@geminixiang/mikan 1.0.0-beta.3 → 1.0.0-beta.30

package/CHANGELOG.md

@@ -9,6 +9,569 @@ any release.
 
 ## [Unreleased]
 
+## [1.0.0-beta.30]
+
+### Added
+
+- Add role-based subagent profiles for software engineering, DevOps, data science, account management, business development, creative production, advertising operations, and bounded general work.
+- Add a generated cross-module hardening report covering module boundaries, coupling, and verification evidence.
+
+### Changed
+
+- Stabilize exported module interfaces and route executor-dependent file staging through the active execution transport.
+- Deepen progressive response rendering and keep Slack E2E turns bound to the runner lifecycle.
+
+### Fixed
+
+- Prevent extension packages, attachment bridges, vault keys, sandbox paths, and event inputs from escaping their intended boundaries.
+- Close runner construction, cached-runner invalidation, Gondolin projection, and automatic Session Dream settlement races.
+- Validate model identifiers, event timezones, package refreshes, and shared-history watermarks consistently.
+- Keep reset history bounded by reset time and exclude queued future turns from session history.
+- Prevent Slack from posting bare working-indicator updates.
+
+### Security
+
+- Harden Git package materialization, extension subpaths, filesystem bridges, and sandbox path validation against traversal and symlink escapes.
+
+### Tests
+
+- Add regression coverage for declaration surfaces, session history boundaries, runtime races, event validation, package materialization, and Slack runner integration.
+
+## [1.0.0-beta.29]
+
+### Added
+
+- Add Git-sourced extension packages with global and conversation scopes, package mount resolution, CLI inspection, and admin portal management.
+- Add native Slack markdown-block responses and the `slack_blockkit` tool for interactive Block Kit messages.
+- Add interactive Block Kit APIs for extensions, with a poll extension example.
+- Add named subagent profiles, built-in workflow specialists, per-profile tool grants, and a bounded Slack progress dashboard.
+- Preserve durable memory with Session Dream before biweekly shared-channel session rotation, using the same conversation-scoped maintenance path as `/new`.
+
+### Changed
+
+- Run Gondolin runtimes inside the mikan process instead of detached workers. Restarts now boot fresh VMs on demand, and shutdown closes every VM so projected files sync back first.
+- Remove Gondolin runtime inventories, worker heartbeats, and the `stateDir` argument from `configureGondolinRuntime`.
+- Render standard GFM response prose as native Slack markdown blocks while keeping progressive response updates behind a single lifecycle.
+
+### Fixed
+
+- Keep the current session active and preserve saved memory when Session Dream cannot finish.
+- Bound subagent cancellation, invocation modes, profile labels, and Block Kit payloads; clamp long labels with an ellipsis instead of rejecting calls.
+- Show the selected subagent profile and its tool grant consistently in progress output.
+- Render the Slack subagent dashboard as a response source rather than escaped mrkdwn.
+- Isolate Git test fixtures from an ambient `GIT_DIR`.
+
+### Tests
+
+- Add coverage for extension packages, extension Block Kit APIs, native Slack rendering, subagent profiles and progress, Session Dream rotation, and in-process Gondolin lifecycle behavior.
+
+## [1.0.0-beta.28]
+
+### Removed
+
+- Remove Gondolin remote-worker and fleet support. `sandbox.gondolin.remote`, `gondolin:remote`, and `--worker-token` are no longer supported; use the local `gondolin:default` sandbox instead.
+
+### Fixed
+
+- Preserve Slack mrkdwn links whose labels contain spaces when rendering Block Kit responses.
+- Reuse the existing Slack progress message when streaming the final response, preventing duplicate or partially completed bot messages.
+
+## [1.0.0-beta.27]
+
+### Added
+
+- Preserve concrete long-term memory before `/new` creates a fresh DM session, while keeping transient context and pre-reset platform history out of the new model context.
+
+### Changed
+
+- Serialize workspace-mutating tools and memory-maintenance runs so file updates, resets, and incoming messages have deterministic ordering.
+- Align extension context and message hooks with the active agent lifecycle, including per-run system prompt rewrites that preserve dynamically rebuilt memory, skills, and sandbox context.
