v5.3.0 Apex

Changelog

v5.3.0 (2026-10-12) — Apex

Full release notes: RELEASE_NOTES_v5.3.0.md

Added

• Ops Memory: a separate bounded operational-history store records coarse metadata from completed tool executions after delivery. It stores no command text, arguments, output bodies, or user messages; observations are workspace-scoped, deduplicated, capped, and expire by category.
• Historical operational retrieval: relevant past execution metadata can be surfaced for an operational user query with explicit expiry and a warning to verify volatile state before relying on it. No background model call or tool-loop decision was added.
• Tests for Ops Memory persistence, data minimization, deduplication, workspace scoping, expiry, corrupt-state reporting, opt-out, and context retrieval.
• Tests and diagnostics for Windows/Git Bash path mistakes, successful commands with intentionally empty output, Discord progress message sizing, and sensitive argument redaction.

Changed

• exec now distinguishes a successful silent command from absent results and provides actionable guidance for path and shell mismatches on Windows.
• Discord tool-progress previews are capped below Discord's 2,000-character message limit and redact common credential/header formats before display.
• README and release documentation now describe the current runtime, memory boundaries, tool execution, adaptive subsystems, channels, and security considerations.
• Version reporting remains package-metadata driven: the package, gateway banner, daemon, web status, and MCP server all resolve the same application version.

Fixed

• Prevented Discord progress edits from exceeding the platform message-content limit.
• Clarified that Windows Git Bash is not a Linux filesystem: Windows drive paths and guessed /workspace or /tmp paths are not valid unless they exist in that shell.
• Successful exec calls with no stdout/stderr now return an explicit exit-code-0 result rather than an empty string.
• Restored and retained the committed Discord.js 14.25.1 dependency and lockfile after an unintended local downgrade.

Included since v5.2.0

• More reliable tool-call pairing and session-message sanitization.
• Hardened session persistence, self-improvement evaluation, and long-running agent behavior.
• Corrected historical COMB wording and removed hard-coded OpenRouter quota/reset assumptions; retries now follow provider response metadata.

Upgrade notes

• No configuration migration is required for this release.
• Ops Memory is enabled by default and can be disabled with SYMBIOTE_OPS_MEMORY=0.
• Run npm ci followed by npm run build when upgrading from a source checkout.
• On Windows, provide workdir instead of issuing cd with guessed paths; use /c/... for explicit Git Bash paths.

---

v5.2.0 (2026-10-10) — Apex

Full notes are superseded by the current v5.3.0 release notes; this section preserves the v5.2.0 release summary.

Added

• Curator tool-bug detection (v5.1): per-tool failure windows, minor/major classification, retry/timeout/fallback proposals
• Memograph integration with shard-hash verification; reseal repair tool
• fs and hardware admin tools; read handles directories, binary and very large files; write supports append and base64
• Native browser CUA driver, channel-specific formatting, live CLI interrupts
• Skill ingestion and persona_digest

Changed

• Tool sandbox off by default (SYMBIOTE_SANDBOX=1 re-enables it); exec default timeout 600 s
• Prompt-injection guard rebuilt with trust levels, weighted patterns and obfuscation-aware normalisation (SYMBIOTE_INJECTION_GUARD)
• Naming unified on symbiote; environment variables are SYMBIOTE_*

Fixed

• Shell execution on Windows (PowerShell-first), tree-kill for timeouts
• Stream drops retried; hung tools and silent streams time out; progress saved each iteration
• Context compaction preserves the original task and tool-call pairing
• Repeated text in context, empty-reply stalls, cut-off tool arguments, lost output tails
• Tool-success reporting, daemon lock and duplicate-start issues, Discord drops, OpenRouter registration

---

v4.0.0 (2026-09-03) — Apex

Windows-First Runtime Portability

• Replaced Unix-only shell assumptions in core execution tools with platform-aware shell dispatch
• Added shared runtime helpers for app home, config discovery, IPC keyring lookup, Python launch, and shell execution
• Removed hardcoded /etc, /usr/bin/chromium, /bin/bash, /home/..., and raw /tmp/... assumptions from key runtime paths
• Preserved legacy symbiote paths for compatibility while preferring current Symbiote runtime locations

Installer & Launch Flow Cleanup

• Hardened launcher/runtime assets for Windows, Linux, and macOS
• Improved browser sidecar startup so packaged and cross-platform installs can resolve Python and browser paths correctly
• Aligned setup defaults with portable app data locations for new installs

Release & Packaging Prep

• Aligned package metadata and runtime version reporting to v4.0.0 Apex
• Refreshed release surfaces and static landing assets for public packaging and deployment handoff
• Updated installation guidance to use the published symbiote package name

---

v3.0.0 (2026-08-23) — Apex

Production Hardening

• Enforced HTTP API authentication across web and API chat paths
• Added loopback-safe API host defaults and stricter CORS validation
• Prevented unverified HTTP owner impersonation
• Validated config before startup and hot reload
• Reduced sensitive request/message logging in production paths

Installer & Setup

• Replaced the legacy wizard with a shared guided setup flow
• Added a desktop installer UI served by symbiote init --ui
• Added double-click launchers: install.command and install.cmd
• Rebuilt symbiote install to install, build, configure, and launch in one flow
• Preserved existing .env secrets during reconfiguration

