Skip to content

0.9.0 — 2026-05-04

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 May 16:32
v0.9.0
bc831cc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

Initial public pre-1.0 release. Extracted from Mentiora's code-pipeline
project after 23 rounds of GA-driven hardening. See the README's
Status matrix for which surfaces are stable;
deterministic replay and web.click remain Beta until AC-SHCRT-08 and
AC-CLICK-* land.

Added

  • Determinism harness. Math.random() (sfc32-seeded) and
    Date.now() / performance.now() (session-fixed epoch_ms) are
    pinned at session-create time and reproduced bit-for-bit on replay
    via the manifest's started_at_ms.
  • Implicit session management in loom-mcp serve. MCP clients
    call loom.web.navigate with just url — the server lazily creates
    a session on first tool call and closes it on shutdown.
  • Path-traversal-safe session IDs. All five core_api_facade
    paths reject anything that isn't a 26-char lowercase-alphanumeric
    ULID. Prevents file-disclosure via session.inspect '../evil'.
  • Typed error mapping. kind: "http_status" (with status code) for
    4xx/5xx responses, kind: "wait_predicate_false" for web.wait
    selector misses, kind: "schema_violation" for unsupported export
    formats with the actual supported list in the message.
  • Chromium subprocess crash detection. ChromiumSupervisor now
    spawns a tokio task that awaits child.wait(); the moment chromium
    dies, the shim self-exits → daemon's crash watcher fires → in-flight
    CDP commands fail in <1s instead of waiting the 30s recv timeout.
  • GC reference protection. collect_referenced_blobs decodes
    receipt_canonical_bytes byte arrays and recursively scans for hex
    hashes, so loom gc --ttl 0 no longer deletes blobs that active
    sessions still reference.
  • Stable session listing. loom session list is now sorted by
    created_at_ms descending with session_id as tiebreak — independent
    of filesystem read_dir order.
  • Aborted-session replay refused. Replaying an aborted or crashed
    source session now returns a typed SessionAborted error instead of
    silently producing a session that "replayed" an abandoned trace.
  • import.playwright RPC. Wires the existing PlaywrightImporter
    through CoreFacadeBridge, CoreServiceAdapter, RpcHandlers, and
    the request_router. loom import playwright trace.zip now works
    end-to-end.
  • Schema-aware CLI coercion. loom action web.type --text 5551234
    no longer fails with "5551234 is not of type 'string'" — the parser
    consults the action's request schema and coerces per declared type.
  • Module file naming. Renamed every <module>/interfaces.rs to
    <module>/<module>.rs. The interfaces.rs convention was a Phase 5
    pipeline artifact; runtime files now match the module they live in.

Fixed

  • web.wait was a no-op — it dispatched a single Runtime.evaluate
    predicate but never checked the result, so missing selectors
    returned success in 1 tick. Now surfaces wait_predicate_false
    with selector did not appear before timeout.
  • HTTP 4xx/5xx responses with ERR_HTTP_RESPONSE_CODE_FAILURE were
    classified as generic network_error losing the status code; now
    the host's typed-error builder prefers status >= 400 events
    before error_reason events.
  • --budget network=0 and wall_clock=0s accepted silently (0
    internally meant "unlimited"); now rejected at parse time.
  • Profile help text claimed safe, default were valid profiles; the
    daemon's allowlist is safe, standard, full. Help text fixed.
  • Date.now() / Math.random() leaked real wall-clock + unseeded
    values when called via web.evaluate before any web.navigate.
    Root cause: chromium's bootstrap about:blank context never had the
    determinism script applied. Fixed by lazy-spawning the
    determinism-injected target on the first evaluate.

Install loom-cli 0.9.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mentiora-ai/loom/releases/download/v0.9.0/loom-cli-installer.sh | sh

Install prebuilt binaries via Homebrew

brew install mentiora-ai/loom/loom

Download loom-cli 0.9.0

File Platform Checksum
loom-cli-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
loom-cli-x86_64-apple-darwin.tar.xz Intel macOS checksum
loom-cli-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
loom-cli-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
Assets 16
Loading