What's Changed
Added
- Command permission profiles (Claude/Grok-style presets):
tools.command_permission_profilesin config (builtinstight,open) plus user-saved SQLite profiles. REST under/api/permissions/profiles(list, get, apply, put, delete). Synthetic apply ids:__yaml__(clear overrides → config only),__blank__(empty lists). Migration004_perm_profiles. See docs/SECURITY.md - Migration
003_command_policy: ensurecommand_policy_overridesexists on DBs already at head without the table agent.tool_execdone events include truncatedoutputpreview (≤1500 chars) for live clients (Felix-vv, Web UI)- Worker-mode broadcast forwards
agent.tool_exec/agent.iteration/agent.thinking(previously onlytool.call/tool.calls.flushreached live clients in split mode) - Dry-run tools step for
custom:*modes uses the custom agent’s declared tool list (not the full profile catalog) - Docker Compose bind-mounts
custom_agents.yamlandcustom_agents.local.yamlso private agents (e.g.@felix) load on remote deploys deploy-remote.shseeds missing custom-agent YAML placeholders and syncscustom_agents.local.yamlon config-only deploys- Read-only gate: pure version/help probes (
npm --version,node -v, …) and bareversion/helpsubcommands allowed underread_onlyruns
Changed
- Command policy store uses the chat DB (
web.database_path, defaultdata/web_chat.db) - Runtime override merge is a full document (empty lists clear YAML baseline; no silent fall-through)
config.example.yamldocuments permission profiles and usesdata/web_chat.dbas the chat DB example
Fixed
- Felix/Web clients not receiving tool result previews on SAQ worker runs
Full changelog: https://github.com/bulletinmybeard/agent-forge/blob/master/CHANGELOG.md