+
+### Fixed
+
+- Keep extension-rewritten messages consistent across tool execution, persistence, provider context, and lifecycle events.
+- Account for compaction model usage in run budgets and reject corrupted session trees instead of silently accepting broken history.
+- Wait for active runs before resetting sessions, and prevent old runs from writing after `/new`.
+- Keep long Slack continuations in their thread and preserve mrkdwn links when rendering Block Kit text.
+
+### Tests
+
+- Add real Slack coverage for memory-preserving `/pi-new`, long threaded responses, and Block Kit markdown links.
+- Add regression coverage for harness message identity, dynamic prompts, compaction budgets, session integrity, runtime settlement, and mutation-tool ordering.
+
+## [1.0.0-beta.26]
+
+### Fixed
+
+- Make the subagent tool schema compatible with OpenAI by exposing an object at the function parameter root.
+
+### Tests
+
+- Add regression coverage for OpenAI-compatible subagent function schemas.
+
+## [1.0.0-beta.25]
+
+### Changed
+
+- Temporarily remove the Agent Sandbox runtime, SDK, Kubernetes client, Helm deployment, runtime images, and related release workflow from the npm release.
+- Restore the Gondolin, Gondolin remote-worker, and Firecracker sandbox implementations while Agent Sandbox packaging is redesigned separately.
+
+### Fixed
+
+- Restore global npm installation and CLI startup after the broken Agent Sandbox dependencies in `1.0.0-beta.23` and `1.0.0-beta.24`.
+
+### Tests
+
+- Add a real `npm install -g --prefix` smoke test for the packed tarball, enforce a 2 MiB size ceiling, and gate CI and npm publishing on the result.
+
+## [1.0.0-beta.24]
+
+### Fixed
+
+- Bundle the vendored Agent Sandbox SDK in the npm package so global installs no longer fail on a missing repository-local tarball.
+- Reuse mikan's direct Kubernetes client dependency as an SDK peer instead of recursively bundling a duplicate dependency tree, keeping the published tarball under 1 MiB.
+
+### Tests
+
+- Add a pack-install smoke test that imports the bundled SDK, runs the packed CLI, enforces a 2 MiB size ceiling, and gates both CI and npm publishing.
+
+## [1.0.0-beta.23]
+
+### Added
+
+- Add Kubernetes Agent Sandbox execution with mandatory `kata-qemu` isolation, a pinned TypeScript client, managed idle cleanup, and shared workspace support.
+- Add a Helm chart with GKE Standard, Linux k3s, Colima, and router-only profiles; GKE supports Filestore CSI on an explicitly configured VPC.
+- Publish mikan, the Agent Sandbox runtime, and the pinned router source build to GHCR through a release-aware image workflow.
+- Expose detailed subagent input, output, cache, reasoning, and cost usage while retaining the existing summary aliases.
+
+### Changed
+
+- Replace Gondolin and Firecracker sandbox modes with `agent-sandbox:<warm-pool>`.
+- Make Helm the supported Kubernetes deployment interface; the default and Colima profiles use host execution, while GKE and k3s profiles require Kata and RWX storage.
+- Include delegated subagent usage in parent run statistics and budget accounting.
+
+### Removed
+
+- Remove the standalone `mikan-worker`, remote worker fleet, dial-home gateway, Gondolin runtime, Firecracker executor, worker CI, and worker release binaries. Existing Gondolin deployments must move to the Agent Sandbox Helm deployment; no automatic deployment or state migration is provided.
+
+### Security
+
+- Require Kata rather than silently falling back to runc, restrict the optional router to the configured mikan namespace with a NetworkPolicy, and keep generated PVCs by default on Helm uninstall.
+- Update transitive `js-yaml` to 4.3.0 to address the merge-key chain denial-of-service advisory.
+
+### Tests
+
+- Add Agent Sandbox unit coverage, Helm profile assertions, pinned router image builds, and full GKE validation covering Kata, Filestore RWX, browser recording, aborts, recovery, Slack, and LLM tool execution.
+- Add coverage for detailed subagent usage, compatibility aliases, failure paths, extension results, and parent budget accounting.
