silas 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08d5115f914d3ff251c01f57b506951e3367717d777bfdd3d175a165169552f7'
-  data.tar.gz: 04e26fde565b7cf2d2a402316e095d6b0cf9f6a753b2d2444682890ec0ebe66f
+  metadata.gz: 35e622a6b7c17416ebe71717f1d072bd07c8a075f901c5b477177aa9bfccfa29
+  data.tar.gz: 59a87acd719063f275926852e255507d3c6159c16892907f70c8a77180dd61f8
 SHA512:
-  metadata.gz: 48d66589890f1c88e9ac8e1d476b131821907aea8c6e60d87300a42970e3e6a7bf52673020a94961f9bc32d2b3409cd6f735b6dfbb3d973ccaa86087298cb939
-  data.tar.gz: 9ddc0ddbba4ad607ecba6443b85492e94d72a058aab78f13ad256d62c2d0631f0a8d61cc0f37cd902d2701e821b4e5248aa7a1076321a2fe25f34fbf13c5a6c9
+  metadata.gz: 608b8bc79c926eadf04b74360e62832413580986c8ef5c6899b5acdc9371695db555799d9dd26d76b3aea77d2deafee13f32236cf8564c3cc6ad47692c58be80
+  data.tar.gz: f992423e27b802ae2efb6e7cf1c366f584ff703bd2210b9388b68abb9730616f2d16ded6b0da6e4b0a62c4c9fefd5becc8e8a85c6a17763d47dfd72bfef6d9ab

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.1.3
+
+- **Ledger: parallel graded gates.** When the model emits several tool calls in
+  one step, `settle!` now settles every invocation instead of stopping at the
+  first one that needs approval. An ungated call (e.g. a low-risk write) runs
+  immediately even when a gated sibling (e.g. a money move) parks for a human —
+  it is no longer stranded behind the approval. This changes only *timing*, not
+  safety: an unsettled sibling already executed on resume regardless of the
+  human's approve/decline, so stopping early only delayed independent work.
+  Regression test in `spec/silas/parallel_tool_calls_spec.rb`.
+
+## 0.1.2
+
+- **Security (email channel scaffold): approvals no longer go to the session
+  initiator.** The generated `Agent::Channels::Email#deliver_approval` mailed the
+  approve link to `email["from"]` — the address that started the session, which
+  for a support agent is the customer, letting them approve their own gated
+  request. It now routes to a configured operator (`SILAS_APPROVER_EMAIL`) and
+  fails closed (sends nothing) if unset. The Slack scaffold was unaffected (its
+  card posts to the team channel/thread, not the initiator).
+
 ## 0.1.1
 
 - **Fix: parallel tool calls.** When the model emitted several tool_use blocks

data/lib/generators/silas/install/templates/channel_email.rb

@@ -10,9 +10,20 @@ class Agent::Channels::Email < Silas::Channel
   end
 
   def deliver_approval(session:, invocation:)
-    email = session.metadata["email"] || {}
+    # SECURITY: an approval must go to an OPERATOR, never to whoever started the
+    # session. For an email-driven agent, session.metadata["email"]["from"] is
+    # the person who emailed in — often the customer — so mailing THEM the
+    # approve link lets them approve their own request. Route approvals to your
+    # ops/approver inbox instead, and fail closed if it isn't configured.
+    approver = ENV["SILAS_APPROVER_EMAIL"] # e.g. "approvals@yourcompany.com"
+    if approver.blank?
+      Rails.logger.warn("[Silas] SILAS_APPROVER_EMAIL unset — approval for " \
+                        "invocation #{invocation.id} not emailed (won't send to the sender).")
+      return
+    end
+
     Silas::ChannelMailer.approval(
-      to: email["from"], subject: "Approval needed: #{invocation.tool_name}", invocation: invocation
+      to: approver, subject: "Approval needed: #{invocation.tool_name}", invocation: invocation
     ).deliver_later
   end
 end

data/lib/silas/ledger.rb

@@ -34,12 +34,19 @@ module Silas
               "the continuation believes are committed."
       end
 
+      # Settle EVERY invocation in the step, then report whether the turn must
+      # park. When the model emits parallel tool calls, an ungated one must not
+      # be blocked by a gated sibling's approval — and it wouldn't be protected
+      # anyway: an unsettled sibling executes on resume regardless of whether the
+      # human approves or declines the gated call, so stopping at the first park
+      # only delays independent work. Execute what can proceed; park if any
+      # invocation is awaiting a human.
       def settle!(step, resolver:)
+        parked = false
         step.tool_invocations.order(:id).each do |invocation|
-          outcome = settle_invocation!(invocation, resolver)
-          return :parked if outcome == :parked
+          parked = true if settle_invocation!(invocation, resolver) == :parked
         end
-        :completed
+        parked ? :parked : :completed
       end
 
       # Drive a SINGLE freshly-created invocation to a terminal state — the

data/lib/silas/version.rb

@@ -1,3 +1,3 @@
 module Silas
-  VERSION = "0.1.1"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: silas
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Daniel St Paul