Skip to content

openab-0.10.0-beta.3

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 03:40
openab-0.10.0-beta.3
d64c678
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed since openab-0.10.0-beta.2

This release lands the OAB MCP Facade capability layer, browser control over MCP-over-ACP, a native Gmail adapter, and a new LINE WORKS platform adapter.

🚀 Features

  • OAB MCP Facade MVP — new shared crates/openab-mcp workspace crate (MCP client runtime extracted from openab-agent) plus a broker-hosted, loopback-only Streamable HTTP MCP server exposing exactly search_capabilities / execute_capability. Activated by the [mcp] section in config.toml (absent = no listener, backward compatible). Also enforces the previously-unenforced tool_filter glob include/exclude at discovery and execution (#1448)
  • Facade-only run mode — an adapter-less config with [mcp] present now runs just the facade listener in the foreground instead of bailing with "no adapter configured" (#1453)
  • Session-aware capability sources — in-process CapabilitySource trait with per-agent-session opaque tokens (constant-time resolve, revoked on evict); session-bound sources are invisible and unreachable to anonymous clients; unified audit lines across both dispatch paths (#1454)
  • Native Gmail adapter — six-tool profile (search_threads / get_thread / get_message / list_labels / list_drafts / create_draft) over GA Gmail REST, served as a loopback MCP server via openab mcp gmail-native serve|login. Drafts-only write surface, own PKCE OAuth flow with refresh-token persistence, header-injection-hardened MIME builder (#1449)
  • LINE WORKS platform adapter — webhook ingress with X-WORKS-Signature HMAC verification + service-account JWT (RS256, auto-refresh), @-mention gating for channel messages, markdown replies rendered as flex bubbles with plain-text fallback, configurable receipt ack, inbound attachment download (image/audio/text through the shared media pipeline), first-class [lineworks] trust section, bounded two-tier ingress queue, and extensive review hardening across six rounds (#1456)
  • Browser control via MCP-over-ACP (Phase 2) — an LLM agent can now operate a connected browser: reverse-MCP tunnel (mcp/connect / mcp/message per the official RFD) from the gateway /acp server to a browser extension, exposing katashiro.* tools (click / read_dom / navigate / type / screenshot). Delivered through the MCP Facade by default (per-session tokens, operator-configurable [[mcp.acp_servers]] deny-all allowlist with pinned tool sets), with proxy/bridge modes as explicit opt-outs. Includes SO_PEERCRED-authenticated bridge socket, constant-time bearer checks, tunnel-only 8 MiB frame allowance, and stale-transport cleanup that closes a facade-bypass path (#1447)

📖 Documentation

  • OAB MCP Adapter ADR — facade boundary, two-tier positioning vs octobroker, capability-plugin path (#1446)
  • OAB MCP Facade operator guide — enablement, two-tool surface, client registration, trust model (#1450)
  • CLI conventions — top-level verbs for the bot, noun namespaces for subsystems (#1452)
  • gmail-native: corrected the Desktop OAuth client claim (validated path is Web application + secret) (#1455)

📌 Operator notes

  • All new config surfaces are opt-in: no [mcp], no [lineworks], no type:acp declarations = behavior unchanged from beta.2
  • MCP audit lines use the bare mcp.audit tracing target — include it explicitly in RUST_LOG (e.g. RUST_LOG=openab=debug,mcp.audit=info) or tool-call auditing is silently off
  • If a deployment previously ran browser proxy/bridge modes, facade-mode setup now removes the stale direct-transport entries automatically (they bypassed facade policy/audit)

Full Changelog: openab-0.10.0-beta.2...openab-0.10.0-beta.3

Version Info

  • Chart Version: 0.10.0-beta.3
  • App Version: 0.10.0-beta.3

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.3

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.3
Assets 8
Loading