+
+## [1.0.0-beta.22]
+
+### Added
+
+- Let subagents opt into a normalized reference snapshot of the active parent conversation with `parentContext`, while keeping fresh isolated context as the default.
+
+### Changed
+
+- Raise default subagent limits from 8 to 100 turns, $0.50 to $10, and 2 to 10 minutes; return concrete budget or timeout reasons.
+- Apply the process-wide subagent concurrency ceiling to both tool- and extension-initiated runs, with cancellation while queued and usage attribution only to the active parent run.
+- Use collision-safe hashed keys for credential authorization and runtime resources. Exact legacy host and shared-container credentials remain readable, but users of ambiguous legacy managed-sandbox keys may need to run `/login` again.
+- Reject unsupported vault file mounts and mounts that overlap workspace or other credential targets.
+- Extract workspace projection and session lifecycle responsibilities into focused modules without intended runtime behavior changes.
+
+### Fixed
+
+- Reject session keys belonging to another conversation and unsafe conversation or thread identifiers.
+- Prevent session pointers and thread files from escaping their owning directory or resolving through symlinks.
+- Process Slack messages posted by known human users through user tokens even when Slack includes the posting app's `bot_id`; bot-authored messages remain ignored.
+- Clearly report subagent budget exhaustion instead of returning a generic incomplete status.
+
+### Tests
+
+- Add Slack E2E coverage for DMs, idle stop, thread isolation, busy queues, images, and multi-file uploads.
+- Add unit coverage for session identity and path safety, collision-safe sandbox identities, vault mount policy, session lifecycle, normalized subagent context, shared slots, cancellation, and budget reporting.
+
+## [1.0.0-beta.21]
+
+### Added
+
+- Fold each subagent's tokens and cost into the parent run's tally (`MikanAgentSession.recordExternalUsage`), so delegated spend counts against the parent run's budget instead of staying invisible to it.
+- Add a process-wide subagent fan-out ceiling shared across conversations.
+- Add `mikan --help` and a generated `mikan env` inventory from the daemon environment manifest.
+- Make the working-directory argument optional, defaulting to `<state-dir>/workspace`.
+- Add a public Gondolin runtime bootstrap seam for embedders.
+
+### Changed
+
+- Subagent runs never reject: request validation failures (unknown tools, invalid budgets, empty tasks, nested runs) now resolve to `failed` results, so one bad request in a `tasks`/`dag` batch can no longer orphan in-flight sibling subagents.
+- Cap parallel `tasks[]` batches at 4 concurrent subagents (the same limit as DAG mode) and run DAG waves through a slot pool instead of chunk barriers.
+- Report a subagent final response with no text as `failed` instead of `completed` with empty output.
+- Enforce parent budgets immediately when subagent usage is folded into the parent run.
+- Apply one state-directory precedence rule across boot, extensions, Sentry, and runtime readers.
+- Refuse model and sandbox settings updates while a conversation is busy, and invalidate affected cached runners consistently.
+- Drive PM2 environment configuration from `~/.mikan/mikan.env` instead of inline secrets.
+
+### Fixed
+
+- Harden Gondolin dial-home reconnects after transport failures and stale sessions.
+- Reject invalid one-shot event timestamps consistently across all event writers.
+- Apply global model settings to idle conversations and report busy conversations as stale.
+
+### Security
+
+- Keep PM2 secrets in an owner-only file outside repository trees and make the PM2 template supervision-only.
+
+### Tests
+
+- Add coverage for subagent accounting and concurrency, CLI and environment manifests, settings mutation, Gondolin reconnects and contracts, event formatting, and worker state layout.
+
+## [1.0.0-beta.20]
+
+### Fixed
+
+- Validate subagent `outputSchema` correctly when it arrives as plain JSON Schema (the only form tool calls can carry), instead of throwing `ValueCheckUnknownTypeError` because it lacks TypeBox's `Kind` metadata.
+
+### Tests
+
+- Add coverage for plain JSON Schema hydration, nested objects, arrays, unions, and validation failures.
+
+## [1.0.0-beta.19]
+
+### Added
+
+- Add fresh in-memory subagents for the main agent and extensions, with explicit tools, budgets, structured output, parallel batches, and bounded DAG orchestration.
