legionio 1.9.43 → 1.9.52

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c2e14e59941d157f3934d2defda8273c0d33e4d2ccc7c1cda305cdfd0c4a56d
-  data.tar.gz: f238dcc116658b5c35d4990531472f700b0504170af2ac80dff194cd388c0c9b
+  metadata.gz: ede4c3b865760acda216ca62dec3963eeba1dc510fa8320438e9fc6f5d290810
+  data.tar.gz: 4428bd1a57998cf59bc887fbbcf67fea6f37c1c4b3036f142dd0bff74d87823c
 SHA512:
-  metadata.gz: 3c10304ab55f3ffd752971ea184fb7917ab499adda804dcae7f92e9bcffd0c8b7860a36a79ba1110d27e02b72783660e1b4f77fb929b98d08b93ceff5cc20894
-  data.tar.gz: dc5f13d4b000a5d3949b65885af43fba4a041a7df9de37fc13ae9fb5e282b07a5e0cac7583ef4c77f44f7c1734308e20949704c2d7e4fa6e3df21ac3666edf67
+  metadata.gz: 12130c29fd51936cd819fc0aa7d320a0b5455b0bd20f4693196bf3e853ff2775ad1d5654233e00469795edc1cfc2c78377292c7b290d02fc2d821818da35ffa0
+  data.tar.gz: ae8b7b9820a8735cfbf6bcaa4bf74b05d49d63a628d4ed06a6a9ed5ffb360138a77f8ea8ad71637c20abbbc3b3b50bf08cf1b0683465b1207ecddffd6386b394

data/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Legion Changelog
 
+## [1.9.52] - 2026-08-07
+### Fixed
+- `/api/stats` + `legion llm status` now report routing on and read circuit state from Inventory SSOT; removed dead `Discovery::System/Ollama` guards and retargeted CLI discovery at `Inventory::Discovery::System`
+- Fixed §4 exception-handling violations: `stats.rb` and `llm_command.rb` now use `handle_exception` instead of silent swallows or unstructured logging
+
+## [1.9.51] - 2026-07-31
+### Fixed
+- Puma: add `force_shutdown_after` (default 10s) to server_settings to prevent indefinite shutdown hangs when streaming connections are wedged (puma/puma#3569). Previously Puma's default of `-1` meant SIGTERM would wait forever on any open SSE/streaming body thread that could not be interrupted
+
+## [1.9.50] - 2026-07-15
+### Fixed
+- Backfill extension routes with API router after boot to fix /api/extensions/* 404s
+- Fix CLI daemon_client require path after legion-llm restructure
+## [1.9.48] - 2026-07-02
+
+### Security
+- API: fixed an authentication bypass in the auth middleware's `skip_path?` (CWE-284). It used bare prefix matching (`start_with?`), so any path sharing a prefix with an unauthenticated route bypassed auth — e.g. `/api/healthily_fake`, `/api/health/admin/export`, `/api/auth/tokens_dump` all matched `/api/health` / `/api/auth/token`. Now uses segment-bounded matching (exact path or `/`-delimited sub-path) via precompiled `SKIP_PATTERNS`, so only the intended paths and their legitimate sub-paths skip auth (fixes #209)
+
+## [1.9.47] - 2026-07-02
+
+### Fixed
+- API: `GET /api/health` now reflects subsystem health instead of always returning `200 ok`. It reports `degraded` with HTTP `503` when an **enabled and previously-healthy** subsystem (transport, cache, data) has broken — e.g. transport `session_open: false` after a connection recovery failure — and includes a per-component `components` breakdown (`enabled`/`healthy`/`detail`). A subsystem only degrades health if it was marked ready at boot (via `Legion::Readiness`); disabled or still-booting subsystems never fail the check. This makes the endpoint usable for load balancers and monitoring (fixes #194)
+
+## [1.9.46] - 2026-07-02
+
+### Fixed
+- API: `GET /api/extensions/tools` no longer 500s with `undefined method 'filter_tool_entries'`. The route block runs in the Sinatra instance context but `filter_tool_entries`/`serialize_tool_entry` are class methods on `Routes::Extensions`; they are now called on the explicit receiver, matching the pattern used by the other catalog routes. Added request specs for `/api/extensions/tools` (fixes #227)
+
+## [1.9.45] - 2026-07-02
+
+### Fixed
+- API: Teams delegated OAuth callback now forwards `tenant_id`/`client_id` to `Entra::Helpers::TokenManager.save_token(:delegated, …)` so browser-login tokens can be refreshed (previously omitted, forcing refresh to fall back to settings and silently fail for delegated-only logins). The unshipped `TokenCache` `require` that 500'd the callback was already removed in 1.9.43 (fixes #212)
+
+## [1.9.44] - 2026-07-01
+
+### Fixed
+- CLI: `connect status` now reads the Entra `TokenManager` (`token_data(:delegated)` + `expired?`) for the `microsoft` provider instead of the legacy `Legion::Auth::TokenManager` secret store, which the delegated/Teams login never writes to — previously always reported `microsoft: not connected` after a successful login (fixes #213)
+- CLI: `connect microsoft` now forwards `--tenant_id`/`--client_id`/`--scope` (as `--scopes`) explicitly to the Teams auth flow instead of dropping flag values via `ARGV.select`
+
 ## [1.9.43] - 2026-06-25
 
 ### Fixed