v3.7.3

3.7.3 (2026-10-15)

Bug Fixes

• placeholder escalation contacts and sandbox-safe test temp dirs (#519) (2db6582)

Dependencies

• bump @modelcontextprotocol/sdk from 1.30.0 to 1.32.1 (#488) (044dcfd)
• bump typescript-eslint from 8.70.0 to 8.71.1 (#505) (2f6450e)

v3.7.2

3.7.2 (2026-10-14)

Dependencies

• bump @types/node from 26.6.2 to 26.6.4 (#510) (6818740)
• bump @upstash/redis from 1.38.4 to 1.39.0 (#503) (5f65693)
• bump @vitest/coverage-v8 from 5.0.1 to 5.0.3 (#507) (9d3fab9)
• bump eslint from 10.11.0 to 10.12.0 (#508) (e3c0ba6)
• bump fastmcp from 4.20.14 to 4.22.4 (#509) (038e6ac)
• bump globals from 17.12.0 to 17.13.0 (#511) (c64075d)
• bump vitest from 5.0.1 to 5.0.3 (#504) (44e1428)
• bump yaml from 2.9.0 to 2.9.1 (#506) (a75380a)

v3.7.1

3.7.1 (2026-10-12)

Bug Fixes

• deps: drop 15 runtime dependencies the package never imports (#501) (5074774)

v3.7.0

3.7.0 (2026-10-12)

Features

• validation: a run that executes nothing no longer passes (#500) (ab61534)

Bug Fixes

• build: add ESM extensions to the shipped .d.ts files too (#495) (4979c65)

Dependencies

• drop gray-matter, which nothing imports (#497) (4d76270)

v3.6.0

3.6.0 (2026-10-12)

Features

• cli: add version command and --version/-v flags (#464) (25e4583)

Bug Fixes

• deps: bump brace-expansion, fast-uri and hono to clear open alerts (#480) (1241264)
• deps: bump js-yaml to 4.3.2 (GHSA-2883-xcg3-v3hh) (#466) (e2e4965)
• license: let GitHub detect MIT (#482) (16caef4)
• security: neutralize CSV formula sigils in telemetry export (CWE-1236) (#463) (afcfabf)

Dependencies

• bump @azure/identity from 4.13.1 to 4.13.2 (#443) (5091d6f)
• bump @azure/identity from 4.13.2 to 4.13.3 (#467) (bfca783)
• bump @google/genai from 2.15.0 to 2.21.0 (#428) (da24a4c)
• bump @google/genai from 2.21.0 to 2.22.0 (#446) (4d1a8f0)
• bump @google/genai from 2.22.0 to 2.23.0 (#457) (43458e5)
• bump @google/genai from 2.23.0 to 2.24.0 (#468) (b7875e7)
• bump @qdrant/js-client-rest from 1.18.0 to 1.19.0 (#430) (5e55232)
• bump @supabase/supabase-js from 2.110.8 to 2.116.0 (#450) (c250efd)
• bump @supabase/supabase-js from 2.116.0 to 2.117.1 (#471) (ad6ba49)
• bump @types/better-sqlite3 from 7.6.13 to 9.6.0 (#444) (f89046a)
• bump @types/node from 26.1.2 to 26.6.2 (#473) (e5e59f9)
• bump @upstash/redis from 1.38.0 to 1.38.3 (#434) (4642603)
• bump @upstash/redis from 1.38.3 to 1.38.4 (#452) (a0bb2bd)
• bump @vitest/coverage-v8 from 5.0.0 to 5.0.1 (#454) (6e18d8f)
• bump axios from 1.19.0 to 1.20.0 (#429) (a5101d2)
• bump cloudflare from 7.0.0 to 7.1.0 (#449) (60279cc)
• bump eslint from 10.10.0 to 10.11.0 (#470) (f3e536f)
• bump eslint from 10.8.0 to 10.10.0 (#440) (b7ebbc5)
• bump fastmcp from 4.12.1 to 4.20.0 (#431) (98d3cbc)
• bump fastmcp from 4.20.0 to 4.20.10 (#442) (bba6594)
• bump fastmcp from 4.20.10 to 4.20.14 (#455) (01ce679)
• bump globals from 17.8.0 to 17.12.0 (#453) (9a8174e)
• bump groq-sdk from 1.4.1 to 1.6.0 (#448) (b3a0451)
• bump inquirer from 14.0.2 to 14.2.2 (#474) (8eead79)
• bump mem0ai from 3.1.2 to 3.1.8 (#427) (964d004)
• bump mem0ai from 3.1.8 to 3.3.0 (#472) (c59f876)
• bump pg from 8.22.0 to 8.23.0 (#426) (adf98ef)
• bump proxy-addr from 2.0.7 to 2.0.8 (#487) (961a333)
• bump redis from 6.1.0 to 6.2.1 (#425) (2bbfd70)
• bump source-map-js from 1.2.1 to 1.2.2 (#486) (a5d13f8)
• bump the npm_and_yarn group across 1 directory with 2 updates (#477) (efdce5f)
• bump the npm_and_yarn group across 1 directory with 3 updates (#435) (6a16d89)
• bump typescript-eslint from 8.65.0 to 8.70.0 (#456) (342ad1c)
• bump vite from 8.2.2 to 8.3.0 (#445) (33d70a9)
• bump vitest from 5.0.0 to 5.0.1 (#458) (7b3c93a)
• bump zod from 4.4.3 to 4.6.2 (#447) (aa08587)
• bump zod from 4.6.2 to 4.6.5 (#469) (2b903c7)