+- Stream debounced subagent node progress through the shared Slack, Discord, and Telegram response lifecycle.
+
+### Changed
+
+- Let final responses at the LLM-call cap complete without tripping the run budget when no continuation is required.
+
+### Fixed
+
+- Install worker binaries from the newest GitHub release that contains a matching asset, including prereleases.
+- Restore generic Google Workspace CLI credential mounts in sandbox vaults.
+
+### Tests
+
+- Add coverage for subagent isolation, recursion guards, budgets, structured output, parallel execution, DAG validation and dependency flow, and platform-neutral progress rendering.
+
+## [1.0.0-beta.18]
+
+### Added
+
+- Add an idempotent Debian and Ubuntu worker-host initialization script.
+- Add persistent `mikan-worker` installation as a delegated systemd service.
+- Add NFS export detection with OS-specific setup guidance for `gondolin:remote` workspaces.
+- Ship host-side vault credential files securely to remote workers without placing them in the shared workspace.
+- Add bounded shared-workspace health probes and worker degradation reporting.
+
+### Changed
+
+- Require each Gondolin remote gateway and static worker to declare its shared `workspaceRoot`.
+- Exclude workers with unhealthy shared workspaces from new placements and restore them after a healthy heartbeat.
+
+### Fixed
+
+- Fail remote execution with actionable diagnostics instead of hanging on dead shared-workspace mounts.
+- Create runtime cgroups beneath the worker's delegated cgroup and report missing `Delegate=yes` configuration.
+- Verify downloaded worker binaries against the matching release checksum filename.
+- Validate `gondolin:remote` only after gateway and worker transports are configured.
+
+### Security
+
+- Materialize remote credential files as owner-only, read-only runtime files outside shared workspaces.
+
+### Tests
+
+- Add coverage for worker host services, cgroup delegation, workspace health, credential delivery, NFS advice, remote validation, and idle execution deadlines.
+
+## [1.0.0-beta.17]
+
+### Added
+
+- Add `gondolin:remote` for scheduling sandbox runtimes across a fleet of Linux/KVM workers.
+- Add a standalone `mikan-worker` daemon with mutual TLS, fenced leases, crash recovery, capacity-aware placement, draining, and sticky conversation assignment.
+- Add dial-home worker enrollment through one-time join tokens and a mikan-hosted gateway.
+- Add private workspace projection, vault injection, resource limits, lifecycle reconciliation, and drift recovery to Gondolin runtimes.
+- Add worker installation, enrollment, operations, and remote quickstart documentation with a one-command end-to-end smoke test.
+- Publish `mikan-worker` binaries and checksums with GitHub releases.
+
+### Changed
+
+- Rename the preview sandbox mode from `microvm:default` to `gondolin:default` and the image build command to `npm run gondolin:image:build`.
+
+### Fixed
+
+- Project mounted files correctly into Gondolin guests.
+- Refresh rotated credentials when Gondolin runtimes are recreated.
+
+### Security
+
+- Authenticate remote workers with mutual TLS and fence stale workers through expiring leases.
+- Keep enrollment tokens one-time and store worker credentials privately.
+
+### Tests
+
+- Add coverage for Gondolin lifecycle, workspace isolation, vaults, resource controls, fleet scheduling, gateways, enrollment, workers, leases, and remote execution.
+
+## [1.0.0-beta.16]
+
+### Added
+
+- Add a preview `gondolin:default` sandbox backed by Gondolin and QEMU.
+- Add a curated microVM guest image build with Node.js, Python, uv, Git, ripgrep, fd, jq, SSH, and build tools.
+- Manage one process-local microVM per conversation with idle shutdown and recreation on demand.
+
+### Changed
+
+- Broaden the coverage gate across all source modules.
+
+### Fixed
+
+- Keep top-level Slack file uploads out of threads.
+
+### Tests
+
+- Add coverage for microVM execution and lifecycle, events, logging, disabled vaults, channel storage, and core file and shell tools.
+
+## [1.0.0-beta.15]
+
+### Added
+
+- Add native image generation with automatic upload through the active model provider.
+- Add extension chat commands via `api.registerCommand`: deterministic `/name` dispatch with no model call; built-ins and first registrations win.
