v0.11.1 — dependency security pass

Patch release.

• npm audit fix (#339): 12 production advisories cleared with non-breaking transitive bumps — ws, axios, form-data, @xmldom/xmldom, protobufjs, hono, fast-uri, and others.
• xlsx → SheetJS vendor CDN tarball 0.20.3 (#339): the npm xlsx line is abandoned at 0.18.5 with unfixed prototype-pollution + ReDoS advisories; the vendor tarball closes both. Relevant because file-processor.ts parses user-uploaded spreadsheets.
• Dependabot enabled (#340 + repo settings): vulnerability alerts, security-fix PRs, and weekly grouped version-update PRs.

Remaining known advisories are tracked deliberately (four 0.x-major SDK bumps + one parent-pinned transitive) — see KPR-366.

Upgrade: hive update --tag=v0.11.1 (per instance).

v0.11.0 — provider-agnostic runtime (KPR-345)

Minor release — the multi-provider runtime epic.

KPR-345: Provider-agnostic runtime (#337)

Hive agents are now genuinely reassignable off Anthropic:

• Lane A passthrough — kimi/… and deepseek/… route through the full Claude runtime (tools, skills, memory, hooks, resume) against vendor Anthropic-compatible endpoints, with per-spawn credential resolution and route-keyed ops attribution.
• Lane B native adapters — openai/…, gemini/…, codex/… execute real hive tools through a fail-closed ToolBridge (MCP + in-process + builtin executor + guardrail gate), with shared prompt-assembly parity (memory, skills), per-provider durable resume (openai previous_response_id, gemini previous_interaction_id, codex hive-persisted stateless replay incl. encrypted reasoning), and delegate subagents via a Claude-identical Task tool.
• Production-validated on the codex surface (keepur/Luna flagship arc).
• Public parity matrix: docs/providers.md — the supported-provider ruling, per-column caveats, nothing silently dropped.

Also in this release:

• fix(slack): download file content from snippets and attachments (#324)

Upgrade: hive update --tag=v0.11.0 (per-instance).

v0.8.3

Patch release that hardens legacy double-skills projection loading so broken workflow sibling paths warn instead of aborting startup.

v0.8.2 — doctor and legacy skills fixes

Summary

• Fix hive doctor home resolution for instance installs, including nested service paths and --instance handling.
• Fix legacy double-skills layout loading so multiple skills under the same workflow no longer collide or silently clobber each other.
• Preserve legacy workflow-level sibling assets in per-skill projections so shared helpers/templates remain reachable.

Verification

• PR CI passed for #286.
• Local npm run check passed: 115 files, 1546 tests.

Included PRs

• #284 — doctor home resolution for instance installs
• #285 — legacy double-skills loader collision fix
• #286 — release version bump

v0.8.1 — token usage stabilization hotfix

Summary

• Prevent status/health memory writes from invalidating prompt prefix caches.
• Add autoDream safeguards: in-flight guard, quiet-period/new-memory thresholds, cooldown state, and run/call budget knobs.
• Stop auto-injecting the Slack MCP into every parent agent turn.
• Include regression hardening for the agent runner Slack env test path.

Verification

• PR CI passed for #283.
• Local SLACK_APP_TOKEN=xapp-test SLACK_BOT_TOKEN=xoxb-test npm run check passed.

Note

The GitHub release/tag is cut. npm publishing is currently blocked by registry auth/scope: the publish workflow passes checks/build/pack and fails at npm publish with npm E404 for @keepur/hive@0.8.1.

v0.8.0 — plugin manifest HTTP transport

Highlights

Plugin manifest now supports remote HTTP MCP servers (#273, KPR-236).

Until now, every plugin MCP server had to be a Node stdio subprocess with a compiled entry. With v0.8.0, a plugin.yaml entry can declare transport: http and point at any remote MCP server — the engine handles per-request authentication with the same per-agent key it already plumbs into stdio plugins as TASK_LEDGER_API_KEY. No new credential ceremony, no local shim.

mcp-servers:
  purchasing:
    transport: http
    url: https://app.example.com/mcp/purchasing
    description: "Purchasing operations — what's due, what's blocked"
    auth:
      type: api-key            # or "bearer"
      header: x-api-key        # optional; defaults: x-api-key (api-key) / Authorization (bearer)
      key-source: agentApiKey  # resolves config.taskLedger.agentKeys[agentId] ?? apiKey

What this unlocks

Operator plugins can register against remote MCP servers — including domain-specific operation-level MCPs built on the operator's own infrastructure — without writing a stdio wrapper. The motivating consumer is @keepur/hive-plugin-dodi consuming dodi's new /mcp/purchasing capability server directly.

Backward compatibility

Fully backward-compatible. Existing manifests work unchanged — transport defaults to "stdio" and every existing field is preserved. No DB migration. No config change required for any deployed instance.

Other changes

• Defensive plugin loading: a single malformed plugin manifest now skips with a logged error instead of crashing the loader. One bad plugin no longer takes down the engine startup.
• Parse-time validation for http entries: missing url, missing auth, empty auth.header, unknown auth.type, and unknown keySource are all rejected at load time with clear errors.
• instance-capabilities honesty: http servers are classified as configured only when at least one per-agent key (or the global apiKey) is set — prevents the agent's toolkit section from advertising a server the runtime will skip.

Migration notes

None required. Adopt the new transport: http shape in your plugin manifest when you want to point at a remote MCP server; otherwise no action needed.

Pull requests

• #273 — KPR-236: plugin manifest HTTP transport
• #277 — release: v0.8.0

Install

npm install @keepur/hive@0.8.0
# or
hive update --tag=v0.8.0