Starstruk Logo MarkStarstruk

v0.6.8

HumanAIGC/EMOv0.6.8May 12, 2026by jaberjaber23

AI Summary

This release focuses on security, audit trails, and configuration management. It introduces the Requesty provider, environment variable overrides for local providers, and fixes for workspace state management and dashboard authentication.

Key Highlights

  • Workspace state directory split to keep private state under `~/.openfang/`
  • Dashboard WebSocket authentication aligned with HTTP middleware
  • Agent tools (`skill_list`, `skill_describe`, `skill_execute`) replace filesystem fallback
  • Requesty provider added with 5 catalog entries
  • Environment variable overrides for local providers (OLLAMA, LMSTUDIO, VLLM, LEMONADE)

New Features

  • New `POST /api/audit/append` endpoint for instance-side audit integration
  • Telegram `message_thread_id` routing per-topic to named agents
  • Hand.toml SHA-256 auto-logging to Merkle audit chain on every load
  • Codex audit findings closed via CRLF/UTF-8 normalization and symlink protection
  • Environment variable overrides for local providers

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.