Skip to content

openab-0.10.0-beta.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 01:25
openab-0.10.0-beta.6
f621c17
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed since openab-0.10.0-beta.5

A security-motivated beta: every Node-based agent image is rebuilt on the Node.js October 2026 security release (Node 22.23.4 / 24.22.1, #1567). In addition, every bundled coding CLI pin moves to a current version, including three major bumps (codex-acp 2.x, grok 1.x, kimi-code 2.x). It also fixes cron and workspace bugs: blank thread_id/id are now treated as unset, and [[ws:]] workspaces survive hung eviction. Cron autonomy is now documented, and CI works again on Rust 1.99.

🔒 Security

  • Node.js base image updated to 22.23.4 / 24.22.1. These versions include the Node.js October 2026 security releases, which fix CVE-2026-111497 (Brotli decoder out-of-bounds write, RCE), CVE-2026-106069 (TLS hostname bypass), and CVE-2026-105482 (dns.resolve NUL truncation). There are no openab code changes for this. The image picked up the fixed Node through the base-image rebuild. Tracking: #1567
    • Rebuilt (Node 22.23.4): openab:0.10.0-beta.6-<agent> / beta-<agent> for claude, codex, copilot, gemini, mimocode, opencode, pi
    • Rebuilt (Node 24.22.1): kimi
    • No Node: kiro, cursor, grok, devin, antigravity, native, agentcore
    • Exposure in openab: unclear, and possibly low. openab and the gateway are Rust, and a default deployment does not start a Node server on a network port. JS agent CLIs and npx-launched MCP servers run on the image's Node as outbound clients. A client-side fetch Brotli path has not been verified either way.
    • Still vulnerable: stable-<agent> / 0.9.x-<agent> (Node 22.23.1), 0.10.0-beta.1–beta.5, and every tag in the deprecated per-agent repositories (openab-claude, openab-codex, openab-gemini, openab-copilot, openab-opencode, openab-pi, openab-mimocode). 0.9 is no longer supported. stable-* gets the fix when 0.10.0 is promoted from this beta, planned for 2026-10-30.
    • Verify: docker run --rm --entrypoint node ghcr.io/openabdev/openab:0.10.0-beta.6-claude --version
    • Verified: NODE_VERSION in the published beta-<agent> and 0.10.0-beta.6-<agent> image configs (linux/amd64 and linux/arm64) is 22.23.4 for all Node 22 agents and 24.22.1 for kimi (#1567 comment).

⚠️ Breaking Changes

  • cron: duplicate usercron ids, compared after trimming, keep only the first entry. Before this release, two cronjob.toml entries with the same id both loaded and ran. Now the loader keeps the first entry in file order and skips the rest, logging usercron: duplicate id (compared after trimming), skipping. The first entry owns the id even when it is invalid or disabled. This stops one job's thread_id/enabled writeback from landing on another entry. Migration: before upgrading, check cronjob.toml for ids that are equal after trimming, including ids that differ only by surrounding whitespace, and make them unique (#1564, thanks @thoththeagent and @charlie0228). See docs/cronjob.md.

🐛 Bug Fixes

  • cron: blank thread_id / id now behave like omitted fields. The cron examples used thread_id = "", which deserialized to Some(""). That skipped thread creation, the send failed, nothing was posted, and the error showed up only in the logs. parse_job_list now normalizes empty or whitespace-only thread_id to unset on both the baseline (config.toml) and usercron paths, so a new thread is created. A blank id is also treated as unset, and a padded id still matches on writeback. The docs now cover usercron id writeback, which pins a job to its first thread, and its edge cases. Two new Troubleshooting rows cover failed to persist usercron thread_id and a gateway/Telegram behavior: a failed create_topic persists the chat ID as thread_id (#1564, thanks @thoththeagent and @charlie0228).
  • pool: the [[ws:]] workspace survives hung eviction. When a session was force-evicted as hung, its session_workdirs entry was purged too. The replacement session then started in the default working_dir whenever the next message had no directive, such as a cron fire or a plain follow-up. Hung eviction now keeps the workspace. /reset still clears it, through a new purge_for_reset(). This restores the behavior that docs/workspaces.md and ADR control-directives §3.1 already describe (#1557, fixes #1556, thanks @sebastian-hsu).

