Starstruk Logo MarkStarstruk

v0.6.8

BasedHardware/omiv0.6.8May 12, 2026by jaberjaber23

AI Summary

Improves workspace isolation and dashboard security while adding new agent tools and an external provider to the ecosystem.

Key Highlights

  • Workspace state split keeps private data under `~/.openfang/` and leaves user workspaces untouched.
  • Dashboard WebSocket authentication aligned with HTTP middleware.
  • New Requesty provider added with 5 catalog entries.
  • Audit chain integration logging HAND.toml SHA-256 on every load.

New Features

  • New agent tools: `skill_list`, `skill_describe`, and `skill_execute`.
  • New `POST /api/audit/append` endpoint for instance-side audit integration.
  • Requesty provider support.
  • Environment overrides for local providers (`OLLAMA_HOST`, `LMSTUDIO_HOST`, etc.).

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.