v0.5.0

Full Changelog: v0.3.0...v0.5.0

v0.3.0

v0.3.0 – Skills, Provider Flavors & Security

Added

• Skills system — load reusable SKILL.md definitions via --skill=PATH (file or folder) or auto-discovery from the skills directory (configurable via skills_dir). Skills are listed in the system prompt and their full instructions are loaded on demand with the load_skill tool.
• Provider flavors — all 9 wizard providers (OpenAI, Anthropic, Ollama, Groq, DeepSeek, Google, Mistral, OpenRouter, xAI) now work at runtime, each mapped to an OpenAI- or Anthropic-compatible endpoint. New generic openai-compatible / anthropic-compatible providers support custom endpoints via api_base.
• --model / --provider CLI overrides — switch model/provider for a single invocation without editing the config.

Changed

• CLI cleanup — --interactive renamed to --ask; -s/--session now implies --ask (previously tools silently failed in interactive sessions); --yolo conflicts with --ask; --init/--config and --list/--delete/--init/--session are mutually exclusive; removed the stale /tools REPL command.
• Typed message roles — session::Message.role is now a Role { User, Assistant, System } enum instead of a raw string (session files stay backward compatible). /compact summaries are now consistently persisted and resumed as system messages.
• Enforced external-command timeouts — external commands now run through async tokio::process with kill_on_drop, so a long-running command (e.g. sleep 300) is killed at the configured timeout instead of running to completion and blocking a worker thread.
• main() decomposed — split into a thin entry point plus a run() orchestrator with extracted helpers; --list/--delete no longer fail on a broken policy file.
• Misc — shared HTTP client with connection pooling; fmt_bytes() deduplication; replaced hand-rolled UTC conversions with the time crate.

Security

• Resolved RUSTSEC-2026-0187/0195/0194 (high-severity lopdf/quick-xml advisories) by replacing markitdown with markdownify + pdf-extract; removed the stale CI audit ignore list.
• Replaced deprecated serde_yaml with the maintained serde_yaml_ng fork.
• Hardened JS-injection in browser/search tools — selectors and queries are now emitted as proper JSON string literals.

Quality

• ~30 new unit tests across config, memory, util, tool output helpers, CLI parsing, and policy path resolution (71 total).

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Full Changelog: https://github.com/dswd/ai/commits/v0.1.0