Aonyx Agent v0.7.0

Changelog

All notable changes to Aonyx Agent will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

(nothing yet)

[0.7.0] — 2026-06-03 — Vague 4 (1/2): automation API

Adds a first-class REST + WebSocket automation API over the agent core
(aonyx serve api) in a new aonyx-api crate. clippy --all-features -D warnings clean on the pinned 1.96.0 toolchain; full workspace test suite
green.

Added

• Automation API (aonyx serve api, feature api, in the -full
  binary) — a bearer-authed HTTP surface over the same core that powers the
  CLI/TUI:
  • Sessions — GET/POST /v1/sessions, GET/DELETE /v1/sessions/:id,
    POST /v1/sessions/:id/messages (blocking turn), persisted in the same
    ~/.aonyx/sessions.db as the CLI/TUI.
  • Streaming — GET /v1/sessions/:id/stream (bidirectional WebSocket)
    and POST /v1/sessions/:id/messages/stream (one-shot SSE): live text
    deltas + tool-activity frames.
  • Memory palace — GET /v1/memory/search (hybrid), GET/POST /v1/memory/diary, GET /v1/memory/kg/entities, /entities/:name,
    /relations.
  • Introspection — GET /v1/tools, /v1/skills, /v1/config
    (secrets are never exposed), /v1/info, /v1/health.
  • OpenAI-compatible — POST /v1/chat/completions + GET /v1/models
    co-mounted on the same port, so any OpenAI SDK is a drop-in client.
  • OpenAPI — GET /v1/openapi.json (open, for discovery).
  • Security — bearer token (flag / keyring api_token / AONYX_API_TOKEN);
    binds 127.0.0.1 by default; a non-loopback bind refuses to start
    without a token; destructive tools stay denied at the loop level.

Notes

• New crate aonyx-api (10 crates total). The API never depends on
  aonyx-agent — the agent loop is injected through an ApiAgent trait,
  exactly like the channel adapters — so the binary pulls it in behind the
  api feature with no dependency cycle.
• First half of Vague 4. The Windows desktop app (Tauri 2, hybrid
  local/remote) lands in v0.8.0.

[0.6.0] — 2026-06-02 — Vague 3 finale (cloud-sync · self-evolution · sandbox)

Closes the Vague 3 arc — and with it the full PRD roadmap (Vague 1 + 2 + 3).
clippy --all-targets --all-features -D warnings clean on the pinned 1.96.0
toolchain; full workspace test suite green.

Added

• Encrypted cloud-sync (Phase AAA, Vague 3) — aonyx memory backup
  zips the project palace and encrypts it (XChaCha20-Poly1305, key derived
  from a passphrase via Argon2id) into a portable .aonyxbak file; aonyx memory restore <file> brings it back on any machine. Sync the file via
  any cloud (S3 / Dropbox / rsync / git) — only the passphrase opens it.
• Self-evolution (Phase BBB, Vague 3) — aonyx reflect reads the
  project diary, asks the model to distil recurring patterns, preferences,
  and lessons, and proposes an improved system prompt (shown as a diff);
  aonyx reflect --apply adopts it into config.toml. A bounded,
  deterministic take on the DSPy/GEPA idea — the agent learns from its own
  history.
• Sandboxed / remote exec (Phase CCC, Vague 3) — sandbox_exec runs a
  command off the host via a Docker backend (docker run --rm <image>)
  or an HTTP backend (POST {command} → {stdout,stderr,exit_code})
  for a Modal function, a Daytona workspace, or any compatible shim.
  Configured via sandbox_backend / sandbox_image / sandbox_url (HTTP
  token in the keyring); registered only when a backend is set.

[0.5.0] — 2026-06-02 — multimodal & web (Vague 3)

Vague 3 takes off: drive a real headless browser, generate images, and
speak. clippy --all-targets --all-features -D warnings clean on the
pinned 1.96.0 toolchain; full workspace test suite green. The -full
release binaries now also bundle browser automation.

Added

• Browser automation (Phase YY, Vague 3) — a headless Chrome / Chromium
  toolset over CDP (chromiumoxide): browser_navigate, browser_read,
  browser_click, browser_screenshot, all sharing one lazily-launched
  browser session. Behind the browser cargo feature (included in the
  -full release binaries); needs a Chrome/Chromium binary at runtime.
• Image generation & TTS (Phase ZZ, Vague 3) — image_gen (OpenAI
  images API → PNG) and tts (OpenAI audio/speech → MP3). Lightweight and
  always available; the OpenAI key is injected (config → keyring → env), so
  they work with a keyring-stored key. Clear error when no key is set.

