v0.30.0

Task History, Vector Search, and Cross-Platform Stability

Knowns v0.30.0 is a major release that introduces task version history and time travel, Qdrant vector search integration, and comprehensive cross-platform stability fixes for Windows and Linux.

This release also includes significant security hardening across filesystem access, code mutations, browser exposure, and outbound integrations.

Added

• Task Version History: Full version history tracking for tasks with JSONL storage format, enabling time travel and audit trails.
• Qdrant Vector Search: Native integration with Qdrant vector database for semantic search across tasks and documentation.
• History Pagination UI: New frontend UI for browsing task revision history with detailed diff views.
• Lifecycle Endpoints: RESTful API endpoints for task history and lifecycle operations.
• Runtime Reconciliation: Automatic reconciliation system for runtime state consistency.
• Reload & Watcher: Hot reload support with filesystem watchers for runtime components.
• Transaction System: Transactional storage layer for atomic multi-step operations.

Fixed

• Hash Mismatch Bug: Resolved task canonical hash mismatch during replay caused by inconsistent JSON structure between write and replay paths (structs vs maps). Applied triple JSON round-trip normalization and excluded timestamps from canonical hash computation.
• Windows File URL Paths: Fixed file:// URL path conversion on Windows where /C:/path was incorrectly joined, creating invalid \C:/path. Now properly strips leading slash on Windows.
• Windows Permission Tests: Resolved permission test failures by rejecting Unix paths in safepath.Resolve and skipping platform-specific tests appropriately.
• Windows Directory Sync: Tightened directory sync check to strict errno == 5 instead of broad string matching, eliminating false positives.
• Ubuntu Race Condition: Fixed race condition in TestTaskAutoArchiveSweeperRunsBoundedStartupSweepWithoutPurge by adding 50ms wait after cancel.
• Qdrant URL Validation: Fixed validation logic to check scheme first before validating userinfo/query/fragment, preventing premature rejections.
• Async Lifecycle Indexing: Made task lifecycle indexing asynchronous to prevent blocking on mutations.
• Missing Lifecycle State: Added guards for missing lifecycle state to prevent nil pointer panics.
• Update Notice Output: Fixed spurious update notice output in CLI.

Security

This release addresses 8 security vulnerabilities (4 Critical, 4 High severity) affecting versions ≤ 0.29.1:

• GHSA-wh3c-v55g-qfg8 (Critical): Unauthenticated Remote Code Execution via REST API Path Traversal + LSP Binary Override
• GHSA-w323-3wpx-f7g5 (Critical): MCP Permission Guard Bypass: code.replace (CapRead) Self-Grants Delete
• GHSA-fc85-99vc-9c75 (Critical): Insecure Default Configuration leads to Unauthenticated Management API Exposure on All Interfaces
• GHSA-f539-xgc6-xw7q (High): Authorization Bypass and Path Traversal in code.replace allows Arbitrary File Overwrite
• GHSA-qx9v-m9gg-p5jg (High): Multiple Server-Side Request Forgery (SSRF) Vectors allowing Internal Reachability Oracle and Arbitrary Proxying
• GHSA-mc52-mwq4-vfx3 (High): OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
• GHSA-fpxv-c555-rhm3 (High): Arbitrary File Read via POST /api/templates/preview templateFile
• GHSA-9gfj-28hw-jchp (High): Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Mitigations applied:

• Blocked Import/LSP RCE Paths: Hardened import and language server protocol execution to prevent remote code execution.
• Filesystem Path Containment: Secured filesystem access with strict path validation and containment.
• Code Mutation Guards: Added comprehensive guards around code mutation operations.
• Browser Exposure Security: Secured browser dashboard exposure with proper authentication and authorization.
• Outbound Integration Hardening: Hardened all outbound integrations with strict validation and rate limiting.

⚠️ Users on versions ≤ 0.29.1 should upgrade immediately.

Changed

• Portable Skill Contracts: Refactored skill system to use portable, language-agnostic contracts.
• Compact Runtime Output: Polished runtime process output for better readability and reduced noise.
• Enhanced CLI Views: Improved task and document CLI views with better formatting and information density.
• Time Tracking Enhancements: Enhanced time tracking service with better state management and validation.
• Semantic Runtime Readiness: Added readiness checks to semantic search runtime for better reliability.

Documentation

• README Sponsor Section: Added sponsor section with contribution information.
• Security Policy: Revised SECURITY.md for clarity and completeness.

Upgrade

npm install -g knowns@0.30.0

Other installation methods and platform binaries are available in the assets below.

Validation

• ✅ All unit tests pass on macOS, Linux, and Windows
• ✅ Full integration test suite passes
• ✅ Cross-platform CI validation on Ubuntu and Windows
• ✅ Production UI build completes successfully
• ✅ Clean merge into main with no conflicts

Breaking Changes

None. This release maintains backward compatibility with v0.29.x.

Contributors

@howznguyen

Included pull request: #140

Full Changelog: v0.29.1...v0.30.0