v0.6.8

TanStack/routerv0.6.8May 12, 2026by jaberjaber23

AI Summary

This release introduces a split workspace state directory, enhances agent tooling, and adds new security features for audit trails and skill installation.

Key Highlights

Workspace state is now split to keep private data under `~/.openfang/`.
Implemented signature verification for skill installation via `POST /api/skills/install`.
Added audit endpoints and Merkle audit chain integration.
Introduced Requesty provider and local provider environment overrides.

New Features

New `POST /api/audit/append` endpoint.
Signature verification with allowed-signer pubkey allowlist.
Support for `OLLAMA_HOST` and `LMSTUDIO_HOST` environment variables.
Telegram message routing improvements.
Installer security hardening (CRLF/BOM, symlink, TOCTOU fixes).

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.