[0.4.0] — 2026-06-02 — integrations & onboarding

The Vague 2 finishing arc (phases SS → XX): onboarding, real channel
adapters, an OpenAI-compatible server, Lua plugins, and skill
auto-generation. clippy --all-targets --all-features -D warnings clean on
a pinned 1.96.0 toolchain; full workspace test suite green. Prebuilt release
binaries now ship in lean and -full (all adapters + plugins)
variants.

Added

• aonyx setup — an interactive onboarding wizard (Phase SS): pick a
  provider, enter the API key, choose a model, and verify it with a live
  connection ping before writing config.toml.
• OS keyring secret storage (keyring crate) for API keys — macOS
  Keychain, Windows Credential Manager, Linux Secret Service. Runtime
  resolution order: config.toml → keyring → environment variable. Keys
  no longer need to live in plaintext, and an env-sourced key can no
  longer leak into config.toml on save.
• Linux aarch64 prebuilt binary, built natively on a GitHub-hosted
  ARM runner.
• Telegram bot (aonyx serve telegram, Phase TT) — a teloxide
  long-poll bot bridged to the agent loop, with per-chat history, a
  chat-id allow-list, and an aonyx setup telegram wizard (token →
  keyring). Behind the opt-in telegram cargo feature so the default
  binary stays lean; destructive tools stay denied for remote chats.
• Discord bot (aonyx serve discord, Phase UU) — a serenity gateway
  bot sharing the same bridge (per-channel history, allow-list, 2000-char
  chunking) with an aonyx setup discord wizard. Behind the discord
  feature; needs the MESSAGE CONTENT privileged intent enabled.
• OpenAI-compatible HTTP server (aonyx serve openai --port, Phase VV)
  — an axum server exposing POST /v1/chat/completions + /v1/models
  so any OpenAI SDK can point at the local agent. Stateless (the client
  owns history, bridged through a new AgentHandler::complete), optional
  bearer auth. Behind the openai-server feature.
• Lua plugins (Phase WW) — drop a .lua file in ~/.aonyx/plugins/
  to add an in-process tool via aonyx.register_tool { name, description, run = function(args) ... end }. The Lua VM runs on a dedicated thread
  (so the tools stay Send + Sync); JSON args/results bridge
  automatically. Behind the lua-plugins feature. Example:
  examples/plugins/hello.lua.
• Skill auto-generation (Phase XX) — on by default: when a request
  shape (its leading action word) recurs skill_autogen_threshold times
  (default 3), Aonyx writes a SKILL.md to ~/.aonyx/skills/ seeded with
  the real examples seen; it loads on the next session. Deterministic — no
  model call. Disable with skill_autogen = false in config.toml.

[0.3.0] — 2026-06-01 — the connected agent

The post-0.2.0 arc (phases AA → RR) opens Aonyx up to the wider tool
ecosystem and deepens the memory-palace integration. clippy --workspace --all-targets --all-features -D warnings clean on a pinned 1.96.0
toolchain (local == CI); ~280 workspace tests.

Added

MCP (Model Context Protocol)

• MCP client — connect to remote MCP servers over stdio (GG) and
  Streamable HTTP/SSE (II); their tools register into the catalogue as
  <server>__<tool> and are callable like any built-in.
• MCP server — aonyx mcp serve exposes Aonyx's own tools to other
  clients (Claude Code, Cursor, …) over stdio (HH). It now also serves the
  palace-backed memory_* tools scoped to the current directory (NN),
  and over a minimal Streamable HTTP transport via --port (OO),
  with optional bearer-token auth (--token / $AONYX_MCP_TOKEN)
  rejecting unauthorized HTTP requests with 401 (PP).

Built-in tools

• web_fetch (readability extraction) and web_search (Brave → Tavily
  fallback) (JJ, MM); web_fetch now extracts text from PDFs too
  (PP).
• memory_search / memory_diary_append / memory_kg_query — the agent
  reads and writes its own memory palace mid-turn (MM).

Sessions & providers

• /fork a session into a child branch (Z); auto-compact long sessions
  (BB); /retry the last turn (CC); /tree session genealogy (MM).
• /model and /provider live-switch (EE, LL); /provider persists the
  choice and remaps the model to the new provider's default when the
  active id doesn't fit (NN).

Vision & export

• Local @image references are downscaled to ≤1568px before being sent to
  a vision model, capping token cost (NN). Remote image URLs are
  fetched (and downscaled) into vision attachments too (OO).
• /export-html standalone styled HTML (FF); /export-bundle writes a
  .zip of Markdown + HTML + meta.json (NN), plus a messages.json
  transcript for re-import (OO). /import-bundle <zip> restores a
  session from that messages.json as a fresh, active session (PP).

