v0.29.1

Highlights

One security fix, and a docblock correction about the same subsystem.

A resumed run could execute a write nobody had approved. When a run pauses to ask a person for typed input, resuming it re-checks which tools are permitted against the current configuration — deliberately, so a tool disabled while the run waited is not executed. The same re-check widened the set in the other direction: a write tool enabled while the run waited became permitted at resume and ran, having passed no approval at any stage. An input submission is not an approval.

Reaching it took two things together: the model naming a tool it had not been offered, and an operator switching that tool on while a run sat suspended — which is what configuring an installation looks like. Reported by @CybotTM while auditing whether update_page_metadata was safe to enable on a publicly reachable demo, fixed in #753.

The resume path now refuses such a call outright rather than pausing for approval. The model asks again in a fresh turn, that turn goes through the normal approval check, and the run suspends for a real approval. Nothing changes for a run that suspended normally: the approval check already runs first, so the case cannot arise there.

And the documentation that would have answered the question in the first place. UpdatePageMetadataTool and SetFileAlternativeTextTool both told readers the write fence did not cover them — true when written, and no longer true since every executing segment claims a lease. The docblocks now say the fence does cover them and point at the record that changed it, so the next person deciding whether a writing tool is safe to enable does not have to trace the call graph to find out. Reported and fixed by @CybotTM in #755.

Upgrading

No configuration change, no migration, no signature change — the frozen @api surface is identical to v0.29.0. If you run agent tools that require approval, and you toggle tools while runs are in flight, upgrade.

Full Changelog: v0.29.0...v0.29.1

Installation

composer require netresearch/nr-llm

Publication status

• TER: extensions.typo3.org/extension/nr_llm — 0.29.1 verified
• Packagist: packagist.org/packages/netresearch/nr-llm — 0.29.1 verified
• Documentation: docs.typo3.org/p/netresearch/nr-llm/0.29/en-us/ — render verified

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-llm-0.29.1.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-llm-0.29.1.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.