+- Add an extension disposal lifecycle (`api.onDispose` or an `activate` return value), run when a harness instance is discarded (`/pi-new`, idle eviction, session rotation).
+- Add `api.triggerRun(text)` to fire an immediate autonomous agent run, `api.uploadFile(path, title)` for proactive file uploads, and an explicit `conversationId` option on `api.notify` for cross-conversation posting.
+- Add `agent_error` and `budget_exceeded` extension hooks so monitoring extensions see failed turns and tripped run budgets.
+- Pass a `RunOrigin` (platform, triggering message id, user identity, attachments) to extension hook events, making `api.react` and per-user extension policy usable.
+- Let `before_agent_start` extensions rewrite the user prompt or block the turn before the model runs; blocked turns leave no trace in the transcript or session store.
+- Let `tool_result` extensions rewrite tool output (content and error flag) before the model and the session store see it, enabling secret redaction and output truncation.
+
+### Changed
+
+- Dispatch `before_agent_start` and `tool_result` hooks with chaining semantics (each handler sees earlier handlers' rewrites; any `block` wins) instead of first-result-wins.
+
+### Fixed
+
+- Dispose cached runners when models switch or environment credentials refresh.
+
+### Tests
+
+- Add coverage for image generation, extension lifecycle and hook rewrites, and runner disposal.
+
+## [1.0.0-beta.14]
+
+### Added
+
+- Add GitHub inline review-thread intake and a `github_review_reply` tool.
+- Add `github_sync`, `github_read`, and `github_issue` tools for repository refresh and issue or pull request operations.
+- Add host-side Cloud Build log retrieval using GCP ADC or Workload Identity Federation.
+- Add a minimal embedder example that runs without portal services.
+
+### Changed
+
+- Update eligible GitHub pull request head branches in place instead of opening duplicate pull requests.
+- Drive platform command registration and routing from a shared command manifest.
+- Use one cross-platform stop grammar, including `/stop` in GitHub conversations.
+- Route sandbox file reads and writes through executors with staged, shell-safe transport.
+- Keep sandbox settings nested through configuration resolution and updates.
+
+### Fixed
+
+- Preserve raw session keys when using Slack's Force Stop button.
+- Spill large bash output into the runtime workspace so sandboxed agents can read it.
+- Keep malformed event files visible in the admin portal for deletion.
+- Unify platform formatting guidance across adapter and conversation contexts.
+
+### Security
+
+- Keep Cloud Build credentials host-side and outside agent sandboxes.
+- Centralize runtime identity and sandbox path sanitization.
+
+### Tests
+
+- Add coverage for GitHub tool operations, review threads, Cloud Build logs, executor file transport, command manifests, runtime embedding, and session serialization.
+
+## [1.0.0-beta.13]
+
+### Added
+
+- Add the `max` thinking level to commands, configuration, and the admin portal.
+- Add quickstart and extension development guides across all supported locales.
+
+### Changed
+
+- Update pi agent dependencies to 0.80.6.
+- Load platform-specific tool packs only for their configured adapters.
+- Improve `github_checks` output and guidance for external CI providers.
+- Synchronize configuration, platform, sandbox, session, skill, event, portal, and deployment documentation across locales.
+
+### Fixed
+
+- Fix broken CLI tables and dead documentation links across locales.
+
+### Security
+
+- Derive ambient shared-vault access from each platform's declared trust model and sandbox topology.
+
+### Tests
+
+- Add coverage for platform tool-pack isolation, external CI checks, and vault trust policy.
+
+## [1.0.0-beta.12]
+
+### Added
+
+- Let `github_checks` fetch the log tail for a failing GitHub Actions job by job ID.
+
+### Changed
+
+- Require GitHub App Actions read permission for job log inspection.
+
+### Fixed
+
+- Treat skipped and neutral GitHub checks separately from failures in check summaries.
+
+### Tests
+
+- Add coverage for job log retrieval and check conclusion classification.
+- Use collision-resistant temporary directories across parallel tests.
+
+## [1.0.0-beta.11]
+
+### Added
+
+- Add a read-only `github_checks` tool for inspecting branch and pull request check runs.
