v0.1.1258

Binaries available at: https://github.com/veryfront/veryfront/releases/tag/v0.1.1258

What's Changed

• ci: standardize SonarQube quality gate check by @kwakayama in #4416
• fix(security): route optional file reads through the cached content pipeline by @kojiwakayama in #4380
• fix(security): enforce eval tool restrictions on localized AG-UI runs by @kojiwakayama in #4394
• fix(security): stop veryfront up deploying stale pushed source by @kojiwakayama in #4393
• fix(security): isolate sub-workflow node states from the parent keyspace by @kojiwakayama in #4388
• docs: split long deploy guide paragraphs by @kwakayama in #4418
• fix(test): isolate Git fixtures from pre-push context by @kwakayama in #4419
• fix(deps): patch fast-uri security alerts by @kojiwakayama in #4421
• fix(security): keep the CLI login token out of the process environment by @kojiwakayama in #4396
• docs: split nested workflow guidance into short paragraphs by @kwakayama in #4420
• fix(security): bound structured child-run fact extraction input by @kojiwakayama in #4383
• fix(security): reject symlinked paths in the esm.sh codemod by @kojiwakayama in #4379
• docs: add public metrics and platform examples by @kwakayama in #4425
• fix(security): validate caller-supplied system messages in agent input by @kojiwakayama in #4398
• fix(ci): recognize completed Codex review summaries by @kwakayama in #4427
• Protect agent-service request dispatch from prototype tampering by @kojiwakayama in #4422
• fix(cli): route host config through private aliases by @kwakayama in #4426
• Ignore inherited HeadersInit array slots by @kwakayama in #4432
• release: start v0.1.1258 release candidates by @kojiwakayama in #4433
• fix(agent): preserve terminal provider error codes by @kwakayama in #4424
• fix(security): bound the content-keyed JSX transform cache by @kojiwakayama in #4400
• fix(agent): surface provider workspace usage limits by @kwakayama in #4435
• Prepare renderer-owned artifact generations by @kojiwakayama in #4423
• fix(agent): bind native response defaults on Node by @kojiwakayama in #4434
• fix(ssr): recover custom error pages after transient failures by @kojiwakayama in #4436
• ci: standardize Sonar quality gate check by @kwakayama in #4437
• fix(proxy): settle WebSocket cleanup before close events by @kojiwakayama in #4444
• Add authenticated agent executor transport foundations by @kojiwakayama in #4439
• Contain renderer memory pressure with graceful recycle by @kwakayama in #4438
• feat(agent): add fixed Node executor bootstrap by @kojiwakayama in #4440
• fix(runtime): support shared dependency snapshot providers by @kojiwakayama in #4451
• fix(proxy): retain reader cancellation after callback failures by @kojiwakayama in #4450
• feat(agent): bridge hosted executor streams and required audit by @kojiwakayama in #4441
• feat(agent): manage executor sessions and resource settlement by @kojiwakayama in #4442
• Scope executor inference to application authority by @kojiwakayama in #4445
• fix(http): reject compromised Node header processing by @kwakayama in #4455
• Discover agent metadata inside bound executors by @kojiwakayama in #4448
• Gate executor operations on preparation and execution by @kojiwakayama in #4453
• Bridge scoped tools to agent executors by @kojiwakayama in #4452
• feat(rendering): derive complete render generation identities by @kojiwakayama in #4456
• fix(proxy): retire legacy managed agent routes by @kwakayama in #4457
• feat(rendering): bind prepared imports to render generations by @kojiwakayama in #4458
• fix: recover preview dependency history across cold renderers by @kwakayama in #4459
• fix(test): isolate working-directory mutations across suites by @kwakayama in #4462
• fix(ci): support complete large review timelines by @kojiwakayama in #4463
• fix(test): safely serialize lazy artifact import literals by @kojiwakayama in #4464
• fix(ci): stabilize config timing checks and patch Sharp by @kwakayama in #4465
• Prepare executor runtimes from installed grants and private facades by @kojiwakayama in #4454
• fix(mcp): preserve platform selectors across namespace rollout by @kwakayama in #4468
• feat(agent): emit native run event types instead of AG-UI Custom wrappers by @kojiwakayama in #4467
• feat(agent): emit runtime_context as a native RUNTIME_EVENT_RECORDED event by @kojiwakayama in #4470
• feat(run-events): export the run event vocabulary and schemas as veryfront/run-events by @kojiwakayama in #4472
• perf(runtime): reduce request instrumentation and path resolution overhead by @kojiwakayama in #4474
• feat(agent): add managed broker and isolated executor runtime by @kwakayama in #4460
• feat(dev): add automated framework CPU profiling by @kojiwakayama in #4475
• feat(agent): prepare trusted runtimes with isolated project tools by @kojiwakayama in #4476
• feat(agent): install executor profiles restricted to project tools by @kojiwakayama in #4477
• feat(agent): keep trusted runtimes in the managed broker by @kojiwakayama in #4478
• fix(agent): retain canceled project admission until retirement by @kwakayama in #4480
• release: veryfront 0.1.1258 by @kojiwakayama in #4481

Full Changelog: v0.1.1257...v0.1.1258