Skip to content

v0.23.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 11:22
v0.23.0
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: BsdGvKi3Med56Wy4VisZQhWin20c4hORHHUxNM9bVlw
Verified
Learn about vigilant mode.
20ec140
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.23.0 adds a content-policy guardrail pipeline, human-in-the-loop tool approval, persistent AI sessions and agent runs, schema-validated structured outputs, and typed provider exceptions, alongside broad tool-egress hardening and a bilingual documentation site. Release work by @CybotTM.

Added

  • Content-policy guardrails — a pipeline that screens outgoing prompts and responses, audits streamed output at end-of-stream, and redacts live streams via a holdback buffer (@CybotTM, ADR-085, ADR-086, ADR-087, ADR-088, ADR-089).
  • Human-in-the-loop tool approval — the agent loop can suspend for a human decision and resume the run (@CybotTM, ADR-084).
  • Persistent AI sessions and memory (ADR-083) and durable agent-run persistence with a queryable event stream (@CybotTM, ADR-081).
  • Schema-validated structured outputs with automatic repair (@CybotTM, ADR-082).
  • Typed provider exceptions — ProviderAuthenticationException (HTTP 401) and ProviderRateLimitException (HTTP 429) (@CybotTM, ADR-080).
  • ToolLoopServiceInterface — downstream extensions can inject and test-double the tool loop (runLoop() / resume()) without depending on the final ToolLoopService (@CybotTM).
  • Bilingual GitHub Pages documentation site with ADRs, search, developer feature deep-dives (streaming/tools, RAG, providers), and on-device AI answers rendered as Markdown (@CybotTM).

Changed

  • On resume, the tool loop restores the suspended run's original allow-list and options and re-applies the tool gate (permission, global enablement, RBAC) to the pending calls, fail-closed (ADR-084).
  • Keep the system prompt on every turn and advance the run sequence on a failed turn.

Fixed

  • Harden provider response parsing against malformed and hostile upstreams, including typed guards for the DALL-E and DeepL response shapes.
  • Null-guard site-config key normalization; clamp maxRetries to its TCA upper bound.
  • Purge agent-run events by run id.

Security

  • Tool egress hardening: enforce FAL file-mount boundaries and backend language access in read tools, exclude workspace-draft references, and broaden the credential egress denylist (digit-suffix and concatenated secret columns, vault/FAL config, connection strings, apitoken, sk-proj- keys, and Composer auth.json in read_source).
  • Harden guardrail enforcement: no unredacted persistence, fail-closed verdicts, and vision screening.

Full changelog: v0.22.0...v0.23.0

Contributors

CybotTM
Assets 12
Loading