Skip to content

v0.55.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Sep 13:48
· 626 commits to main since this release
v0.55.0
47d0b9d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • A macOS continuous-integration lane now exercises the real launchd upgrade path a production install follows. (#1671, #1683, #1685)

  • A CI lane now exercises flair upgrade --check --tree on a packed extract plus systemd unit. (#1564, #1109)

  • The post-publish canary now installs published flair-mcp and flair-client and asserts a tool-call.

    Heads-up: a canary that cannot resolve or drive the published adapters
    is a FAIL. Do not promote from a run that did not complete that step.

  • Flair releases now stop at a staged tag until a clean-machine canary installs and boots the published version.

    Heads-up: after approving a release, run the post-publish canary and paste
    the command it prints. Until you do, latest still points at the previous
    version.

  • bun run test:unit now type-checks the tree before it runs tests.

Changed

  • The post-publish canary now passes a healthy instance when flair doctor's only complaint is a known advisory hint. (#1701, #1686, #1698)

  • @tpsdev-ai/flair-client now sends X-Flair-Client: flair-client/<version> on every request. (#1383)

    Heads-up: upgrade @tpsdev-ai/flair-client (and @tpsdev-ai/flair-mcp)
    with this release. A server upgrade alone does not identify a silent old
    client.

  • Flair's URL builders now share one parser for the HTTP_PORT value.

  • The HTTP bind hardening also covers TLS listeners, reverses a widening, and closes the spawn environment.

  • Flair's HTTP listener is now bound by host and port, defaulting to loopback. (#1502)

    Heads-up: the new default is strictly narrower — before this, a bare port
    bound every interface, including the credentialed HTTP surface, and that narrowing
    is the fix. It also means an install reachable remotely today will answer only on
    127.0.0.1 after its next flair restart or flair upgrade    , with no error:
    remote agents, LAN clients and federation peers simply stop connecting. Widening is
    now deliberate — declare it with flair init --http-bind <host>, the
    FLAIR_HTTP_BIND environment variable, or a top-level httpBind: key in
    ~/.flair/config.yaml. The http.host key shown in older deployment docs is not
    read by Flair and will not preserve a widened bind, so set one of those three before
    upgrading. Only hosts that include IPv4 loopback (loopback itself or a wildcard) are
    accepted.

  • Apple Silicon now embeds on Metal by default, and Health says so. (#1437)

    Heads-up: FLAIR_EMBED_GPU_LAYERS=0 pins CPU on Apple Silicon.
    Unset now means "derive", not "HFE's 0".

Fixed

  • Flair now keeps the admin password out of the launchd service file; flair init and flair doctor --fix refuse to write an unstartable one. (#1685, #1693, #1684)

  • bootstrap no longer ships byte-identical soul entries more than once. (#1431)

  • The macOS launchd CI diagnostics now redact every credential name Flair knows about, not a hand-maintained subset.

  • The CLI honours the port: in ~/.flair/config.yaml, and an unreachable instance no longer blames a config that is already correct. (#1719)

  • docs/federation.md now states that sync is push-only. (#1452, #934)

  • flair federation pair names a local /FederationInstance 403 instead of dumping raw AccessViolation. (#820)

    Heads-up: a 403 on pair is usually the local identity read, not the
    hub. Check FLAIR_ADMIN_AGENTS in the server process env, or
    flair principal add <id> --admin, before chasing hub tokens.

  • scripts/flair-client.mjs loads the raw 32-byte key flair agent add writes. (#1736)

  • flair hook status reports verified delivery, not a bare wired check. (#1734)

    Heads-up: a green hook status verified that the hook command
    produces SessionStart additionalContext when run — final delivery
    still depends on harness trust (re-approve in /hooks) and the
    harness's own injection step. It does not mean a line exists in
    hooks.json. After install, re-approve the hook in Codex (/hooks)
    before the next session.

  • flair init no longer writes a fresh admin-pass file that 401s against a persisted Harper user.

    Heads-up: HDB_ADMIN_PASSWORD still only seeds a brand-new install.
    Re-init never rotates a stored hash unless you pass --reset-admin-pass.
    That flag prints the user, socket, and destination file first, and refuses
    if the operations socket is not owner-only (0700 dir / 0600 socket).

  • A current server now refuses an identified flair-client older than 0.18.0 on memory writes, and flair doctor names the silent-drop pin.

    Heads-up: if writes look stored but never land, upgrade the adapter
    (flair upgrade / pin @tpsdev-ai/flair-mcp and @tpsdev-ai/flair-client

    = 0.18.0), not the server. Restart the MCP host after the pin moves.

  • A fresh launchd instance now applies owner-only socket permissions on first start, so flair doctor is green without a second restart. (#1701)

  • The plain-tree upgrade CI lane now canonicalizes its fixture paths, so it is truthful on hosts where TMPDIR is a symlink.

    Heads-up: this fixes the lane, not the product. A real deploy whose systemd unit
    names a symlinked path (/opt/flair -> /srv/flair) is still never discovered, so
    flair upgrade restarts the instance outside that unit — the service comes back,
    but systemd's supervision is bypassed and it is left unsupervised. Set
    FLAIR_SYSTEMD_UNIT=<unit> to restart through the unit until this is fixed. Tracked
    separately.

  • Orphaned ephemeral test Harpers are killed and removed on the next startHarper. (#1372)

  • POST /ReflectMemories execute no longer dies with HTTP 422 when the generative backend is cold. (#1263)

  • REM nightly no longer reports completed when a core stage did not run. (#924, #1503)

  • Skill registration refuses /tmp sources and resolves SKILL_CONFLICT. (#1433)

    Heads-up: scratch/inspect paths are no longer recorded as durable
    skill provenance. Re-register from an npm specifier or a non-temp path.

  • SkillScan no longer treats markdown inline code as shell injection. (#1434)

    Heads-up: tps skill register still refuses high/critical with
    no bypass. The verdict does not yet gate skill loading (that is a
    later #1434 step).

  • flair status --json names what federation.peers.connected measures. (#1499, #1146)

    Heads-up: federation.peers now includes measuredBy: "lastSyncAt".
    connected is last-contact within 24h, not a live TCP session.

Full record: CHANGELOG.md

Assets 2
Loading