Starstruk Logo MarkStarstruk

v0.6.8

mountain-loop/yaakv0.6.8May 12, 2026by jaberjaber23

AI Summary

Resolves workspace state directory splitting to protect user data and aligns dashboard WebSocket authentication with HTTP middleware. Adds the Requesty provider and hardens the installer.

Key Highlights

  • Workspace state_dir split ensures private state stays under `~/.openfang/`
  • Dashboard WebSocket auth aligned with HTTP middleware
  • Agent tools (skill_list, skill_describe, skill_execute) replace filesystem fallback
  • Requesty provider added with 5 catalog entries
  • Installer security hardening including TOCTOU fixes and CRLF normalization

New Features

  • Workspace state management
  • Agent tools implementation
  • Requesty provider integration
  • Local provider environment overrides
  • Audit logging (SHA-256 to Merkle chain)
  • Installer security improvements

Full Release Notes

**Fixes:**
- #1097 workspace state_dir split — private state stays under `~/.openfang/`, user workspace untouched
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 `skill_list` / `skill_describe` / `skill_execute` agent tools (replaces filesystem fallback)
- #1170 `require_signed` wired through `POST /api/skills/install` with `allowed_signer_keys` allow-list
- #1174 `POST /api/audit/append` endpoint for instance-side wrapper audit integration
- #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
- #780 Telegram `message_thread_id` routing per-topic to named agents
- Codex audit findings on installer.rs binding check closed:
  - CRLF and UTF-8 BOM normalization on both sides of compare
  - `package.json` added to manifest candidate list
  - symlink and canonicalization escape protection
  - TOCTOU closed via private staging dir plus atomic rename

**Providers:**
- #995 Requesty added (`https://router.requesty.ai/v1`) with 5 catalog entries
- #1154 `OLLAMA_HOST` / `LMSTUDIO_HOST` / `VLLM_HOST` / `LEMONADE_HOST` env override for local providers

**PR dispositions:**
- closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
- held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
- author rework requested: #943 (IDOR on session endpoints)

**Tests:** 2696+ across 14 crates, 0 clippy warnings.