Starstruk Logo MarkStarstruk

v0.6.8

Xiaojiu-z/EasyControlv0.6.8May 12, 2026by jaberjaber23

AI Summary

Introduces workspace state isolation, dashboard authentication alignment, and new agent tools for skills management.

Key Highlights

  • Workspace state split to separate private state from user workspace
  • Dashboard WebSocket authentication aligned with HTTP middleware
  • New agent tools: skill_list, skill_describe, skill_execute
  • Requesty provider added with 5 catalog entries
  • Local provider environment overrides (OLLAMA_HOST, LMSTUDIO_HOST, etc.)

New Features

  • Workspace state_dir split
  • Dashboard WS auth alignment
  • Agent tools for filesystem fallback replacement
  • Requesty provider
  • Audit chain integration for HAND.toml

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.