore(deps-dev): bump eslint from 8.57.1 to 10.7.0 in /vscode-extension by @dependabot[bot] in #18
• chore(deps-dev): bump @types/node from 20.19.43 to 26.1.1 in /vscode-extension by @dependabot[bot] in #15
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.21.0 to 8.63.0 in /vscode-extension by @dependabot[bot] in #30
• ci(deps): bump golangci/golangci-lint-action from 7 to 9 by @dependabot[bot] in #29
• ci(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #28
• ci(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #26
• ci(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #25
• ci(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #23
• chore(deps-dev): bump @vscode/test-electron from 2.5.2 to 3.0.0 in /vscode-extension by @dependabot[bot] in #24
• chore(deps-dev): bump @typescript-eslint/parser from 6.21.0 to 8.63.0 in /vscode-extension by @dependabot[bot] in #27
• Merge security hardening into main by @alib8b8 in #31
• fix: apply gofmt formatting by @alib8b8 in #32
• feat: Add 5 agentic AI nodes and rebrand as Agentic Workflow Engine by @alib8b8 in #33
• feat: add 5 more agent nodes (critic, evaluator, reflector, supervisor, human_in_loop) by @alib8b8 in #34
• fix: comprehensive audit and fix of 10 bugs across all agent nodes by @alib8b8 in #35
• fix: address security audit feedback — execute hardening + README transparency by @alib8b8 in #36
• docs: update homepage slogan by @alib8b8 in #37
• docs: update demo to viral scenarios by @alib8b8 in #38
• chore(deps-dev): bump @typescript-eslint/parser from 8.63.0 to 8.64.0 in /vscode-extension by @dependabot[bot] in #47
• ci(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #39
• ci(deps): bump dependabot/fetch-metadata from 2 to 3 by @dependabot[bot] in #40
• ci(deps): bump golangci/golangci-lint-action from 6 to 9 by @dependabot[bot] in #41
• ci(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #42
• chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in the go-minor-patches group by @dependabot[bot] in #43
• ci(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #44
• ci(deps): bump actions/setup-go from 5 to 7 by @dependabot[bot] in #45
• chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 in /vscode-extension by @dependabot[bot] in #46

New Contributors

• @dependabot[bot] made their first contribution in #8

Full Changelog: v0.3.0...v0.4.0