Starstruk Logo MarkStarstruk

v0.6.8

RightNow-AI/openfangv0.6.8May 12, 2026by jaberjaber23

AI Summary

Introduced workspace state directory separation, enhanced agent tooling with signature verification, and added audit logging capabilities via a Merkle chain.

Key Highlights

  • Workspace state_dir split to separate private state from user workspace.
  • Dashboard WebSocket authentication aligned with HTTP middleware.
  • Agent tools skill_list, skill_describe, and skill_execute replace filesystem fallback.
  • require_signed enforcement via POST /api/skills/install with allowed_signer_keys.
  • HAND.toml SHA-256 auto-logged to Merkle audit chain on load.
  • Telegram message_thread_id routing per-topic to named agents.

New Features

  • Workspace state_dir split
  • Dashboard WS auth aligned with HTTP middleware
  • Agent tools (skill_list/describe/execute)
  • require_signed wiring through POST /api/skills/install
  • POST /api/audit/append endpoint for instance-side wrapper audit integration
  • HAND.toml SHA-256 to Merkle audit chain
  • Telegram message_thread_id routing
  • Requesty provider added
  • OLLAMA_HOST / LMSTUDIO_HOST / VLLM_HOST / LEMONADE_HOST env override for local providers

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.