Skip to content

ChannelGate 0.5.7

Choose a tag to compare

View all tags
@makeitfutureDev makeitfutureDev released this 25 Sep 19:51
· 411 commits to main since this release
v0.5.7
7115d3e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ChannelGate 0.5.7 — the HTTP run API now works like an admin's message in its channel.

Highlights

  • API runs work like an admin's message. The run API key is an admin credential. Every POST /api/runs turn acts as one fixed api principal. It gets the channel's mode like an admin's message would, including Auto and, in an Admin channel, the permission bypass for a Full run. It also gets channel memory (search, read, save and the post-reply memory review), the organization's and channel's skills and secrets, the channel folder, MCP connections, and the gateway tools, including the admin ones. Before this release every gateway tool was refused to API runs, so Auto mode, memory and approvals never applied.
  • No personal scope. An API run uses the channel's shared agent Composio account only. It gets nobody's personal Composio or Toolbox token, secrets, skills or SSH keys. The author a request names is attribution only, and naming a real admin never lends that admin's rank. Background work and schedules an API run starts are owned by api too.
  • API runs join their thread's queue. A Slack follow-up in a channel-backed API thread gets the usual Steer / Queue / Cancel choice instead of running concurrently on the same session, and a Slack stop or steer stops the API run.
  • A per-run mode no longer rebuilds the channel's container. On an Admin channel with host-home sharing on, a read/worker/auto/lean API run dropped the home mount, waited for every run inside, and recreated the container, killing detached jobs. The next ordinary turn then recreated it back. The mode now narrows tools only.
  • resumeCommand from the API opens the session inside the channel's container, like the Slack Resume control.

The runtime image is unchanged from 0.5.6. Full list: CHANGELOG.md.

Upgrade
scripts/update.sh (or the Enterprise automatic updater) from 0.5.6. No migration and no image rebuild are needed. Automations that call /api/runs now run with admin rank in the target channel. Keep the run API key as secret as the admin password.

Evidence

  • Release evidence workflow: https://github.com/makeitfutureDev/channelgate/actions/runs/36180787351
  • Verify downloaded artifacts: sha256sum -c SHA256SUMS and gh attestation verify <artifact> --repo makeitfutureDev/channelgate
  • Automated gate on the exact candidate: 2906 tests passed, 0 failed; static, secret-scan, security-coverage, npm audit and DCO clean; CI green. The live Claude/Codex acceptance cases for the API changes (TEST-PLAN.md, "HTTP run API channel parity") had not run at the cut.
Assets 2
Loading