Reroute 0.4.0

Reroute 0.4.0

Daily-use release

Install once globally with pi install npm:@onedotmint/reroute@0.4.0, configure accounts through /reroute → masked terminal setup, and reuse defaults across projects. A project needs explicit one-time source-upload/execution consent before its first remote task; account spending policy remains a separate gate.

Changes

• User-level provider accounts, compute defaults, budgets and execution settings; optional simple project overrides. Existing v3 project configuration remains supported and is not automatically migrated, overwritten or deleted. Existing projects need the new one-time consent.
• Global/project native Pi packages coexist without duplicate tool registration, including reload. Ordinary Pi/AFT Bash remains unchanged; the model chooses heavy work directly through reroute_run.
• SDK source transfers use a verified manifest-indexed gzip stream instead of per-file uploads. Unchanged and one-file Daytona transfers reuse its verified baseline; Modal retains its release/recreate policy and download-cache persistence.
• Native progress and measured phase timings, separate task/status uncertainty, recent project jobs, provider defaults and local cost estimates.
• Static npm/pnpm/Yarn/Bun/Rust/Python environment hints; npm-shrinkwrap.json bootstrap/cache identity support and version-declaration cache keys.
• Modal image PATH preservation, narrowly validated Volume mount aliases, private identity/config/state exclusions, and existing ownership/descendant/cache safety protections.

Acceptance

The release runtime is derived from frozen candidate SHA-256 de62f3837d6c941488f4f50304fbb06b3a8229a772e052f35707eb38b9460e31. Release-only changes are version metadata, CLI help strings and documentation; no cloud execution logic is changed for release.

• 262 automated checks, strict types/build and CLI smoke passed with real Pi 1.4/AFT 0.62 coexistence.
• Frozen package global installation/consent acceptance: 13/13 groups passed.
• Daytona and Modal: four real scenarios per provider passed, including source integrity, warm downloads, intentional exit 7, project isolation and resource cleanup.
• Real model: six selection categories have successful evidence after an independently authorized light-fixture correction; 15 total requests, no automatic retry. This used an isolated local Provider, not autonomous model-to-paid-cloud execution.

Original harness failures and later authorized rechecks remain recorded. See full acceptance for exact scope, timings, artifact identities and residual resources.

Known limits

Local budgets are estimates, not provider billing caps. Tiny remote tasks still incur substantial startup/transport overhead. No controlled historical speedup factor, production SLA, broad fault-recovery certification or universal model-selection accuracy is claimed. Unknown jobs may need manual provider verification; no local retry is automatic. Modal releases compute after confirmed jobs but keeps storage by design. Three empty test Apps remain from acceptance because the installed public JS SDK lacks App deletion; all new test Volumes were deleted and compute terminated. Keys saved by Reroute use private permissions, not encrypted keychain storage.

Reroute 0.3.1 preview patch

Reroute 0.3.1 preview patch

A Modal reliability and dependency-security maintenance patch for @onedotmint/reroute. The CLI command remains reroute.

Install / update

Use a security-patched Node.js release satisfying ^22.23.4 || ^24.22.1 || >=26.12.1 and restart Pi after updating its runtime or extensions.

# Recommended: project-local Pi extension
pi install -l npm:@onedotmint/reroute@0.3.1

# Optional standalone CLI for masked setup and diagnostics
npm install -g @onedotmint/reroute@0.3.1

Review and approve project trust, then run /reroute. The standalone CLI does not install the Pi extension or change Pi settings. Do not install the unrelated unscoped reroute package. Updating this npm package does not update the Node process running Pi or existing cloud images.

Changes

• Accept the narrowly validated Modal Volume mount alias while retaining archive/member/source/artifact symlink checks. Download archives can persist across fresh Sandbox lifetimes.
• Use a non-login Modal shell so login profiles do not discard image-supplied Rust/toolchain PATH. The image recipe and Daytona provider implementation are unchanged.
• Update Daytona SDK 0.223.1 → 0.226.0, removing the known vulnerable fast-glob/micromatch/braces chain through upstream's tinyglobby replacement. Update Modal 0.11.0 → 0.11.1, ignore 7.0.12 → 7.0.13 and the compatible transitive Undici patch.
• Require patched supported Node lines, align doctor checks, pin the development runtime and CI versions, and add dependency/runtime-policy regressions.

The dependency refresh recorded zero known npm vulnerabilities at verification time, 279 verified registry signatures and 95 verified attestations. These are point-in-time findings, not a complete code, host or supply-chain audit.

Exact source and verification

• Source/tag target: 6753ffd4c25b909c5fc085256f3aba7e1d852c2a on rebuild/0.3-native, not the repository's older main branch.
• Fresh full CI re-verification: https://github.com/onedotmint/Reroute/actions/runs/39942759623/attempts/2
• Node 22.23.4 and 24.22.1 each passed strict typecheck/build, 204 tests / 0 failures / 0 skips, real localhost OpenSSH/rsync acceptance, offline CLI smoke, benchmark and clean-prefix package installation.
• Actual pinned AFT coexistence tests ran; exact-commit Pi Git install/trust/load/remove passed on Node 22 (intentionally only that matrix).
• Both Node jobs built identical npm tarballs from clean source. The attached Node 22 tarball's SHA-512/SHA-1 and size were independently recomputed and match the prior security candidate and package-verification receipt.
• Package SHA-1: 85af6cb45b1e0d9c0d6d88fd4aabe6595427936e.
• Package integrity: sha512-QNrxP68b7DJZmWF7HjUik1XxRj6I6hhwbgkO8qGBg10WS4LXUD3AG90XZ84DLk9nQHpMW22PVFgbcOlaTm/dmw==.

