agent-bom v0.104.0

Highlights

• Preserve live gateway activity through the production dashboard proxy and resume from the last event cursor after reconnect. Postgres identity upgrades add the managed-profile lookup while preserving legacy installations that have not provisioned identity storage.
• Upgrade the dashboard's YAML parser and image-processing dependencies to js-yaml 4.3.2 and sharp 0.35.4. Distribution freshness checks now pass their configured timeout and retry budget to the Glama probe.
• Preserve the imported report’s scan ID in finding links so investigation opens its persisted graph snapshot.

What's Changed

• chore(docker-mcp): pin the submission to v0.103.2 by @github-actions[bot] in #5056
• fix(deploy): supersede stale demo approvals by @msaad00 in #5058
• chore(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 in /ui by @dependabot[bot] in #5059
• fix(product): keep correlation proof truthful and reproducible by @msaad00 in #5062
• fix(cli): make first-run evidence resilient by @msaad00 in #5063
• fix(release): sign refreshed latest images by @msaad00 in #5064
• feat(graph): persist signed correlation receipts by @msaad00 in #5065
• fix(cli): verify quickstart runtime handoff by @msaad00 in #5067
• fix(cloud): bound and sanitize provider execution by @msaad00 in #5066
• chore(deps): bump lucide-react from 1.37.0 to 1.38.0 in /ui by @dependabot[bot] in #5068
• fix(release): refresh product screenshot provenance by @msaad00 in #5069
• feat(graph): harden durable correlation orchestration by @msaad00 in #5071
• fix(graph): focus correlation decisions and path proof by @msaad00 in #5072
• fix(ui): compact correlation path proof by @msaad00 in #5073
• fix(ci): restore main release gates by @msaad00 in #5077
• fix(ci): batch npm bulk advisory checks by @msaad00 in #5079
• fix(graph): honor non-traversable campaign edges by @msaad00 in #5081
• fix(mcp): use streamable HTTP for introspection by @msaad00 in #5082
• feat(evidence): add canonical truth dimensions by @msaad00 in #5080
• feat(graph): expose independent path evidence by @msaad00 in #5085
• fix(ci): restore bounded npm bulk advisory gate by @msaad00 in #5087
• fix(ci): enforce bounded npm advisory batches by @msaad00 in #5095
• fix(ci): require exact marketplace tool contracts by @msaad00 in #5097
• feat(identity): define provider-neutral join contract by @msaad00 in #5083
• feat(mcp): record protocol compatibility contract by @msaad00 in #5084
• chore(deps): consolidate routine dependency updates by @msaad00 in #5096
• fix(api): bind host discovery and UI scans to explicit scope by @msaad00 in #5098
• fix(postgres): keep role validation fail-closed across retries by @msaad00 in #5099
• fix(scan): retain explicit project IaC with no-discover by @msaad00 in #5100
• fix(mcp): enforce runtime evidence write authorization by @msaad00 in #5101
• fix(auth): honor explicit loopback bootstrap roles by @msaad00 in #5102
• fix(ui): honor the standalone runtime API destination by @msaad00 in #5103
• fix(graph): require complete path evidence by @msaad00 in #5104
• fix(evidence): preserve scoped graph proof and setup contracts by @msaad00 in #5106
• fix(ui): simplify investigation flow and evidence presentation by @msaad00 in #5107
• fix(ci): validate README contracts before merge by @msaad00 in #5109
• fix(registry): verify public schemas and migrate Smithery namespace by @msaad00 in #5110
• fix(registry): require schema evidence in daily monitors by @msaad00 in #5111
• fix(registry): verify complete Smithery public schemas by @msaad00 in #5112
• fix(mcp): default to focused task profiles by @msaad00 in #5113
• fix(auth): bind runtime ingestion to expiring source credentials by @msaad00 in #5114
• fix(ui): qualify correlation evidence claims by @msaad00 in #5115
• test(auth): stabilize future credential validation by @msaad00 in #5117
• fix(onboarding): unify the first scan contract by @msaad00 in #5118
• fix(delivery): align container and CI execution contracts by @msaad00 in #5120
• fix(ui): make first-use navigation accessible by @msaad00 in #5119
• docs(product): clarify graph scope and compliance evidence by @msaad00 in #5121
• fix(api): protect control-plane availability and disable production docs by @msaad00 in #5122
• fix(ci): stabilize proof generation across Python and SQLite runtimes by @msaad00 in #5124
• docs(product): show reproducible human and agent workflows by @msaad00 in #5125
• fix(ui): clarify evidence-driven investigation and overview by @msaad00 in #5127
• fix(quickstart): verify freshness at persisted timestamp precision by @msaad00 in #5126
• fix(graph): preserve imported SBOM provenance by @msaad00 in #5129
• fix(auth): disable unapproved embedded OAuth token issuance by @msaad00 in #5128
• fix(inventory): preserve identity and snapshot consistency by @msaad00 in #5130
• fix(graph): bind skill findings to their source owner by @msaad00 in #5144
• fix(ui): align overview evidence and status readability by @msaad00 in #5131
• fix(api): align listener and storage diagnostics by @msaad00 in #5132
• fix(graph): preserve readable finding groups and navigation by @msaad00 in #5133
• chore: sync MCP registry — 10 new, 0 trust corrections, 11 versions, 0 CVE updates by @github-actions[bot] in #5142
• chore(deps): consolidate UI dependency updates by @msaad00 in #5145
• fix(ui): preserve operational evidence and setup interactions by @msaad00 in #5149
• fix(perf): count completed Postgres benchmark operations by @msaad00 in #5146
• chore(deps): consolidate core dependency maintenance by @msaad00 in #5148
• fix(ui): consolidate overview layout and graph navigation by @msaad00 in #5150
• fix(findings): preserve observation anchors and SLA deadlines by @msaad00 in #5152
• docs(readme): lead with a visible CLI demo and concise first run by @msaad00 in #5153
• fix(ui): clarify finding evidence and configured agent relationships by @msaad00 in #5155
• fix(runtime): bound configured MCP and gateway credentials by @msaad00 in #5154
• fix(ui): polish overview coverage and investigation layouts by @msaad00 in #5157
• fix(cwpp): preserve retry scope and cleanup recovery evidence by @msaad00 in #5156
• fix(runtime): preserve producer assurance and stable receipt evidence by @msaad00 in #5159
• fix(finops): aggregate complete tenant cost totals and qualify history by @msaad00 in #5158
• fix(workflows): qualify AI spend and preserve Skills scan scope by @msaad00 in #5160
• chore(release): prepare 0.104.0 by @msaad00 in #5161
• chore(deps): consolidate UI dependency updates by @msaad00 in #5168
• chore(deps): consolidate routine updates into a weekly batch by @msaad00 in #5169
• fix(release): preserve evidence across scans, investigations and audit by @msaad00 in #5164
• feat(runtime): stream resumable gateway activity by @msaad00 in #5170
• feat(runtime): add managed profile clients and checkpointed feed CLI by @msaad00 in #5173
• fix(ci): recognize current Glama release listing markup by @msaad00 in #5172
• feat(runtime): manage profiles and resume dashboard activity by @msaad00 in #5174
• fix(runtime): complete reconnect proof and Findings tour by @msaad00 in #5177
• fix(ci): honor Glama freshness probe retry settings by @msaad00 in #5179
• fix(ci): retain failed distribution listing evidence by @msaad00 in #5181
• docs(release): complete 0.104.0 runtime and security notes by @msaad00 in #5182
• fix(ci): verify catalog wording and deduplicate recurring alerts by @msaad00 in #5185

Full Changelog: v0.103.2...v0.104.0