Skip to content

Prometheus v0.9.6

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Oct 19:23
· 220 commits to main since this release
v0.9.6
62ef860
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

/doctor stops printing secrets, a session's model choice survives any restart, and a telemetry write that fails no longer ends the turn. Read "Upgrading from 0.9.5" before you restart the daemon.

Security

  • oara doctor and the chat /doctor no longer print secrets (#627, #628). Their output goes to a terminal, a chat or CI logs, and none of those pass through log redaction.
    • The Telegram check says whether a bot token is set. It no longer shows the token's first and last four characters, which for a Telegram token are the bot id and part of the secret.
    • A config file that fails to parse is reported by error type and line and column only, never with text from the file. The daemon log does the same for the config-pins file.
    • The config-pins row never shows the value of a secret-named key, or of a key shaped like an HTTP header (authorization, x-api-key, cookie, proxy-authorization). It still says which key overrides the file.
    • Inference URLs are shown without a username, password or query string (user:pass@, ?api_key=). Requests still use the full URL, so authenticating proxies keep working.
    • A key pasted into api_key_env, which should hold the name of an environment variable, is no longer echoed. The row says what belongs there instead.
  • Dependency security updates (#629, #630, this PR).
    • The lock moves to pyjwt 2.15.1 and urllib3 2.8.0.
    • The mcp and full extras now require pyjwt>=2.15.1, so pip install -U replaces an older pyjwt instead of keeping it.

Models

  • A session's model choice survives any restart (#632). Before, a cloud choice (/claude, /qwen <model>, the Beacon picker) lived only in memory, and a plain restart quietly put the session back on the local model. Now every sticky choice, cloud or local backend, is stored with its session when it is made, and restored when the daemon starts.
    • If the chosen model or provider is gone from your config, the session gets the default model. The log has a WARNING naming the session, and the stored choice is deleted.
    • If the provider's key is missing, the session also gets the default and a WARNING, but the choice is kept. Set the key, restart, and the choice comes back.
    • /local is stored too, so the next start does not bring back the old choice.
    • Ephemeral sessions and the OpenAI-compatible /v1 API never store a choice.
  • The REST model picker honours router.overrides.enabled (#632). With overrides disabled it answers 403 to a new choice, as the chat commands already did. Going back to the default is never refused.
  • A bare off in adapter.model_tiers means off (#626). YAML reads an unquoted off (or no, or false) as false, so qwen: off was refused with an ERROR unless you quoted it. It now turns the adapter off. on, yes, true, numbers and empty values are still refused, and the ERROR says what YAML read.

Telemetry and learning

  • A telemetry write that fails no longer ends the turn (#634). It is logged as a WARNING and recorded in silent_failures, and the turn carries on. Before, a failed write ended the turn, and during a tool call it reported a successful call as failed.
  • The telemetry v2 schema (#634). telemetry.db gains three tables (turns, responses, tool_sets) and new columns on tool_calls. training.db gains new columns on training_pairs. Nothing writes to them yet; that comes in a later release. Free text in the new columns is redacted when written, and oara scrub covers it.
  • Coding runs capture repair pairs (#635). oara code runs in its own process and never opened training.db, so a local model's "failed validation, then got it right" sequences there were lost. They are now captured, following training.capture_enabled. If the store can't be opened, the run logs an error and still completes. The interactive CLI still does not capture.
  • The tool dashboard counts repairs correctly (#635). adapter_repairs counts calls the adapter repaired. Calls that failed validation and could not be repaired are now their own validation_failures count, shown in /tools. Before, they were counted as repairs.

Other

  • The model ladder (developer benchmarking only) now picks a model's adapter tier as the daemon does, and its judge setup is documented (#631, #633).
  • Docs found stale while checking 0.9.5 are corrected, including the client guide's advice on ordinal and message_id (#626).

Upgrading from 0.9.5

  • Re-pick cloud models once after the upgrade. 0.9.5 kept cloud choices only in memory, so the restart into 0.9.6 has nothing to restore and those sessions start on the default model. Choices made on 0.9.6 are stored. Local backend choices were already stored and carry over.
  • If you set router.overrides.enabled: false, Beacon's picker can now only go back to the default. A new choice gets a 403.
  • The schema changes are additive. schema_version stays 3, so a 0.9.5 binary still opens the files if you roll back.
  • pip install -U 'oara-prometheus[mcp]' (or [full]) now upgrades pyjwt to 2.15.1 or later.

Install

pip install -U oara-prometheus           # the daemon, its web API, the CLI and Telegram
pip install -U 'oara-prometheus[full]'   # adds Slack, Discord, MCP, the browser tool, Anthropic and voice output
brew upgrade oara                        # Homebrew on Apple Silicon; first install: brew install oaralabs/tap/oara

Python 3.11 or later. On PyPI: oara-prometheus 0.9.6.

Assets 4
Loading