Skip to content

Ainz 0.9.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 16:44
· 5 commits to main since this release
v0.9.2
f46babd

Lua plugins can now expose tools directly from scripts, with bundled require modules, JSON helpers, progress reporting, and capability-checked host functions. Each call receives a fresh Lua 5.4 state with memory and instruction budgets. Plugin approval pins the source bundle before it runs.

This release also fixes eight security and stability issues:

  • Workspace file access rejects dangling symlinks and uses directory handles to prevent escapes during file opens.
  • Web fetching validates and pins DNS answers, checks every redirect, and rejects private and mapped addresses.
  • File permission rules normalize target aliases and reject decoy arguments.
  • Shell prefix allowances no longer authorize compound shell commands.
  • Cancelling a process provider terminates its process group.
  • Cancelled tool calls receive results so sessions remain resumable.
  • Incomplete or truncated model streams fail instead of reporting success.
  • Tool output and HTTP response buffers stay bounded, including streamed progress.

Lua setup and API documentation: https://github.com/wess/ainz/blob/v0.9.2/docs/plugins.md

Install or upgrade with brew install wess/packages/ainz or brew upgrade wess/packages/ainz. Native archives and SHA-256 checksums are available below for macOS and Linux on ARM64 and x86_64.

Assets 10
Loading