v3.5.4

3.5.4 (2026-09-05)

Bug Fixes

• ci: scope the weekly Semgrep sweep to Code so it stops OOMing (5021eac)
• ci: scope the weekly Semgrep sweep to Code so it stops OOMing (77163a5)
• ci: unblock bot PRs on security-review (#413) (cfad789)
• deps: clear all 17 open high Dependabot alerts (9759a1e)
• deps: clear all 17 open high Dependabot alerts (lockfile bumps) (a1eb387)
• deps: make the axios override track the direct dep (56f4945)
• deps: make the axios override track the direct dep (ea58eb6)
• deps: patch fast-uri advisories in the lockfile (#414) (286bcb9)
• deps: patch fast-uri advisories in the nested example lockfile (#418) (1c09e4d)

Dependencies

• Bump @anthropic-ai/sdk from 0.112.3 to 0.115.0 (#390) (64f1dec)
• Bump @google/genai from 2.12.0 to 2.13.0 (#388) (cd2b543)
• Bump @google/genai from 2.13.0 to 2.15.0 (#407) (bbf4c02)
• bump @hono/node-server (#398) (7a586ea)
• Bump @langchain/core from 1.2.3 to 1.2.4 (#404) (3c2b8da)
• Bump @supabase/supabase-js from 2.110.7 to 2.110.8 (#396) (3a4d3b8)
• Bump @types/node from 26.1.1 to 26.1.2 (#405) (8250f42)
• Bump axios from 1.18.1 to 1.19.0 (#401) (f5d2245)
• bump better-sqlite3 from 12.11.1 to 13.0.3 (#402) (1a78396)
• Bump eslint from 10.7.0 to 10.8.0 (#392) (9dd9f41)
• Bump fastmcp from 4.12.0 to 4.12.1 (#400) (773ca0d)
• Bump fastmcp from 4.7.2 to 4.12.0 (#395) (93ec0be)
• Bump globals from 17.7.0 to 17.8.0 (#403) (d803d4d)
• Bump groq-sdk from 1.3.0 to 1.4.1 (#406) (52cc1ee)
• Bump mem0ai from 3.1.0 to 3.1.2 (#394) (aef6427)
• Bump openai from 6.48.0 to 6.49.0 (#387) (c1d75cd)
• Bump postcss in the npm_and_yarn group across 1 directory (#397) (7a559bf)
• Bump typescript-eslint from 8.64.0 to 8.65.0 (#389) (56ea9b4)

v3.5.3

3.5.3 (2026-07-24)

Bug Fixes

• doc-parity: unblock Doc Parity on release #381 (JSDoc reattach + npm-stat link timeout) (0223efe)

Dependencies

• Bump the npm_and_yarn group across 1 directory with 2 updates (#385) (eed954e)

v3.5.2

3.5.2 (2026-07-22)

Bug Fixes

• mcp: bind httpStream to loopback by default; report real host in banner (24a4245)
• mcp: loopback-default httpStream bind + accurate host banner (7db0378)
• mcp: sandbox design-tokens file reads to the project root (#382) (94275f8)

v3.5.1

3.5.1 (2026-07-21)

Bug Fixes

• release: pin npm to ^11.5 in publish job (npm@latest→npm@12 broke publish) (#379) (8997b2c)

Dependencies

• bump cloudflare from 6.5.0 to 7.0.0 (#358) (69c8ad0)

v3.5.0

3.5.0 (2026-07-21)

