Release OwlLayer v0.5.0

OwlLayer AI 0.5.0: Deepgram voice (Nova and Flux STT, Aura TTS, streaming pipeline, Voice Agent), a single tool registry with a tool limit and argument validation before approval, server hardening, typed model and voice catalogs in every adapter, the redesigned shared widget presets with voice and text continuity, and Gemini Live tools that follow the navigation with the default model.

Install: pnpm add @owllayer/core @owllayer/server plus the SDK and adapters you use. Known limitation: Gemini 3.x Live models keep the tools of the page where the voice session started; see the Tools Guide, section "Voice models and tool updates".

Versions

Package	Version
@owllayer/core	0.5.0
@owllayer/ui	0.5.0
@owllayer/server	0.4.0
@owllayer/react	0.4.0
@owllayer/vue	0.4.0
@owllayer/svelte	0.4.0
@owllayer/angular	0.4.0
@owllayer/browser	0.4.0
@owllayer/adapter-google	0.4.0
@owllayer/adapter-openai	0.4.0
@owllayer/adapter-anthropic	0.4.0
@owllayer/adapter-livekit	0.4.0
@owllayer/adapter-deepgram	0.1.0

Minor Changes

• New shared HitlLabels type for the texts of approval UIs, used by all framework SDKs (#90).

  • Fields, all optional: title, message, approve, deny, deniedMessage and toolLabels (display name per tool).

  Packages: core

• OwlLayerClient now keeps its tools in a single ToolRegistry instead of scattered internal state (#152).

  • New ToolRegistry API: onChange, lastChangedAt, replaceAll, maxTools, setMaxTools, global and plugin fields on a registered tool, and global tools are kept when removeByComponent runs.
  • New ToolLimitError.
  • Tool limit: no limit before the handshake, then the server's maxActiveTools (30 by default). Extra registrations are refused: registerTool returns false, a tool.registry.limit event fires, and onError is called.
  • HANDSHAKE_ACK can carry an optional maxActiveTools (protocol version unchanged).
  • Tool arguments are validated against the tool's Zod schema before the approval request is sent — invalid arguments never reach an approval, and the handler receives the parsed values. callTool validates the same way. RegisteredTool now has a schema field.

  Packages: core

• Provider-neutral streaming speech contracts and live session history (#109).

  • New, additive packages/core/src/voice/streaming.ts: StreamingSTTService/StreamingTTSService with openTurnStream()/openSpeechStream(), independent from the existing batch STTService/TTSService (a streaming-only provider never fakes a batch transcribe()/synthesize()), plus STTTurnEvent, SpeechStreamState, and the runtime guards isStreamingSTTService/isStreamingTTSService.
  • LiveSessionConfig gains two optional fields: conversationHistory (prior messages, supplied on session creation and re-creation) and onToolCallCancelled (ids of provider-cancelled tool calls). Purely additive — every existing STTService, TTSService, LiveAdapter, and LiveSession implementation compiles and behaves unchanged.
  • Exported from the package root (@owllayer/core).

  Packages: core

• The agent can now use the tools of a new page right after navigating to it (#76).

  • Tools registered while the agent is busy (for example by a page mounted during a tool call) are now sent to the server.
  • After a tool that navigates, OwlLayerClient waits for the new page to register its tools (up to 500 ms) before returning the tool result.
  • LLMAdapter.handleToolResult accepts an optional third argument: the tools currently available.

  Packages: core

• New watchRouteChanges(client) helper: sends the current page to the agent when the app changes page without a full reload (#118).

  • Detects router navigations (history.pushState, replaceState) and the browser back and forward buttons.
  • Sends an update only when the path changes; query string and hash changes are ignored.
  • Returns a cleanup function that restores history. Does nothing during server-side rendering.
  • Used by the Vue, Svelte, Angular and Browser SDKs; React already had the same behavior.

