v0.2.68

v0.2.68 — Artifacts, personalization backend, multilingual PII, feedback analytics

This release lands canvas-bound artifacts with live streaming edits, the backend for Personalization & Memory v1 (UI deferred), a redesigned multilingual PII detector, and a new governance feedback analytics page. It also closes three pre-personalization security gaps around cross-org thread access, debug-log plaintext, and the response cache.

🔒 Security

• Closed cross-org gap in markGenerating — client-supplied organizationId is now validated against the thread's stored org, preventing a multi-org user from pulling another org's RAG / model policy / audit attribution into a thread (#1657).
• debugLog('PRE_LLM_CALL') no longer ships system prompts or user messages in plaintext to operator log streams; payloads are summarized to { sha256, len } via a new summarizeForLog helper (#1657).
• computeCacheKey now accepts an optional userPersonalizationFingerprint so per-user content cannot leak across users via a shared cache hit once personalization is wired in (#1657).

🚀 Features

• Artifacts on canvas — agents can create and edit thread-bound documents (HTML, Markdown, code, SVG, Mermaid) via two new tools (artifact_create, artifact_edit). Patches stream into the canvas with inline diffs, scrolled focus, and a brief source-view hold after each stream settles. Includes a per-thread GC cron and full RLS-aware queries/mutations (#1655).
• Export as PDF for HTML and Markdown artifacts via the browser's native print flow inside the artifact iframe — zero new dependencies, full CSS / font / CJK fidelity. The HTML iframe sandbox gains allow-modals (required by window.print()) (#1656).
• Personalization & Memory v1 — backend with three tables (custom instructions, memories, audit log), assertSelfAndOrgMember self-and-org-member enforcement, a non-blocking propose_memory agent tool (pending → approved → invalidated), lazy rate-limiter-gated cleanup, GDPR Art 15/20 export endpoint, HMAC-pseudonymised audit trail, and prompt-injection structural defenses (XML tags, per-memory nonces, content filter). Settings UI, chat inline pending card, and EU JIT-consent modal are intentionally deferred to a follow-up (#1658).
• PII detection v2 — replaces v1 regex with a redesign covering DE/FR/CH/EN home-address patterns (12 alternation forms, Unicode \p{L}\p{M}, NFC normalize at entry), libphonenumber-js for international phone numbers, and validator.js for IBAN mod-97 / credit-card Luhn post-filtering. EU address coverage rises from ~62% to 98.8%, real-chat over-masking from 40% to 0%, with ReDoS worst case bounded at 110 ms on a 12KB pathological input (#1659).
• Governance feedback analytics page at /settings/governance/feedback: chat thumbs and arena verdicts with first-class agent / model / provider attribution, top-agents / top-models / per-pair model-matchup tables (canonical lexicographic orientation, decisive / tie / both-bad triple), and paginated recent-feedback listings with expandable rows. submitFeedback / deleteFeedback now do thread↔org checks and read attribution from messageMetadata server-side instead of trusting the client (#1662).

🛠 Improvements

• Settings → Logs page polished: heading + subheading added, category filter and CSV/JSON exports hoisted into the header, audit timestamps switched to absolute MMM D, YYYY HH:mm. Sign-in blocks table refreshed with timestamp / user / IP / lock-out / IP-limit columns and an empty state (#1649).
• CopyableField redesigned as a single bordered "ID field" pill with aria-live status, focus ring, and title-tooltip truncation; adopted for the organization ID with a helper subtitle (#1649).
• Hardcoded heights dropped from Button size variants — SearchInput and FilterButton now own their own h-9, keeping sizes consistent across pages (#1649).

📝 Other

• Dependency updates: docker/dockerfile 1.21 → 1.22, pdfjs-dist 5.4.624 → 5.5.207 (#1661).
• Design source split: monolithic .pen file broken into per-page files (agents, auth, automations, chat, conversations, onboarding); knowledge and PoC 2.0 refreshed (#1654).

Upgrade

No manual migration required. Run tale upgrade to update the CLI, then tale deploy to apply the new version.

All schema additions (messageFeedback.{agentSlug,model,provider} + by_org_createdAt index, messageMetadata.agentSlug, three personalization tables, the artifacts table) are additive and applied automatically. New runtime dependencies (libphonenumber-js, validator.js) are bundled.

Contributors

@larryro, @Israeltheminer, @AdeolaAdekoya, @renovate

---

Full Changelog: v0.2.67...v0.2.68