Starstruk Logo MarkStarstruk

v0.6.8

jianchang512/clone-voicev0.6.8May 12, 2026by jaberjaber23

AI Summary

Focuses on fixing workspace state directories, aligning dashboard WebSocket authentication, and improving agent tools and audit chains. Includes fixes for the Codex installer.

Key Highlights

  • Workspace state directory split to separate private state from user workspace
  • Dashboard WebSocket auth aligned with HTTP middleware
  • Agent tools (`skill_list`, `skill_describe`, `skill_execute`) improved
  • HAND.toml SHA-256 auto-logging to Merkle audit chain
  • Codex installer fixes for CRLF, BOM, and TOCTOU issues

New Features

  • Requesty provider added
  • Local provider environment overrides (OLLAMA_HOST, LMSTUDIO_HOST, VLLM_HOST, LEMONADE_HOST)
  • Enhanced agent tools and audit integration
  • Telegram message_thread_id routing

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.