cli-v0.11.0

Runx CLI 0.11.0

Runx 0.11.0 keeps every secret in one place, runx secret, and a connector
whose credential's variable is set needs no setup at all. A name without a
version runs at the newest version your runx reads, so a package published for
a newer runx no longer breaks an older one. What runx adds to a project now
lives under .runx, apart from the skills and connectors you write. Connectors
can run as a person's signed-in browser account, and the payment skills settle
through Stripe and PayPal as well as x402.

Highlights

• One secret command. runx secret set <name> keeps a value sealed in the
  runx home, or --from <reference> keeps it in 1Password, AWS Secrets
  Manager, AWS Systems Manager Parameter Store, Vault, the system keychain or a
  file, read through that manager's own CLI on every use. list, rm and
  read complete it. A connector binds one with runx connector use <connector> --secret <name>, the managed agent names one with runx config set agent.secret <name>, and a program reads one with runx secret read or
  the client's secrets.read. Setting a secret again serves everything that
  names it from its next call.
• Variables need no setup. A connector with no instance selected binds the
  credential whose variable is set in the environment or the workspace .env,
  as runx connector use would, and stores nothing. A selected instance still
  wins, and two set variables refuse rather than choose.
• The newest version your runx reads. A skill or connector named without a
  version takes the newest published version this runx reads: the current one,
  or the newest older one when the current version needs another runx. The
  output's newest_unread names the version passed over and why. A version
  named outright is installed as named, or refused when this runx does not read
  it.
• Your files and runx's apart. Every package runx adds goes to
  .runx/added-skills and .runx/added-connectors. skills/ and
  connectors/ hold what you write, and your own copy of a skill or connector
  answers its name first, whatever version a ref names.
• Browser-session connectors. A connector's session can name the tool that
  reports its signed-in account. Setup pins that account, and every operation
  checks it again and runs as it. The reddit skill reads and acts through the
  account's own signed-in Brave profile and reads each post, comment and vote
  back.
• More payment providers. The stripe, paypal and link connectors
  carry exact amounts, OAuth custody, native approval and durable
  acknowledgements. charge and refund settle through a Stripe, PayPal or
  x402 merchant account, and pay pays through a held x402 wallet or an
  approved Link authorization.

Added

• runx secret set|list|rm|read, runx connector use --secret, runx config set agent.secret, runx connector import-mcp --secret and runx connector use --hosted --secret. The client gains secrets.read.
• The registry lists a connector's versions at GET /v1/connectors/<name>/versions, as it lists a skill's, and runx reads both
  histories a page at a time to find the newest version it reads.
• A turn's load answers with the skill's exact SKILL.md and its digest and
  its runners as an index with their purposes and inputs, and binds the runner
  it names. A runner states its purpose in its run.yaml description, and
  every runner of a maintained skill with several runners states one.
• turn_read reads what an act's context index names, a page at a time, and
  turn_list shows each open turn.
• fs.read reads a file by lines with start_line and line_count and names
  the whole file's digest. fs.edit, fs.write and fs.apply_bundle return
  each file's diff.
• agent-session searches the web with exa beside reading pages.
• github's activity runner reads every issue and pull request updated since
  a time, each in the fields a reader needs.
• The twitter skill saves an X plan once by its digest and continues it from
  its own progress, so later calls name only the digest.
• validateTurnLoadContract in @runxhq/contracts checks a completed load's
  output, and the registry's public skill catalog rule now lives in
  @runxhq/contracts.

Changed

• A skill install is written beside its destination and moved into place only
  once everything it carries reads, as a connector install already was, so a
  version runx does not read leaves nothing in the project.
• A run reads only the connectors it reaches, so one connector that cannot be
  read fails only what reaches it.
• A secrets manager runs with the operator's own environment in the runx home,
  so a workspace .env never signs it in, configures it or chooses what it
  trusts.
• Memory is its host's: runx reads no MEMORY.md into an act. Memory a host
  supplies travels as any admitted context.
• A command's result carries its output by default, and output past the
  capture limit is carried as far as it held.
• A tool's input offers the exact shape it decodes, defaults included.
• The reddit tool compiles its browser bridge once instead of on every call.
• Every release platform runs the README quickstart in its release smoke.

Fixed

• Windows host commands retain SystemRoot and the other documented process
  variables regardless of their inherited casing, so Node can initialize.
• On Linux, a non-root user could not install or run a registry skill on a
  machine with a /skills directory, or from /: the filesystem root is no
  one's workspace now (#556).
• The README quickstart runs from a fresh clone whatever connectors the
  workspace holds: a connector manifest this runx cannot parse, a broken one or
  one written for a newer runx, fails only a run that reaches that connector
  (#557).
• A bundled session calls the connectors its load bound.
• A nested act's call runs, and a cancelled call is recorded as stopped.
• An approved effect whose file changed since the person saw it is refused,
  naming what changed, instead of failing the run.
• runx registry search names a connector by its ref in the install command
  it offers.
• An isolated harness case keeps the connectors its skill pins.
• fs.search takes one file as well as a directory and refuses a secret it
  resolves to. A change over a file that names no digest is told to name the
  content_digest its read returned.
• The commands a client-started run executes keep the host's HOME.
• research's synthesize act refuses an answer of another shape at the act.

