v0.6.8

HumanSignal/label-studiov0.6.8May 12, 2026by jaberjaber23

AI Summary

Focuses on workspace state isolation, security hardening for skill installation, and local provider overrides. Includes the Requesty provider and audit logging enhancements.

Key Highlights

Split workspace state_dir to keep private state under `~/.openfang/`
Added `require_signed` enforcement for skills with `allowed_signer_keys`
Added `POST /api/audit/append` endpoint for instance-side audit integration
Added HAND.toml SHA-256 logging to Merkle audit chain
Added Requesty provider and local provider environment overrides

New Features

Requesty provider added
POST /api/audit/append endpoint
require_signed skill installation
OLLAMA_HOST/LMSTUDIO_HOST env overrides

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.