  Packages: core

• The voice widget no longer waits in silence when the microphone does not start.

  • @owllayer/core: createMicrophoneSource() connects the microphone at 16 kHz when the browser accepts it, and otherwise at the device rate with downsamplePcm() (Firefox and older Safari refuse a 16 kHz context); getMicrophoneErrorKind() tells a refused permission from a missing device. New labels micPermission and micUnavailable.
  • @owllayer/react: useVoiceMode uses them, exposes micError, and startRecording() resolves to true when recording (false on failure) instead of only logging the error.
  • React, Vue and Svelte widgets: a refused or missing microphone is shown in voice mode (red orb, reason under it, short status in the header); the microphone button asks again. Opening directly in voice mode still falls back to text when fallbackToText is set.

  Packages: core, react, vue, svelte

• Redesigned chat and voice widget, shared by React, Vue and Svelte, with the conversation kept between text and voice.

  • @owllayer/core: new stylesheet for the call, chat and travel presets (compact call card in voice mode, conversation panel in text mode, launcher, empty state, typing indicator, voice visualizer for listening, thinking, speaking and error, reduced motion, small screens). Each preset has its own palette (PRESET_THEMES), overridden by theme. New WidgetLabels keys (switchToText, switchToVoice, close, muteMic, unmuteMic, emptyTitle, emptyText, linesWaitingTitle, linesWaitingText, linesBusyTitle, linesBusyText); default status labels in sentence case. New transcript system event kind and transcript.delta client event.
  • @owllayer/react, @owllayer/vue, @owllayer/svelte: the widget uses the shared markup: header with agent state, mode switch and close button, voice controls (mute, hang up, switch to text), last transcript lines in voice mode, the same conversation in both modes. Labels replace the texts that were hard-coded in French. The microphone level drives the visualizer in every preset. travel opens bottom left only when no position is given. Svelte now scopes the widget styles under .owllayer-widget-root.
  • @owllayer/server: voice transcriptions are sent to the client (SYSTEM_EVENT transcript) and stored as one history message per spoken turn, so the conversation continues in text mode.
  • @owllayer/adapter-google: a Gemini Live session starts with the conversation the server passes (conversationHistory), so switching from text to voice keeps the context.
  • end_call in every SDK: the declaration is shared in @owllayer/core (END_CALL_TOOL); React, Vue and Svelte register it while the panel is open and close the panel once the agent has finished speaking (END_CALL_TIMING), instead of cutting its last words. Vue and Svelte did not register it before.
  • @owllayer/ui: DevTools placement option (bottom-left by default, away from chat widgets); useDevTools({ placement }) in React.

  Packages: core, ui, server, react, vue, svelte, adapter-google

• Security: weak admin passwords are rejected in production, and server tool arguments are validated before the handler runs (#172).

  • The admin password must have at least 12 characters and must not be a well-known value. With NODE_ENV=production, a weak password stops the server from starting; otherwise it logs a warning.
  • LLM arguments are checked against the server tool's declared parameters (types, required, enum); invalid arguments never reach the handler.
  • A server tool registered without risk logs a warning, since it runs without human approval. The default stays 'none' for now.

  Packages: server

• Security: the server now bounds message sizes and rates, and runs one LLM turn at a time per session (#170).

  • WebSocket messages are capped at 4 MB (limits.maxMessageBytes) and HTTP request bodies at 64 KB (413 above).
  • Text inputs are capped at 8,000 characters, client tools per context update at maxActiveTools (30 by default; limits.maxClientTools can raise it but not lower it below maxActiveTools) and context data at 64 KB (limits).
  • New rateLimit option: 100 messages per second and 20 user messages per minute per connection by default; userInputsPerMinutePerKey caps all connections of an API key (off by default, set it to cap your LLM cost).
  • A user message received while the assistant is still answering is rejected with a clear error instead of starting a parallel turn. Long hybrid audio recordings may need a higher maxMessageBytes.

