@dogpile/sdk 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## [0.6.0] — 2026-05-23
+
+v0.6.0 hardens the runtime for resilience and safety: bounded concurrency for tool and worker fan-out, sibling-failure cancellation across protocols, a host/private-network allowlist for the built-in web search adapter, header allowlisting for provider error metadata, and a pure redaction helper for safe trace serialization. Streaming chunk events drop the cumulative `output` field in favor of `text` deltas + `outputLength`.
+
+Prepared the release identity for `@dogpile/sdk@0.6.0` and `dogpile-sdk-0.6.0.tgz`.
+
+### Breaking
+
+- **`ModelOutputChunkEvent` no longer carries cumulative `output`.** Streaming chunk events now carry `text` as the delta and `outputLength` as the accumulated character length. This avoids repeatedly storing the full partial output in every chunk event.
+
+### Added
+
+- **`maxConcurrentAgentTurns?: number` on `DogpileOptions`, `EngineOptions`, and `RunCallOptions`.** Defaults to `4` and can be lowered per run to bound shared, broadcast, and coordinator worker fan-out independently from delegated child-run concurrency.
+- **New subpath: `@dogpile/sdk/runtime/redaction`.** Exports pure `redactTrace()`, `redactRunResult()`, and `TraceRedactionOptions` helpers for safe trace/result serialization. Defaults redact prompts, outputs, tool inputs/outputs, provider responses, and embedded child traces while preserving ids, ordering, costs, usage, and accounting summaries.
+- **`allowHosts?: readonly string[]` and `allowPrivateNetwork?: boolean` on `WebSearchToolAdapterOptions`.** The built-in web search adapter now enforces host and private-network policy before issuing fetches.
+- **`scripts/public-surface.json`.** Package export tests and the packed consumer smoke now share a small manifest for public subpath expectations.
+
+### Changed
+
+- Tool requests returned from a model response now execute with bounded concurrency while preserving transcript order.
+- Shared, broadcast, and coordinator worker fan-out now use bounded concurrency instead of unbounded `Promise.all`.
+- Shared, broadcast, and coordinator worker provider requests now receive a fan-out-aware abort signal so sibling failures cancel still-running provider calls.
+- `codeExec` sandboxes now receive a timeout-aware `AbortSignal`; Dogpile still returns a timeout if the sandbox ignores the signal.
+- Provider error details and Vercel AI response metadata now allowlist safe response headers and strip auth-like header keys before serialization.
+- npm publishing is canonical through manual `workflow_dispatch` from `main`; the GitHub Release `published` trigger no longer publishes.
+- Browser bundle output is minified and browser source maps exclude embedded `sourcesContent`.
+
 ## [0.5.0] — 2026-05-01
 
 v0.5.0 Observability and Auditability starts with provenance annotations: model provider calls now produce real request/response events, replay can synthesize those events from provider-call anchors, and callers get a small runtime helper for normalized provenance fields.