v0.8.12

Fixed

• Debian Chromium SIGTRAP crash in Kubernetes. The Dockerfile previously installed the OS-level chromium package from Debian 12. When run as a non-root user in strict Docker/Kubernetes environments, this package consistently crashed at startup with Code: null and Trace/breakpoint trap (core dumped). On amd64 the Dockerfile now downloads Chrome for Testing via Puppeteer during the build phase (avoiding the Debian package's SIGTRAP); arm64 keeps Debian's chromium, since Chrome for Testing publishes no linux-arm64 build. Both resolve to a single PUPPETEER_EXECUTABLE_PATH symlink. This resolves the persistent browser launch failures on restricted environments without requiring insecure workarounds like --no-zygote or disabling Seccomp/AppArmor. Thanks @muhfalihr.

Added

• Global message search across sessions. GET /api/search finds messages across all sessions through an open SearchProvider contract, with a built-in database full-text provider (PostgreSQL tsvector/GIN, SQLite FTS5) as the zero-dependency default — no external service required. Search works out of the box on both SQLite and PostgreSQL and survives repeated dialect switching and export/import round-trips; a non-FTS5 SQLite build skips the index gracefully and the route returns 501 instead of crashing boot. Set SEARCH_ENABLED=false to disable the route and module entirely (the index is DB-maintained per-write regardless, at negligible in-process cost). Advanced backends (typo-tolerance, CJK word-segmentation, large-scale relevance) will be available as provider plugins.
• message:persisted plugin hook. A new general extension point fired when a message is durably persisted — on outbound send (from MessageService) and on inbound receive (from SessionService, where both engine adapters converge on the single persist) — so plugins can react to persisted messages (e.g. an external search indexer) without coupling to the message/session services. The built-in FTS search provider is DB-synced and does not consume this hook; it exists for plugin providers and general use. Fire-and-forget: a handler error is swallowed and never breaks the send/receive path.
• Redis authentication via username. Added support for REDIS_USERNAME to configure the Redis cache connection and BullMQ queue connections that require a username. Thanks @muhfalihr.
• OpenAPI/Swagger snapshot export + enriched, auth-accurate API docs. The published spec (served at /api/docs and exportable via scripts/export-openapi.ts) now mirrors the runtime auth model: @Public() routes (/api/health*, /api/infra/health, and the integration ingress wildcard) are marked as not requiring an X-API-Key, matching what the ApiKeyGuard actually enforces. The webhook events enum now advertises the * subscribe-all wildcard the dispatch layer already honors, and request/response schemas are filled in across the catalog, status, stats, integration-instance, and auth endpoints — notably typing the integration InstanceView (and its IngressUrl entries) as real schemas so generated clients no longer receive opaque objects. The export script pins a hermetic environment (in-memory SQLite, queue/MCP off) so it is safe to run anywhere without touching a real database or opening a Redis connection.