Removed

• Credential profiles, runx connector use --from, runx config set api-key --from and --bearer-stdin: a secret replaces each.
• Reading MEMORY.md and RUNX_MEMORY_PROFILE_PATH into an act.

Security

• rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 fix RUSTSEC-2026-0382 and
  RUSTSEC-2026-0383.

• A secret binding carries a proof only its runx home can make, so a project
  cannot plant one.

• A secrets manager never takes its sign-in, configuration or trust from a
  workspace .env.

• Tokio 1.54.1 and ctutils 0.4.5 fix RUSTSEC-2026-0386 and
  RUSTSEC-2026-0385.

Breaking changes

• Each project gets a new kernel store, .runx/kernel-v2.sqlite, and 0.11.0
  reads nothing 0.10 recorded in .runx/kernel.sqlite. Connector instances,
  standing approvals, paused runs and effect custody start empty, so each
  project binds its connectors again once. While the 0.10 store holds a
  provider effect in flight, 0.11.0 refuses to start the new store and names
  those acts.
• The home config upgrades once on first use: each credential profile becomes
  a secret of its name, the managed agent's key becomes the secret agent,
  and the ids of sealed values become material_id, api_token_material_id
  and publish_api_token_material_id. Secrets and logins keep their sealed
  files.
• The reddit connector names an account's browser profile profile, and
  its bind command takes --profile. Each account binds its browser once
  again.
• The sql connector's connection config and requests name the configured
  source source.
• Packages runx adds live under .runx/. skills/ and connectors/ are
  yours, and a copy there answers its name before any registry version.
• runx reads no MEMORY.md into an act.
• Packages published for 0.11.0 can use manifest fields that 0.10.2 refuses,
  such as a runner's description and the new connector session and payment
  shapes.
• Every contract names its fields one way (CONVENTIONS.md): _ref is a runx
  reference, _uri a URI, _id a bare id, _path a file path, _locator a
  provider's locator, and every digest reads sha256:<hex>; state is where
  something is in its lifecycle, status how a check came out and outcome
  how a run ended. Receipts, events and records 0.10.2 wrote keep verifying
  with 0.10.2.
• A packet id names its owner. A core packet, which runx itself emits or
  reads, is runx.<name>.v<N>; a package's is
  <publisher>/<package>.<name>.v<N>, such as
  runx/lead-qualify.qualification.v1, and lives in that package's
  packets/<name>.v<N>.schema.json at $id
https://schemas.runx.ai/packages/<publisher>/<package>/<name>/v<N>.json.
  runx refuses any other form, and every packet of runx's own skills has its
  new id.
• A package packet resolves from the package its id names: the package
  itself, the pinned copy its bundle carries, or the owning package in the
  workspace or added to the project. Nothing resolves through a workspace
  dist/packets, and the root package.json runx.packets field is gone.
  Publishing pins each packet a package reads from another package and never
  copies a core one.
• The registry's digest of a published bundle's files is bundle_digest,
  written sha256:<hex>, in skill versions, installs, paid listings and the
  x402 discovery extension. package_digest is only ever the execution
  package digest a run records.

Upgrade guidance

• Before upgrading, finish or reconcile on 0.10.2 any run with a provider
  effect in flight. If 0.11.0 names one later, either finish it on 0.10.2 or
  move .runx/kernel.sqlite aside to discard it.
• Install 0.11.0 and run any command once to upgrade the home config. Then
  bind each project's connectors again with runx connector use.
• Rename source_ref to source in each sql connection config.
• In each project, delete the packages 0.10.2 added under
  skills/<owner>/<name>/<version>/ and connectors/<name>/<version>/. 0.11.0
  adds them under .runx/ and otherwise treats the old copies as your own,
  never updating them.
• Keep a model key with runx secret set agent and runx config set agent.secret agent, or let the provider's own variable supply it.
• Stay on 0.11.0 or later to run the current versions of runx's skills and
  connectors: 0.10.2 refuses them.
• A package of your own that declares packets moves each to its
  packets/<name>.v<N>.schema.json under the id
  <publisher>/<package>.<name>.v<N>, with that id's $id, renames the id
  where its runners declare it, and is published again. A package that reads
  a runx packet names it by its new id.

Contributors

Community package updates keep their original publisher identities and
contributor attribution. Maintained packages remain published by Runx.

Full changelog:
cli-v0.10.2...cli-v0.11.0