Use the attached COMMIT.txt, package-verification.json, ssh-verification.json and npm-registry-verification.json to check source identity, CI installation and post-publication registry installation. The attached tarball is an alternative to installing from npm.

Preview boundaries

This is a preview patch, not a production reliability, performance or billing certification. Modal default-toolchain and real-repository cold/warm acceptance passed on the preceding SDK tree; Daytona has historical live evidence. The updated SDK tree has full offline/SSH/Pi/package acceptance, but no renewed paid-cloud qualification. SkyPilot/E2B lack live qualification; E2B retains the documented unresolved auto-resume race and task inspection fails closed.

Manual user WSL2/TUI acceptance, broad real-model selection reliability, cross-machine interruptions, live fault recovery, actual billing and broad workload speedup are not certified. Existing npm-shrinkwrap cache-key/bootstrap limitations remain. Cloud operations can cost money, and retained storage/images may continue to incur charges. Review README, DELIVERY and docs/SECURITY-2026-10.md for the complete historical evidence and limits.

npm publication verification

Published publicly as @onedotmint/reroute@0.3.1 with npm latest set to 0.3.1. The registry SHA-512 integrity and SHA-1 match the attached exact-commit CI package. An isolated fresh public-registry install passed --version and CLI smoke; Pi project-local npm install/list/remove and published source-extension loading passed. Registered tools are only reroute_run and reroute_status, with /reroute management and no Bash override. See attached npm-registry-verification.json; no personal Pi configuration or paid cloud resource was used.

Reroute 0.3.0 preview

Reroute 0.3.0 preview

Keep Pi and source local; offload eligible build, test and compute tasks through native Reroute tools.

Install

Requires Node.js >= 22.19.0 and Pi for the native extension.

# Recommended: project-local Pi package
pi install -l npm:@onedotmint/reroute@0.3.0

# Optional standalone CLI for masked credential setup and diagnostics
npm install -g @onedotmint/reroute@0.3.0

Approve project trust after reviewing the package, then run /reroute in Pi. The npm package is @onedotmint/reroute; the CLI command is still reroute. Do not install the unrelated unscoped reroute package. The CLI does not register the Pi extension or change Pi settings.

Highlights

• Independent reroute_run and project-scoped reroute_status tools, plus the /reroute management panel. Pi/AFT retains ordinary Bash ownership.
• Managed Daytona/Modal configuration, masked credential setup, separate named accounts and explicit spending authorization.
• One-way source snapshots, isolated task execution, retained download caches and explicit task receipts. Failed or uncertain remote execution never silently retries locally.
• Public scoped npm packaging; tarball name, installed identity and version are checked against the source manifest.

Source and verification

• Source: 51194348385601743a45144ab0b4ae5eb636aadb on rebuild/0.3-native, not the repository's older main branch.
• CI: https://github.com/onedotmint/Reroute/actions/runs/39752316807
• Release publication is gated on successful Node 22/24 typecheck, build, tests, CLI smoke, real localhost SSH/rsync acceptance and clean-prefix tarball installation. Node 22 also checks exact-commit Pi Git install, extension loading and removal.
• The attached npm tarball and package-verification evidence come from the successful Node 22 job. Check COMMIT.txt, package-verification.json and the archive integrity before installing an attached tarball.

Preview limitations

This release is a distribution milestone, not a production or billing certification. Daytona has historical real-service evidence, including an exact prior merged-commit run; this release commit has not been requalified against paid clouds. Modal has never been live-verified; SkyPilot and E2B lack live qualification. E2B retains a documented unresolved auto-resume race, and native task inspection fails closed rather than entering an unsafe connection path. Billing is unverified for every provider. Broader real-model tool-selection reliability, manual interactive Pi/TUI and cross-machine interruption behavior are not certified by CI.

Cloud creation/start can incur charges, and retained storage can continue to cost money. Review the README and DELIVERY ledger for configuration, authorization boundaries, historical evidence and remaining limits.

npm publication status

Published and independently installation-verified: @onedotmint/reroute@0.3.0, public access, npm latest tag. Registry SHA-512 integrity and SHA-1 shasum match the attached CI-verified tarball. A fresh temporary prefix installed the package from the public registry and passed --version and CLI smoke; Pi project-local npm install/list/remove and published source-extension loading also passed. The extension registered only reroute_run, reroute_status and /reroute, without taking over Bash. See the attached npm-registry-verification.json. No personal Pi configuration or paid cloud resource was used in this verification.

The verified tarball remains an alternative CLI install (npm install -g ./onedotmint-reroute-0.3.0.tgz); the exact Git source remains available for Pi (pi install -l git:github.com/onedotmint/Reroute@51194348385601743a45144ab0b4ae5eb636aadb).