v0.9.24

Patch release — auth-path, URL-handling, and git-status parsing fixes (since v0.9.23, #196–#206).

Auth & config

• config: preserve the URL path when selecting the queue auth header, so a reverse-proxy's /aelli and /litellm mounts stay distinct (#196)
• config: sanitize CR/LF/TAB from auth header values (header-injection guard); treat default-port-equivalent gateway URLs as equal; strip IPv6 brackets in isLocalhost; reject non-numeric A2A port env (#204)
• daemon: reject non-string cwd before forwarding to the A2A server (#202)

git status parsing

• git-context: UTF-8-encode raw chars in quoted paths so non-ASCII filenames round-trip under core.quotePath=false (#205)
• git-context: count backslashes before toggling rename quotes so a path ending in a literal backslash splits to the correct destination (#206)
• git-context: add the missing \a (BEL) C-escape in unquoteGitPath

Plus Nemotron review-cycle hardening across validation, daemon, task-queue-client, and policy.

Update with /plugin update in Claude Code.

v0.9.23

What's Changed

• improve(a2a-client): Nemotron COMPLEX review cycle (hour 23 UTC) by @raelli in #181
• fix(auth): send Bearer token for task-queue SSE when AELLI_LITELLM_BASE is set by @raelli in #182
• improve(daemon): Nemotron COMPLEX review cycle (hour 0 UTC) by @raelli in #183

Full Changelog: v0.9.22...v0.9.23

v0.9.22

Patch release folding in the two improvements merged just after v0.9.21:

• #178 — improve(policy)
• #179 — improve(config)

Verified clean on the release HEAD: pnpm test 206/206, eslint exit 0, pytest 391/391. Marketplace synced to 0.9.22.

v0.9.21

First release since v0.9.20 — ships ~36 robustness/quality improvements merged on top of it, and lands main lint-clean with the full JS + Python suites green.

Highlights (curated this cycle: #164, #165, #168, #170, #172, #175, #176)

• daemon: crypto.randomBytes rpc-ids, structuredClone payload guard, C0/C1 control-char log sanitization, advisory message field, safer error/catch handling.
• validation: clearer "not a string" vs "empty" failure messages.
• task-queue-client: retry on HTTP 429.
• a2a-response: shallow-copy semantics documented.

Repo health

• Cleared 9 pre-existing lint errors (CI gates only pnpm test, so lint debt had accrued silently).
• Fixed 5 env-dependent test_dispatch_integration.py tests (pinned OCTOWIZ_ALLOWED_ROOTS in setUp).

Verified: pnpm test 206/206, eslint clean, pytest 391/391. Marketplace synced to 0.9.21.

v0.9.20

What's changed

• Restored pyproject.toml so octowiz-cache CLI can be installed via pip install -e .
• Aligned versions across package.json, .claude-plugin/plugin.json, and pyproject.toml (all 0.9.20)
• octowiz-cache --version now reads from package metadata instead of a hardcoded string
• Added @antfu/eslint-config with antfu style applied across all JS source and test files; closes the octowiz-cache check hard gap for polyglot stacks

v0.9.19

Fix Claude Code skill discovery on case-sensitive Linux filesystems by renaming Octowiz skill entry files to uppercase SKILL.md.

Validation:

• pnpm test: 201 tests passed
• claude plugin validate: passed with existing warnings
• verified all Octowiz skill directories contain SKILL.md

Co-Authored-By: Oz oz-agent@warp.dev

v0.9.18

What's Changed

Self-healing Python A2A server (#119)

The session-start hook now detects a stale A2A server and replaces it automatically — previously a long-running server silently served old code forever (observed 6 days / 5 releases stale). The agent-card route anchors identity (a foreign service on the port is never touched), /health settles fresh vs stale against the installed plugin version, and only the recorded pid is killed — after verifying it is the uvicorn on the configured port. Together with the 0.9.17 daemon plist check, both background services now follow /plugin update with no manual restarts.

mattpocock-skills rename completed (#122)

mattpo-skills no longer exists in the IntegraHub marketplace. The setup checker (REQUIRED_PLUGINS), the marketplace manifest dependency, the seeded skills-hub memory, and the setup-skill gap table now all reference mattpocock-skills — fresh machines no longer hit a permanent plugin_mattpo-skills hard gap.

Test hygiene (#118)

Jest runs redirect AELLI_CACHE_DIR to a temp dir — local test runs no longer append fake daemon path mismatch lines to the real ~/.cache/aelli-cc/aelli-cc.log, so log entries are trustworthy diagnostics again.

Docs refresh (#120)

doctowiz skill gained /health-based version checks, auto-restart log patterns, and an upgrade table through 0.9.18; README replaced stale manual daemon-start instructions with the launchd + self-healing reality and documents the full config.js env vocabulary; the landing page capability grid now lists the nine real A2A capabilities.

Tests: 201 JS + 603 Python

Full Changelog: v0.9.17...v0.9.18

v0.9.17

What's Changed

Architecture deepening + daemon version-skew auto-restart (#114)

• Daemon auto-restart on version skew: ensureDaemonVersion() compares the launchd plist's ProgramArguments path against the installed plugin's index.js and reloads the daemon when stale — /plugin update no longer leaves an old daemon running
• /health endpoint on the Python A2A server (diagnostics)
• Fixed branch: undefined on session-start events (deleted event-builder.js; start.js composes the payload inline)
• Deleted hollow session.js pass-through
• Unified doctrine fetch: plan and review share doctrine_enrichment.py with TTL cache + stale fallback

Architecture deepening pass 2 (#115)

• src/config.js — single owner of every env read, URL resolution, secret fallback, and auth-header decision; fixes the AELLI_BASE_URL default divergence and makes doctowiz probe exactly what production resolves
• src/a2a-transport.js — one JSON-RPC 2.0 transport replaces four hand-rolled HTTP clients; rejects non-JSON 200 bodies instead of reporting them as completed tasks
• providers/protocol.py — named AgentRunProvider seam with canonical status vocabulary; both providers contract-tested as substitutable
• a2a.py: err()/require() — the capability error envelope (the contract daemon.js maps to queue status) now has exactly one owner

Tests: 193 JS + 603 Python

Full Changelog: v0.9.16...v0.9.17

v0.9.16

What's Changed

• fix(bridge): exclude plugin dirs from spec-deviation false positives by @raelli in #111
• fix(tests): move misplaced test back into TestRouteEvent by @raelli in #112
• chore: bump version to 0.9.16 by @raelli in #113

Full Changelog: v0.9.15...v0.9.16

v0.9.15

• Fix graceful SIGTERM shutdown in aelli (drain in-flight requests before exit)
• Add concurrency semaphore (cap 4) on workflow handler
• Await terminal PATCH calls to prevent fire-and-forget race on shutdown
• Update setup skill: fix mattpocock-skills install ID
• Update doctowiz skill: version history + workflow_runs_failing diagnostic