Skip to content

BYOK SDK 0.28.2 · keys 0.28.2

Choose a tag to compare

View all tags
@Ancienttwo Ancienttwo released this 22 Oct 18:07
· 871 commits to main since this release
v0.28.2
9c749f9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.28.2 publication record

Date: 2026-10-22 (UTC).
Status: all nine packages are published on npm. The complete registry readback passed. 0.28.3 later replaced them on latest.

This record was written on 2026-10-23, when the v0.28.2 tag was pushed.

Changes

The owner selected 0.28.2 as a one-release exception to the pre-1.0 MINOR rule. From this release, keys uses the release train version, so all nine packages are 0.28.2.

  • Security (client): the undici pin moves from 8.11.2 to 8.12.3 (#700).
  • Server and client: opt-in CORS for loopback (#613). Hosts can wait for the durable terminal state of an Agent-home projection instead of polling (#637).
  • Keys and client: a separate local provider custody launcher. piModelConfigFromPinnedCatalog. PI_THINKING_LEVELS comes from pi-ai.
  • Protocol and client: tool_use and tool_result events carry the MCP identity. Adapters publish metadata for Hosts (#635).
  • Client: a pinned Windows x64 native asset copier, and an opt-in task-free export of Agent memory. During a route outage, the daemon outbox keeps one copy of a pending agent.message.publish.
  • Examples: K4 Host and routine improvements.

See the CHANGELOG and the release notes for the full scope.

Source and accepted artifacts

  • Source commit: 9c749f9bc6d6964639d3e016f448fa4638533998 on main, the merge of #705.
  • Release matrix: run 39748877588, dispatched with release_sha equal to the source. It completed with success: 30 jobs passed and 1 job was skipped as expected.
  • Artifact: release-pack-9c749f9bc6d6964639d3e016f448fa4638533998, id 12412716745. Manifest SHA-256: dcb84516dad195ceaff9e4bfa549a6d7bc6b3c1b03ac506b3fc3010965f8464a.
  • Downstream acceptance (AiphaBee) passed on this commit: pack and smoke, typecheck, lint, the SDK compatibility check, 670 local-agent tests and the packageability check.
  • On 2026-10-23, the npm dist.integrity of all nine packages was compared with the tarballs in this artifact. All nine are equal.

npm execution

The account is ancienttwo, with auth-and-writes 2FA. Uploads used browser authentication. This local route has no provenance attestation. The dist-tag is latest.

A first attempt ran without a terminal. npm masked the browser link, and the run stopped with EOTP on the first package, before any upload. The second run, in a terminal, uploaded all nine packages from 10:41:49 to 10:46:55 UTC. Its readback first timed out on registry delay. A rerun of the same command read back all nine packages and created the tag. No upload was repeated.

Tag

The annotated tag v0.28.2 points to 9c749f9b. The tag object is 56db76431467c5f8d45a43ce3b9eaff7a4ed2f97. Its message is v0.28.2, a blank line, then sourceGitSha 9c749f9bc6d6964639d3e016f448fa4638533998. It was created on 2026-10-22 at 10:50:14 UTC and pushed on 2026-10-23.

Accepted tarballs

Package Version SHA-256
@byok-sdk/core 0.28.2 d5b0b7a30221ea6563244345bcb97443bfa540fd895ca2f902d098ecaa9a96d6
@byok-sdk/protocol 0.28.2 29903fa074ee41543912b877cbc8edde00aa6ef42883b01b4107fb4b531bba30
@byok-sdk/server 0.28.2 070d06b685726c285d93c5ec1fba91281fa8bdc33cc3daa02f07c4604482ee30
@byok-sdk/cloud 0.28.2 26d0ada5a6f8d6b5511a676c67948879a0f5a0840c9cf3efde90e9d9694bb08b
@byok-sdk/client 0.28.2 28bf52e951da92f81abefa68678178eb9e9a02b4c7d148bc0994bfc7f4ac8d6e
@byok-sdk/cloud-dataplane 0.28.2 9a9708ea5151e972b8026a4e09a351e84b787e2fa43fef8695b537d12797ff76
@byok-sdk/cloud-do 0.28.2 5d438ce9b75861c554fa7be74b2b3c93b65e4b5b259d1701d42b0387f3a21e61
@byok-sdk/ui-runtime 0.28.2 319d11f77d660da61c4b03aa854d1231bde3839e663c2926f6546bbb35bffaf3
@byok-sdk/keys 0.28.2 fda687b2ef7977485aa7f60de5912b3bc127f45dc456f347ef20f7f25ec33113
Assets 2
Loading