+
+### Changed
+
+- Make `github_pr` idempotent so pushing an existing branch updates its open pull request.
+- Teach the GitHub agent workflow to inspect CI, fix failures, and push updates.
+- Require GitHub App Checks read permission for CI inspection.
+
+### Tests
+
+- Add coverage for GitHub check summaries and existing pull request updates.
+
+## [1.0.0-beta.10]
+
+### Fixed
+
+- Retry cloning a GitHub repository on later triggers when the conversation clone is missing.
+
+### Security
+
+- Stop applying the ambient default shared vault to GitHub conversations while preserving explicit conversation vault grants.
+- Document the platform, shared machine, and personal credential trust boundaries.
+
+### Tests
+
+- Add coverage for GitHub clone retries and platform-gated default vault resolution.
+
+## [1.0.0-beta.9]
+
+### Added
+
+- Clone GitHub repositories into conversation workspaces and check out pull request heads.
+- Add a `github_pr` tool that pushes agent changes from `pi/*` branches and opens pull requests.
+
+### Changed
+
+- Require GitHub App Contents read and write permission for repository automation.
+- Post completed GitHub responses as single comments instead of streaming edits.
+
+### Fixed
+
+- Keep GitHub issue context inside the history recency window.
+
+### Security
+
+- Require commenters to have repository write permission or higher before triggering the agent.
+- Keep installation tokens out of sandboxes and restrict agent pushes to non-force `pi/*` branches.
+
+### Tests
+
+- Add coverage for GitHub repository checkout, permission gating, pull request creation, and branch restrictions.
+
+## [1.0.0-beta.8]
+
+### Added
+
+- Add a GitHub messaging adapter where each issue or pull request is an independent conversation.
+- Add GitHub App authentication, mention and participation triggers, persisted polling cursors, and downtime replay.
+- Add GitHub adapter deployment configuration and documentation.
+
+### Tests
+
+- Add coverage for GitHub polling, authentication, conversation context, triggers, and responses.
+
+## [1.0.0-beta.7]
+
+### Added
+
+- Add TypeScript and npm-package extensions with `package.json` entrypoints and runtime dependencies.
+- Add `mikan ext install`, `validate`, `list`, and `remove` commands.
+- Add extension installation from Git sources and repository subpaths.
+
+### Changed
+
+- Treat reinstalling an extension as an update while preserving its data directory.
+- Use `package.json` as the primary extension metadata source with `manifest.json` as a fallback.
+- Convert the agent project manager example to TypeScript with a typed extension API.
+- Add the Slack `reactions:write` scope and missing slash commands to the manifests and setup guides.
+
+### Tests
+
+- Add coverage for TypeScript loading, package metadata, extension CLI operations, and Git installation.
+
+## [1.0.0-beta.6]
+
+### Added
+
+- Add emoji reactions for agents and extensions across Slack, Discord, and Telegram.
+
+### Changed
+
+- Default the agent project manager example to conversation-scoped extension data.
+- Log when extensions rewrite the system prompt and report the resulting size change.
+
+### Fixed
+
+- Render Slack session links outside the triggered-by italic span.
+
+### Tests
+
+- Add coverage for the reaction tool and extension reaction API.
+
+## [1.0.0-beta.5]
+
+### Added
+
+- Add `api.paths.sharedDataDir` for extension state intentionally shared across conversations.
+- Add an idempotent, dry-run-first script for migrating extension code and data to the new layout.
+
+### Changed
+
+- Store conversation extension code and data under `conversations/<id>/` and global extension assets under `global/`.
+- Make `api.paths.dataDir` conversation-scoped by default to prevent accidental cross-conversation state sharing.
+
+### Tests
+
+- Update extension loader and command coverage for the conversation-scoped layout.
+
+## [1.0.0-beta.4]
+
+### Changed
+
+- Show an extension's slug in `/pi-extensions` when it differs from the manifest display name.
+
+### Fixed
+
+- Reject extensions installed directly at a scope root and show an actionable warning to use a named subdirectory.
+
+### Tests
+
+- Add coverage for scope-root extension mis-install detection and inventory warnings.
+
 ## [1.0.0-beta.3]
 
 ### Fixed