📖 Documentation

  • cron: new "Autonomy and Permission Scope" section. It states that cron prompts skip the adapter's inbound checks (allowlists, DM gating, @mention, bot filtering). This is by design: cron is how OpenAB gives agents autonomy. The section also covers what write access to cronjob.toml grants. That includes shell execution through disable_on_success, which OpenAB runs itself (sh -c / cmd /C) outside the agent's tool-approval model and with OpenAB's full environment, unlike the env-cleared agent process. Operators get two enforceable scope choices: full autonomy, or operator-managed jobs only (#1562, original work by @thoththeagent and @charlie0228 in #1560).

🏗️ Maintenance

  • Coding CLI pins bumped to the versions nightly builds today. All 12 variants already build and publish as nightly-<variant> (#1550):

    CLI Old New
    kiro-cli 2.13.0 2.25.0
    claude-agent-acp 0.59.0 0.84.0
    claude-code 2.1.212 2.1.284
    codex-acp 1.1.4 2.0.0 (major)
    codex 0.144.1 0.159.0
    copilot 1.0.71 1.0.89
    cursor-agent 2026.06.19-20-24-33-653a7fb 2026.09.28-64d2043
    devin 3000.2.17 3000.11.3
    gemini-cli 0.47.0 0.61.0
    grok 0.1.220 / 0.2.106 1.0.44 (major)
    kimi-code 0.28.1 2.1.1 (major)
    opencode 1.17.9 1.18.33
    antigravity (agy) 1.1.13 1.2.13

    This also fixes drift: Dockerfile.grok was pinned to 0.2.106 while the package and unified images used 0.1.220. MiMoCode (0.1.15) and Pi are unchanged.

  • CI: clippy passes on Rust 1.99.0. async-trait is bumped to 0.1.92 to fix the double_must_use lint errors, and AtomicUsize::fetch_update is replaced by try_update in openab-cp, with no behavior change. This is a stopgap; pinning the CI toolchain is a follow-up (#1559).

📌 Operator notes

  • Node-based agents (claude, codex, copilot, gemini, kimi, mimocode, opencode, pi): upgrade to this beta, or wait for 0.10.0 (planned 2026-10-30). Until then, stable-* stays on the vulnerable Node 22.23.1.
  • Deprecated per-agent repositories will be deleted on 2026-11-30. ghcr.io/openabdev/openab-<agent> (openab-claude, openab-codex, openab-gemini, openab-copilot, openab-opencode, openab-pi, openab-mimocode) gets no further updates. Its images still run Node 22.23.0. Migrate to ghcr.io/openabdev/openab:<tag>-<agent> before that date, see docs/image-tags.md.
  • codex, grok and kimi users: these CLIs jumped a major version. CI smoke tests and nightly builds pass, and npm bin names are unchanged, but authenticated ACP sessions were not exercised before merge. Smoke-test your agent after upgrading, or pin the previous version until you have.
  • Usercron users: run the duplicate-id check above before upgrading. A skipped duplicate gives no error in chat, only a log line.
  • If you copied thread_id = "" from older examples, those jobs now start posting into newly created threads, where before they silently failed.
  • Telegram/gateway: a failed or timed-out create_topic still writes the chat ID back as thread_id. To recover, remove that line from cronjob.toml. A code fix is a follow-up.
  • Read the new cron Autonomy section before giving an agent write access to cronjob.toml. That access includes scheduled shell execution.

Full Changelog: openab-0.10.0-beta.5...openab-0.10.0-beta.6

Version Info

  • Chart Version: 0.10.0-beta.6
  • App Version: 0.10.0-beta.6

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.6

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.6
Assets 8
Loading