Sixb 0.2.0

Sixb 0.2.0

Sixb 0.2.0 completes secure and traceable execution (#360). Every operation runs in one execution context, every protected read goes through one authorization model, markings follow data from datasets to ontology properties, and the current value of any object can be traced back to its source. Missing execution, authorization, markings or lineage permissions fail closed.

Every Sixb package moves to 0.2.0. This release has breaking changes and database migrations: read Upgrading before you deploy.

What 0.2.0 guarantees

Area	What it means for your project
One execution model	Requests, workers, Actions, workflows, syncs, pipelines, projections and Agent runs share one execution context. Each run and ontology commit records who initiated it, from where, and under which parent. There is no implicit system authority.
Markings	Mark properties and dataset columns, and grant them through a role's clearances. Marked values are redacted on every read, and markings follow the data through syncs, pipelines and projections, with SQL analyzed from its query plan.
Object policies	can.view(Type).where(...) grants only some objects. A principal cannot read, edit, link or act on an object it cannot see, and Action handlers know who asked.
Lineage	Ask where any value comes from: the dataset version and columns behind it, or the Action that edited it and who asked for it. Every step is authorized on its own.

The first three shipped across the 0.1.x releases. Lineage, the last piece, is new in this release.

Highlights since 0.1.26

Where a value comes from

const lineage = await sixb.objects(Customer).lineage("42")
const upstream = await sixb.datasets.lineage(customers, { depth: 5 })

A lineage explains, for the current state, what makes an object exist and what decided each property:

• an imported value: its projection, the dataset version and column it reads, and the versions upstream that column comes from;
• an edit: the Action or workflow that made it, who asked for it, when, and the imported value it replaced;
• telemetry: the commit that appended the latest point.

linkLineage(...) does the same for a link. The API serves all three reads, and an object page shows Where this value comes from for each property. A step the reader cannot see is left out and counted, never described, and an object the reader cannot read answers like a missing one.

Console, Settings and project settings

The app now opens three places, each for a different person:

	For	What's in it
Settings	Everyone	Personal, Developers, Memory
Project settings	Admins	Members, Usage, Activity
Console	The project's developers	Syncs, pipelines, ontology, logs

The Console opens to whoever holds can.observe(project.console), granted in a role like every other permission.

Environment variables

List what a project needs in sixb.env.ts. sixb dev and sixb check stop before starting when a variable has no value.

import { defineEnv } from "@sixb/core/env"
import { doppler } from "@sixb/env-doppler"

export default defineEnv({
  source: doppler({ project: "client-a" }),
  vars: {
    DATABASE_URL: "required",
    LINKEDIN_CLIENT_SECRET: "prod",
    SENTRY_DSN: "optional",
  },
})

With a Doppler source, sixb env init, pull, set and status move the values, and sixb deploy writes each server's .env from it before building. Production values stay off laptops.

The Agent keeps within its model's context

• Measured budgets. The Agent learns each model's bytes per token from the project's runs, and keeps every call under its model's limit.
• Large outputs go to files. A tool output too large for the context is saved to a file the Agent reads in pieces, and opens from a Full output link in the chat.
• Compaction. Long or idle conversations are condensed toward the model's limit, keeping the prompt cache where it pays.
• A context meter. A ring beside the model shows how full the conversation is, part by part. /context does the same in the terminal.
• Step limits. agent: { maxSteps, subagentMaxSteps } and defineAgentStep({ maxSteps }) cap runs at a number of model calls. Sub-agents and workflow AI tasks stop at 500 by default.

A conversation that runs on your computer can also be continued from the web, or moved to the cloud.

Also in this release

• Shared links. Actions receive the client of the request that asked for them, Actions and workflow steps revoke links with sixb.shares.revoke, and app/shared-unavailable.tsx brands a dead link.
• Desktop. useDesktop tells an app it runs in the desktop app, from its first render.
• Faster PostgreSQL. Objects are partitioned by type, so a query plans against its own type's indexes, and idle connections are kept for a minute.
• Links read as declared. Every provider reads a link only through the object types its ontology allows.
• Fewer refreshes. Live object queries refresh only when a type they read changes.
• Pipedrive fields, options and labels can be managed from the connector.

Upgrading

Upgrade every Sixb package to 0.2.0 together, then rebuild your application assets. ^0.1.x ranges do not accept 0.2.0, so update each @sixb/* range in your package.json.

bun add @sixb/core@^0.2.0 @sixb/cli@^0.2.0 @sixb/app@^0.2.0 @sixb/client@^0.2.0

Upgrading from a release older than 0.1.26? Read the notes of each release in between first.

Migrate the database

Run sixb db migrate before starting the new version. PostgreSQL migrations 084-agent-token-rates to 086-partition-objects and SQLite migrations 082-agent-token-rates and 083-agent-computer-sessions add the Agent's token rates and computer sessions.

PostgreSQL 086 partitions objects by type. It locks the objects table while it copies every row, so plan for that pause and rehearse it on a copy of a large database first.

Required changes

• Write objects through Actions. The routes that wrote objects, links and telemetry directly are removed: PUT /api/objects/:type/:id, PUT and DELETE …/links/:linkId, and POST …/telemetry/:propertyId. Code keeps writing in process with sixb.objects(…).upsert().

• Grant the Console in a role. The visibility export in app/layout.tsx is removed.

    // app/layout.tsx
  - export const visibility = { console: [developers] } satisfies AppVisibility
  
    // security/roles/developers.ts
    grants: [
  +   can.observe(project.console),
      can.observe(project.logs),
    ],

• Import the context budget from core. @sixb/agent no longer re-exports it, and core no longer exports matchingAgentUsageAnchor, agentContextBytesPerToken and measureAgentContextRequest.

Package versions

Every published Sixb package is now 0.2.0, including @sixb/env-doppler (new).

Changes since v0.1.26