Approval

• Per-tool always-allow: the approval overlay's [A] key remembers a
  destructive tool so future calls skip the prompt; persisted to config
  (OO). Rules also accept a name:needle arg-pattern form — e.g.
  bash:cargo auto-approves only cargo commands (PP).

Robustness & cost

• HTTP providers (Anthropic / OpenAI-compatible / Ollama) retry
  transient 429 / 5xx / network errors with exponential backoff (RR).
• Anthropic prompt-caching: the system prompt is sent as a cached
  block, cutting input-token cost across a session's turns (RR).
• /cost prints a detailed per-session token + USD breakdown (RR).

TUI

• /mcp panel lists connected MCP servers and toggles all of a server's
  tools at once (RR). /rename retitles the current session (RR).
  @glob refs (@src/**/*.rs) load every matching file (RR).

Skills & theming

• Custom skills loaded from ~/.aonyx/skills/ (DD); live theme editor
  /theme-edit (KK).

[0.2.0] — 2026-05-29 — the full-screen TUI

A 25-phase arc (B → Z) turning the line-based REPL into a full-screen
ratatui terminal UI with multimodal input, multi-session branching, a
memory-palace inspector, and live capability toggles. 185 workspace tests,
clippy --workspace -D warnings clean.

Launch with aonyx --tui. The legacy line REPL remains the default.

Added

Terminal UI (ratatui)

• Full-screen layout: scrollable conversation viewport, multi-line composer,
  status bar. Auto-scroll, animated braille spinner, 💭 thinking…
  placeholder.
• Markdown rendering in the viewport via tui-markdown, with a
  ratatui_core → ratatui colour converter. Rendered live during
  streaming — headings / bold / code light up as the model types.
• @path file references load files into the next turn's context;
  !cmd runs a local shell and feeds the output back.
• Fuzzy autocomplete popup (nucleo-matcher) for @ files, / commands,
  and /cmd <arg> argument completion (/themes, /load, /ingest,
  /undo).
• Inline composer syntax highlight: /cmd magenta, !bash yellow, chat
  default — recoloured on every keystroke.
• Ctrl+P fuzzy command palette over every slash command + theme.
• Mouse support: scroll wheel, single-click palette accept. /mouse
  toggles capture so the host terminal can do native drag-to-select + copy.
• Vim modal editing (/vim): Insert / Normal, j/k/g/G navigation.
• 4 bundled themes (/themes): default, catppuccin, dracula, gruvbox.
• Desktop notifications (notify-rust) on long-turn completion + errors.
• Token + USD cost estimator in the status bar (per-provider pricing table).

Multi-session

• SqliteSessionStore cross-run persistence at ~/.aonyx/sessions.db,
  auto-restore on startup.
• /sessions list, /new rotate, /find <query> full-text search across
  every session, /load <id-prefix> switch, /fork branch the current
  session into a child (parent_id tracked).

Floating panels

• /kg — memory-palace visualization: entities grouped by type, relations
  as src ──predicate──▶ dst.
• /tools — enable / disable registered tools live (shared ToolRegistry
  disabled-set).
• /skills — enable / disable loaded skills live (shared runner toggle set).
• /inspect — pretty-printed JSON of the last LLM request (base64 images
  elided).

Safety + memory

• Inline approval overlay: destructive fs_edit / fs_write / bash calls
  pause the runner for a [Y/n] decision (async AsyncApprover bridge).
• /undo [N|list] — revert the last N filesystem changes via a JSONL
  snapshot journal at <cwd>/.aonyx/undo.jsonl.
• /ingest <path> — chunk a local file (paragraph-aligned) into the project
  palace; searchable by the agent.

Multimodal

• @image.png rendered inline as a half-block Unicode thumbnail (works in
  any truecolor terminal, no Kitty / iTerm / Sixel dependency).
• Vision passthrough: images forwarded to Anthropic (image / source
  blocks) and OpenAI-compatible providers (image_url data URLs).
• Attachment::Image on Message, #[serde(default)] for backwards
  compatibility with existing persisted rows.

Changed

• ApprovalPolicy::allow is now async to support the interactive TUI
  approver.
• AgentRunner exposes shared handles: skill_toggle_handle(),
  last_request_handle().
• SessionStore gains search, find_by_id_prefix, and fork.
• ToolRegistry gains a shared disabled-set with disable / enable /
  toggle / is_disabled.

[0.1.0] — 2026-05-28 — pre-alpha foundations

This is the first release. Aonyx Agent runs end-to-end against Anthropic / OpenAI /
OpenRouter / Ollama / LM Studio with a working memory palace (Knowledge Graph,
diary, BM25 full-text search) and four built-in skills.