  Packages: server

• Security: server tools, plugins and API keys can now be scoped per client app (#171).

  • New apiKeys option on server tools and at plugin installation: the tool is only offered to, and only runs for, those API keys. Without it, a tool stays available to every key.
  • New allowedOrigins per API key (server.addApiKey(key, { allowedOrigins }), admin API, SQLite and MongoDB stores): connections from another origin, or without an Origin header, are rejected.
  • Session ids are full UUIDs.

  Packages: server

• Provider-neutral streaming voice pipeline, live tool-call cancellation, and voice-mode validation (#112).

  • New StreamingPipelineLiveAdapter (packages/server/src/voice/): a LiveAdapter composite over any StreamingSTTService + LLMAdapter + StreamingTTSService from @owllayer/core. Plugs into the existing live option with no AITP change — turn-based state machine (speculative replies held until ...

Release OwlLayer v0.4.0

What's Changed

• --- setup by @nightwalkeryao in #1
• Feat/feature 35 livekit optional runtime by @borisbob91 in #2
• Feat/feature 21 core client event contract standardization by @borisbob91 in #3
• Feat/feature 35 livekit optional runtime by @borisbob91 in #4
• docs(en): align VitePress English docs with Astro French source by @borisbob91 in #6
• Docs/public release readme by @borisbob91 in #7
• fix(pnpm): duplicate version declaration by @borisbob91 in #8
• fix(ci): synchronize Danger lockfile by @borisbob91 in #9
• fix(ci): make clean package builds portable by @borisbob91 in #10
• fix(release): restrict Changesets to public packages by @borisbob91 in #12
• chore(release): version packages by @github-actions[bot] in #11
• docs: establish OwlLayer AI governance and Spec Kit workflow by @borisbob91 in #39
• chore: configure repository CODEOWNERS by @borisbob91 in #41
• docs: establish OwlLayer AI naming and AITP guide by @borisbob91 in #43
• chore(core): migrate @domos/core to @owllayer/core by @borisbob91 in #44
• feat(core): expose provider-neutral audio from @owllayer/core/media/audio by @borisbob91 in #50
• chore(release): version packages by @github-actions[bot] in #45
• chore(angular): migrate audio utilities to Core Media by @borisbob91 in #51
• chore(adapter-livekit): migrate audio utilities to Core Media by @borisbob91 in #52
• chore(release): version packages by @github-actions[bot] in #53
• docs(site): migrate documentation site to OwlLayer AI by @borisbob91 in #55
• chore(ui): migrate @domos/ui to @owllayer/ui by @borisbob91 in #56
• chore(release): retire standalone @domos/audio workspace by @borisbob91 in #58
• test(server): stabilize STT timing measurement by @borisbob91 in #60
• chore(release): version packages by @github-actions[bot] in #57
• chore: complete OwlLayer and AITP pre-publication cutover by @borisbob91 in #61
• chore(release): version packages by @github-actions[bot] in #63
• Fix/frozen lockfile by @nightwalkeryao in #66
• feat: restore i18n for server, sdks and demos by @borisbob91 in #64
• Feat/npm readmes by @nightwalkeryao in #65
• fix(release): exclure les source maps des tarballs npm by @borisbob91 in #68
• chore(release): version packages by @github-actions[bot] in #67

New Contributors

• @nightwalkeryao made their first contribution in #1
• @borisbob91 made their first contribution in #2
• @github-actions[bot] made their first contribution in #11

Full Changelog: https://github.com/borisbob91/owllayer/commits/owllayer-v0.4.0

Release OwlLayer v0.3.1

Patch release: @owllayer/core@0.3.1, @owllayer/ui@0.3.1, SDKs/Adapters/Server@0.2.1

Release OwlLayer v0.3.0

Initial release with @owllayer/core@0.3.0, @owllayer/ui@0.3.0, SDKs and Adapters @0.2.0