v2026.7.1

Security

• Bumped joserfc to 1.6.7 (GHSA-wphv-vfrh-23q5, CVE-2026-48990, moderate). With b64=false (RFC 7797 unencoded payloads), a JWS could carry a payload that skipped the JWSRegistry payload-size limit during deserialization. joserfc is a transitive dependency (via authlib, which backs the MCP gateway's OAuth), so this is a lockfile-only bump; the MCP gateway and authz test suites pass unchanged.

Changed

• Bumped dashboard frontend dependencies: @xyflow/svelte to 1.6.1, posthog-js to 1.396.3, vite to 8.1.2, @sveltejs/kit to 2.68.0, and svelte to 5.56.4. The production build is unaffected.
• Migrated the dashboard to js-yaml 5. js-yaml 5.0 removed the CommonJS default export and the quotingType dump option, so CognitionPanel.svelte now imports { load, dump } by name and drops quotingType; @types/js-yaml is removed because v5 ships its own type declarations. One behavior change follows from v5's YAML 1.2 (CORE) load schema: in an edited role.yaml, bare yes/no/on/off now load as strings instead of booleans, and re-dumped strings use single quotes where quoting is required.

Added

• initrunner tool new "<description>" scaffolds a custom tool from natural language. It generates a plain-Python type: custom module plus a pytest stub using the configured model, AST-validates the source before writing (the module is never imported during scaffolding), retries once on a validation failure, and prints a paste-ready tools: snippet. Generated functions default to async def, take config and secrets through an injected tool_config dict, and avoid sandbox-blocked imports. --output sets the module name (and retargets the generated test's import to match).

• initrunner run <role> --dev adds a developer REPL. It turns off streaming and the status spinner so a breakpoint() in a custom tool owns the terminal for pdb, and enables in-session tool hot-attach.

• In-REPL /tool add <module> and /reload. /tool add appends a type: custom tool and rebuilds the agent in place (reloading an edited module), so a freshly scaffolded tool is callable on the next turn with the conversation preserved; /reload rebuilds the agent after an edit to role.yaml. Both run through a new AgentHandle that swaps the live agent under a lock and carries _template_values / _memory_store / _resume_context onto the rebuilt agent.

• initrunner plan <role> predicts a run without calling the model. A new command that reports reachable tools (function-level via builder introspection), would-fire initguard policy decisions, applied guardrails, the sandbox that would engage, armed triggers, and a heuristic token/USD cost. Supports --prompt (sizes the cost estimate and surfaces the prompt's tool_search subset), --no-introspect (type-level only), --no-sandbox-probe, and --json. It never raises: a tool whose builder fails or opens a connection is reported at type level with a caveat.

Fixed

• Async custom tools wrapped by the audit-hook sandbox stay coroutines. build_custom_toolset now wraps an async def tool with an async sandbox wrapper instead of the sync wrapper, which previously returned an un-awaited coroutine.
• Cron cost projections work in cost estimate and plan. estimate_role_cost_sync constructed croniter without a timezone-aware base, so get_next() returned naive datetimes that failed the 24h firing-window comparison and silently dropped the daily/monthly estimate; it now passes a UTC base.