Runtime Reliability

• Fixed sub-agent depth accounting
• Implemented real sub-agent kill and steer behavior via abort + resume
• Removed accidental admin-tier treatment for sub-agents
• Fixed packaged browser sidecar path discovery
• Unified runtime version reporting through package metadata

---

v2.1.0 (2026-03-12)

Circuit Breaker Failover

• Providers that fail 3x consecutively are automatically disabled for 60s cooldown
• Latency-aware routing: tracks moving average latency per provider, prefers faster ones when all healthy
• Auto-recovery: half-open probes after cooldown, full recovery after 2 consecutive successes
• Health states: healthy -> degraded -> unhealthy -> circuit-open (automatic transitions)
• Circuit-open providers skipped during fallback chain (no wasted retries)
• See: Circuit Breaker

Session Hot Resume

• Session state persisted to disk every 60s
• On process termination: all active sessions marked and flushed to disk before exit
• Startup restoration: previous session state reloaded on boot with 24h age validation
• Gateway restarts no longer lose conversation context registration
• See: Sessions

Metrics Collector

• Provider metrics: call count, error count, token usage (in/out), latency histograms (p50/p90/p99)
• Tool metrics: per-tool call frequency, latency, error rates
• Session metrics: turn count, active session tracking
• Ring buffer design: bounded memory, automatic eviction of old samples
• Auto-flush to JSON every 5 minutes; zero dependencies (pure Node.js stdlib)
• See: Metrics

Configurable Idle Emoji

• Idle status indicator emoji now configurable via idleEmoji field in symbiote.json
• Also configurable via IDLE_EMOJI environment variable
• Defaults to existing behavior when absent

Enhanced Health Endpoint

• GET /api/v1/health now returns comprehensive gateway status
• Fields: version, uptime (human-readable), PID, provider health states (per-provider circuit breaker status), metrics snapshot (tokens/latency/errors), memory usage (RSS + heap in MB), active turns, session count, tool count, connected channels

Other

• Dependabot security patches (file-type)
• Documentation and landing page updates for Symbiote rebrand

---

v2.0.0 (2026-03-12)

Provider Health Monitor — Circuit Breaker + Intelligent Failover

• Circuit breaker pattern: Providers that fail 3× consecutively are automatically disabled for 60s cooldown
• Latency-aware routing: Tracks moving average latency per provider, prefers faster ones when all healthy
• Auto-recovery: Half-open probes after cooldown, full recovery after 2 consecutive successes
• Health states: healthy → degraded → unhealthy → circuit-open (with automatic state transitions)
• Fallback chain integration: Circuit-open providers are skipped during failover — no wasted retries
• File: src/providers/health.ts (202 lines)

🔥 Session Hot Resume — Survive Restarts

• Session state persistence: Active session metadata saved to disk every 60s
• Graceful shutdown capture: On SIGTERM/SIGINT, all active sessions marked and saved
• Startup restoration: Previous session state restored on boot with age validation (24h expiry)
• Zero-loss restarts: Gateway restarts no longer lose conversation context registration
• File: src/sessions/hot-resume.ts (193 lines)

Metrics Collector — Runtime Observability

• Provider metrics: Call count, error count, token usage (in/out), latency histograms (p50/p90/p99)
• Tool metrics: Per-tool call frequency, latency, error rates
• Session metrics: Turn count, active sessions tracking
• Ring buffer design: Bounded memory, automatic eviction of old samples
• Persistent: Auto-flush to JSON every 5 minutes + shutdown flush
• Zero dependencies: Pure Node.js stdlib, non-blocking fire-and-forget recording
• File: src/metrics/collector.ts (466 lines)

🏥 Enhanced Health Endpoint

• GET /api/v1/health now returns comprehensive gateway status:
  • Version, uptime (human-readable), PID
  • Provider health states (circuit breaker status per provider)
  • Metrics snapshot (tokens, latency, errors)
  • Memory usage (RSS + heap in MB)
  • Active turns, session count, tool count, connected channels

Infrastructure

• Symbiote rebrand (v1.7 → v2.0 naming)
• IPC Identity (HMAC-SHA256 inter-agent authentication)
• Web Automation Suite (14 browser tools via Playwright sidecar)
• VDB embedded vector database with 5s real-time indexing pulse
• Voice middleware (Whisper transcription + MeloTTS generation)
• Webchat dark glass UI overhaul
• One-command installer (bash + PowerShell)
• UTF-8 BOM stripping for Windows config compatibility

By the Numbers

• Total source: ~19,000 lines TypeScript
• Built-in tools: 31
• Providers: 8 (Anthropic, OpenAI, GitHub Copilot, Gemini, Groq, Ollama, xAI, GLADIUS)
• New v2.0 code: 861 lines across 3 new modules

---

v1.7.0 (2026-03-10)

Features

• VDB persistent memory engine
• 10-second real-time indexing pulse
• COMB → HEKTOR vectorization sidecar
• Context Monitor (proactive context management)

---

v1.6.0 (2026-03-08)

Features

• Provider fallback chain
• Session archival and context windowing
• WhatsApp Web integration
• Webchat visual overhaul

---

v1.5.0 and earlier

See git history.