Added

Agent core

• aonyx-agent::AgentRunner — multi-turn loop with streaming, tool dispatch,
  ApprovalPolicy gate, per-turn iteration cap, skill activation, project context.
• ApprovalPolicy with AutoAllow, DenyDestructive (default), Custom(Arc<Fn>).
• ChatRequest / ChatChunk / ChatStream = BoxStream<'static, Result<ChatChunk>>
  shared types in aonyx-core.

Memory palace

• aonyx-memory::SqliteKgStore — Knowledge Graph with entity / relation
  temporal validity windows, idempotent migrations, indexes, 5 tests.
• aonyx-memory::SqliteDiaryStore — append-only narrative log per project.
• aonyx-memory::SqliteChunksStore — SQLite FTS5 BM25 search with
  unicode61 remove_diacritics 2 tokenizer.
• aonyx-memory::Palace — unified facade composing the three stores; open(dir)
  creates {kg.db, diary.db, chunks.db} layout under ./.aonyx/.
• MemoryStore::hybrid_search delegates to BM25 (FTS5). Vector layer
  (fastembed-rs + HNSW + RRF k=60) intentionally deferred to V1.1.

LLM providers

• aonyx-llm::anthropic::AnthropicProvider — native Messages API,
  streaming SSE, content_block_delta + message_stop events,
  system-message extraction.
• aonyx-llm::openai_compat::OpenAiCompatProvider — shared backend for every
  "speaks-OpenAI" endpoint. Optional Bearer auth, optional extra headers.
• aonyx-llm::openai::provider — OpenAI public API factory.
• aonyx-llm::openrouter::provider + provider_with_attribution —
  OpenRouter aggregator with optional HTTP-Referer / X-Title.
• aonyx-llm::lm_studio::provider — LM Studio with empty Bearer (no auth header).
• aonyx-llm::OllamaProvider — JSON-lines streaming from /api/chat.
• aonyx-llm::Router — fallback chain across providers with tracing::warn on each failure.

Tools (10 built-in handlers, registered by ToolRegistry::default_set())

• fs_read, fs_glob, fs_grep — Safe.
• fs_write, fs_edit — Destructive (must clear ApprovalPolicy).
• bash — Destructive; cmd /C on Windows, sh -c elsewhere; timeout via
  tokio::time::timeout; kill_on_drop.
• git_status, git_diff, git_log, git_show — Safe.

Skills

• aonyx-skills::SkillLoader — parses YAML frontmatter + markdown body from
  any SKILL.md / *.skill.md. Handles \n and \r\n line endings.
• aonyx-skills::SkillEngine — activates skills via case-insensitive keywords,
  query regex, project regex, always_on, or manual. Invalid regexes are
  silently skipped.
• aonyx-skills::builtin_skills() returns the four V1 built-ins embedded
  in the binary at compile time:
  code-review, doc-writer, data-analyst, incident-response.

CLI

• aonyx — opens an interactive REPL in the current dir.
• aonyx new <path> — same, scoped to <path>.
• aonyx config show / path — inspect ~/.aonyx/config.toml.
• aonyx memory stats — report kg / diary / chunk counts.
• aonyx memory search <query> — BM25 search across chunks.
• Slash commands inside a session: /quit /q /exit, /clear /reset, /help /?.
• First-run wizard writes ~/.aonyx/config.toml with sensible defaults.
• Environment fallbacks: ANTHROPIC_API_KEY, OPENAI_API_KEY,
  OPENROUTER_API_KEY.

Distribution

• MIT license, public repository at https://github.com/feiuz/aonyx-agent.
• CI matrix on Linux, macOS, Windows for format / clippy / test.
• Release pipeline (.github/workflows/release.yml) triggers on v*.*.*
  tags and produces static binaries for Linux x86_64, macOS x86_64 + arm64,
  Windows x86_64.
• release.toml for cargo-release automation; docs/releasing.md walkthrough.

Numbers

• 90 tests across 5 crates (8 agent + 26 llm + 22 memory + 14 tools + 13 skills + 7 cli).
• aonyx.exe release binary: 8.0 MB stripped.
• p50 cold start to interactive prompt: well under 1 s.

Known gaps (planned for V1.1+)

• Vector embeddings (fastembed-rs ONNX), HNSW index, RRF fusion, temporal boost.
• Tree-sitter code-aware chunk splitter.
• MCP client and server (aonyx-mcp crate is scaffolded but inert).
• Interactive approval prompt (CLI currently only supports DenyDestructive).
• Subagent spawning (aonyx-agent::subagent is scaffolded but inert).
• Telegram / Discord adapters (aonyx-adapters is scaffolded but inert).
• OpenAI-compatible HTTP server.
• tools blocks in OpenAI / Ollama provider payloads (text-only V1).

Full Changelog: v0.6.0...v0.7.0