Skip to content

v0.227.1 — 2026-07-12 — Apollo · Evans

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 15:06
· 89 commits to main since this release
v0.227.1
356a924

Production truth release

v0.227.1 is the published artifact for this release line. The v0.227.0 tag was deliberately stopped before npm publication and GitHub Release creation when the real Linux release gate exposed host-dependent tests; no 0.227.0 npm package exists.

Reliability and security

  • Unified Node HTTP execution behind one same-package Undici fetch + dispatcher owner across pipelines, OAuth, downloads, extraction, cascade, and public HTTP transport. Proxy and NO_PROXY behavior are locked by a real local-proxy regression on Node 22/24.
  • Replaced hidden repair mutation with a bounded, shell-free exact-command verifier. Child envelope truth, oracle evidence, and process exit code now agree; network/auth/rate-limit failures no longer tell agents to edit adapters.
  • Made browser/CDP cookie acquisition memory-only by default. Explicit POSIX persistence is atomic, rejects symlinks, and enforces 0700 directories plus 0600 files; empty export fails with auth_required instead of false success.
  • Removed the reported production dependency advisories, detached the correctly scoped npm update check from foreground CLI lifetime, and made security/privacy claims executable release checks.

Architecture and evidence

  • Bounded the executable action surface at 105 exact owners: 50 registered composition actions plus 55 transport-native actions. Catalog, docs, MCP metadata, and runtime must agree.
  • Separated fixture-shape, deterministic integration, live endpoint, authenticated-browser, cold-start, and warm-start evidence. Inventory count is not operational-health evidence.
  • Made generated test inventory, profile-seed manifests, browser simulations, and Git reference fixtures stable across Linux, macOS, and Windows.

Verified publication

  • Exact release-commit CI: Linux Node 22/24, Windows Node 22, macOS, and all three Rust sidecar jobs passed.
  • Trusted publication workflow: canonical verify, zero-vulnerability production audit, metadata gate, pack, npm provenance publish, and GitHub Release all passed.
  • Canonical local gate: 250 unit files (2,807 passed, 2 skipped), 11 integration files (21 passed, 7 credential-gated skips), 170 adapter files (6,467 passed), plus performance, coverage, stats, truth, conformance, export, changeset, and public-boundary checks.
  • Registry artifact: 3,890 files, 14,257,888 bytes unpacked, SHA-1 ec1c7e5562c58076af171d92b09aa279a918bcd8, SLSA provenance present. A clean registry install passed live Hacker News, dead-proxy exit 75, repair truth, and registry signature/attestation verification.

Full changelog · Compare v0.227.0...v0.227.1 · npm package

Assets 2
Loading