Skip to content

Prometheus v0.9.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Sep 00:14
· 271 commits to main since this release
v0.9.4
07921f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security fix for Mac users, plus fixes for hooks, Ollama, routing and installed copies. Upgrading is recommended, especially on macOS.

Security fix for Mac users

  • Protected credential paths could be reached by a case variant on macOS (#578). macOS treats ~/.SSH/id_rsa and ~/.ssh/id_rsa as one file, but Prometheus compared spellings, so ~/.SSH/id_rsa and ~/.config/app/.ENV got past the built-in deny list. Paths written through the /etc, /tmp and /var symlinks got past the workspace, search, rm -r and sandbox guards the same way. Every guard now decides by what the path is: symlinks resolved, and names compared the way the volume compares them. On Linux, where the filesystem distinguishes case, a case variant is a different directory and nothing changes.
  • The download tool could write into protected directories on macOS (#574). /etc is a symlink to /private/etc there, so the guard on /etc, ~/.ssh and the other protected directories never fired, and case variants and firmlink spellings got through too. It now refuses every spelling, including a ~/.SSH that does not exist yet.

Hooks

  • A hook's timeout now stops what the hook started (#576). A command hook that timed out left whatever it had launched running, and the tool call waited for it; an HTTP hook that trickled bytes ran past its deadline and reported success. A timeout now ends the hook's whole process group, an HTTP hook's timeout is a total deadline, and both count as a failed hook.
  • Prompt and agent hooks honor their timeout and can no longer crash a tool call (#571). A stalled model stalled the tool call, and an error surfaced as "Tool X raised an exception" after the tool had already run. Both now become a failed hook result that respects block_on_failure.
  • Command hooks get a minimal environment (#571). They inherited the daemon's whole environment, provider API keys and the API token included. They now see PATH, HOME, USER, LANG, LC_*, TMPDIR and SHELL, the event's payload, and any name listed in the hook's new env_allowlist. If a hook needs another variable, list it there; oara doctor shows each hook's allowlist.
  • The hook contract is written down in docs/contracts/hooks.md (#566).

Models and routing

  • Ollama turns record their token usage and respect the length limit (#577). Prometheus never asked Ollama's OpenAI-compatible endpoint for usage, so every Ollama round logged 0 tokens, and it sent the length limit in a field that endpoint ignores, so replies ran unbounded. Usage counts need Ollama 0.5.2 or later; older servers keep working.
  • Two task rules that name the same model on different hosts no longer share a provider (#569). The second rule's requests went to the first rule's host, with that rule's API key, so a task meant for one host could reach another. Each rule now gets its own.
  • The model is told which provider and model it is (#580). The identity line at the top of every turn said "provider: unknown" and gave the model file's full path. It now reads, for example, "Qwen3.8-27B-UD-Q4_K_XL (provider: llama_cpp)", the same at boot and after routing.
  • Installed copies give local models their real adapter tier (#573). The registry that says which local models have native tool calling shipped only in git checkouts, so every pip and Homebrew install silently ran every local model at the heavier "full" tier. It is now in the wheel, and a missing registry is a warning.

macOS fixes

  • Agent tasks start on a Mac (#575). Tasks ran python -m prometheus, and a Mac has no python on PATH. They now use the interpreter Prometheus runs in.
  • A stale daemon lock no longer blocks startup on macOS (#575). After a crash, a lock whose PID had been reused by any process said "Daemon appears to be running" until deleted by hand. macOS now checks the process's real start time. Lock files stay readable by older releases.

Also

  • httpcore 1.0.9 or later is a declared dependency; it was already installed with httpx (#576).
  • CI runs the test suite on macOS with Python 3.14, what Homebrew installs (#572); a replay harness catches unintended behavior changes in CI (#568); the routing step moved into its own module with no behavior change (#570); a test no longer launched a stray interpreter (#579).
  • Docs: Prometheus is described as an AI agent daemon that runs on hardware you own (#565), and the Homebrew install notes are current (#562, #564).

Known issue

  • On Intel Macs, pip builds cryptography from source, because its releases since 49.0 ship no Intel-Mac wheel. That needs Rust and OpenSSL; with Homebrew's OpenSSL, set OPENSSL_DIR=$(brew --prefix openssl@3). On Python 3.14, watchdog also builds from source, which needs Xcode's command-line tools.

Install

pip install -U oara-prometheus           # the daemon, its web API, the CLI and Telegram
pip install -U 'oara-prometheus[full]'   # adds Slack, Discord, MCP, the browser tool, Anthropic and voice output
brew upgrade oara                        # Homebrew on Apple Silicon; first install: brew install oaralabs/tap/oara

Python 3.11 or later. On PyPI: oara-prometheus 0.9.4.

Assets 4
Loading