v0.3.0

What's new in v0.3.0

Security controls

Two new controls let you lock down what the agent can touch:

• Work-directory sandbox (work_dir) — read_file and write_file are restricted to a directory tree. Symlinks are canonicalized so they can't escape the boundary. Defaults to the directory openheim was invoked from.
• Shell access control (allow_shell) — set to false to remove execute_command from the tool list entirely. The LLM never sees it and cannot request it.

Both are configurable in config.toml and as builder methods (.work_dir(path) / .allow_shell(bool)) for programmatic embeddings.

System identity

~/.openheim/system.md defines the agent's base identity and is injected into every session's system prompt. openheim init creates a default file. The prompt is now structured: identity block first, then skills, separated by clear section headers.

Default skills

A new default_skills array in config.toml auto-loads skills into every session — no need to pass --skills each time. Per-session skills are merged on top with duplicates removed.

Cross-compilation

Cross.toml added for building Linux targets from macOS.

Fixes

• MCP subprocess stderr no longer leaks into the terminal
• openheim run now exits cleanly after a headless prompt completes
• merge_skills deduplicates within the default_skills list itself
• Leading/trailing whitespace in system.md is preserved
• openheim init correctly reports system.md creation status when config already exists

---

Breaking changes (library users)

• AppConfig gained two new public fields: work_dir: Option<PathBuf> and allow_shell: bool. Struct-literal construction must supply these fields. TOML loading is unaffected (both have serde defaults).
• SystemToolExecutor::build takes an additional allow_shell: bool argument.