Features

• add agent capability manifest interfaces for task delegation and execution (46c8b0c)
• add agent capability manifest types for intelligent task delegation (c0b08a3)
• add benchmarking and integration tests for DelegationContractManager (b37b1b4)
• add bun >= 1.1.0 to engines field (1158336)
• add Liability Firebreak Enforcement Tests and Feature Flags Manager (d499049)
• add SonarCloud analysis configuration and properties (ca5941a)
• add support for execution modes in capability manifest and registry (84ffe3b)
• add telemetry schema and CLI dashboard for agent performance metrics (f194846)
• add validation pipeline integration system with comprehensive testing and reporting (6afed33)
• agent-router: update task context type and enhance global router initialization with dependencies (20f5988)
• agents: add AgentPersona type system (7fc763c)
• agents: add comprehensive unit tests for persona system (eb0dfcf)
• capabilities: expand capability database with new agent functions and optimizations (e7e4244)
• ci: add documentation-parity gates and fix stale VERSION export (#277) (1c21a08)
• ci: integrate 1Password secrets in workflows (cec8048)
• container: implement LocalDockerBackend, RemoteDockerBackend, and KubernetesBackend for container execution (6517d46)
• content-manager: add ContentProvider interface and createContentManagerServer function (655f3bf)
• cowork: Phase 4 - wire handoff_context to sessions (28f2ed5)
• delegation framework improvements (a0ca76d)
• delegation: add barrel export index.ts for delegation module (9dd93ba)
• delegation: add CapabilityManifestGenerator class wrapper (81d385a)
• delegation: add plugin_security_enabled feature flag killswitch (d0cf9be)
• delegation: add runtime warning for missing executionMode (task 8.1) (dae4c7b)
• delegation: add security threat model and TLP enforcement (18590aa)
• delegation: enhance security validation and telemetry tracking in delegation contracts (7d0d5fa)
• delegation: Phase 20 - Plugin delegation with security metadata, permission scopes, and reputation integration (e1c2dfd)
• delegation: Phases 1-2 backward-compatible execution modes (83869bb)
• delegation: Phases 3-6 execution modes, MCP, tests (133fa88)
• delegation: Ralph Loop V2 � prompt rewriting, pattern learning, token budget (8fe83c6)
• delegation: tasks 10.2-10.4 � health monitoring exports + load tests (2c2c640)
• delegation: Tasks 4.1-4.5 session handoff protocol v3.0 (14b25ee)
• dependencies: add axios as a dependency with version >=1.13.5 (96a1d28)
• design-tokens: add TokenProvider interface and createDesignTokenServer for design token validation (b0d4da6)
• develop verification policy framework for delegation contracts (c0b08a3)
• doc-parity: structural PROVIDER_ENV_KEYS manifest + config determinism guard (Wave 1 task 1.6) (#316) (ce342f7)
• doc-parity: Wave 1 � generated API reference + strict export-parity (#313) (6e855de)
• docs: add initial wiki.json for project documentation (f4a258e)
• Enhance capability registry and delegation integration (159815d)
• Enhance capability registry and liability firebreak functionality (e0b9899)
• establish permission token types for hierarchical access control (c0b08a3)
• implement AgentRuntime for multi-step task execution with LLM integration (f9a715d)
• implement Anti-Assumption Protocol framework types and threat detection (2e8217f)
• implement delegation contract types for AI delegation framework (c0b08a3)
• implement Liability Firebreak Enforcement for delegation framework (69a2569)
• lint: add ESLint v9 flat config for @dcyfr/ai (7a41875)
• mcp: add bearer token auth to delegation-monitor write operations (task 4.7) (1f50e17)
• mcp: add MCP server configuration for various services and update exports in package.json (2de26c2)
• mcp: authenticated Streamable HTTP transport for FastMCP servers (#222) (60f3e99)
• mcp: export remote transport + bearer-auth helpers from the mcp barrel (#377) (989bd68)
• memory: add memory module exports and integration guide documentation (60e4b65)
• personas: add TypeScript type definitions for brand voice and agent personas (bd2e259)
• personas: implement brand voice system Phase 2.2-2.6 (ac468da)
• plugins: Phase 13 Incident Response SLA (459121b)
• plugins: Phase 15 gVisor Integration (c121677)
• plugins: Phase 16 Behavioral Anomaly Detection (85b5beb)
• plugins: Phase 17 Plugin Certification Program (262306e)
• plugins: Phase 18 Web...