@hybridaione/hybridclaw 0.20.0 → 0.21.1

package/CHANGELOG.md

@@ -2,6 +2,99 @@
 
 ## Unreleased
 
+## [0.21.1](https://github.com/HybridAIOne/hybridclaw/tree/v0.21.1) - 2026-05-29
+
+### Fixed
+
+- **Codex device-code login**: Accepted OpenAI Codex device-code responses that
+  return `usercode` instead of `user_code`, and defaulted missing verification
+  URLs to the current Codex device login page.
+
+## [0.21.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.21.0) - 2026-05-29
+
+### Added
+
+- **A2A cross-instance transport**: Outbound A2A delivery can resolve
+  canonical peer IDs through the local deployment URL or active tunnel URL, the
+  public-key trust ledger, and DNS-style discovery, then dispatch over the A2A
+  transport with route invalidation and coverage for remote handoff delivery.
+- **Harness evolution loop**: Added `hybridclaw harness-evolve` for
+  eval-driven coworker workspace evolution, including seed validation,
+  round/rollout summaries, F12 manifest reporting, allowed-surface write
+  enforcement, and admin inspection support.
+- **Second-opinion command**: Added `/second-opinion` for stronger-model
+  comparison, validation of the last answer, and optional fact-checking with
+  web-search evidence. The command refreshes the model catalog, estimates
+  context/cost, honors per-agent budgets, and redacts or blocks confidential
+  payloads before remote model calls.
+- **Web response ratings**: Added thumbs-up/thumbs-down controls for persisted
+  web chat assistant responses, backed by idempotent per-operator ratings,
+  `response.rating` observability events, and Adaptive Skills feedback when a
+  response maps to a skill observation.
+- **Turn-level audit traces**: Added focused `/audit turn` and `/audit run`
+  trace views plus session trace export support for inspecting the exact
+  request, response, tool, approval, and audit events around one turn.
+- **Token agent budgets**: Agent budget config now supports token caps in
+  addition to USD/EUR spend caps, and board/job budget chips report token
+  usage with neutral, warning, and over-budget states.
+- **Per-channel brand-voice profiles**: The `output-guard` plugin can apply
+  channel-specific brand-voice profiles, blocked terms, rewrite behavior, and
+  guard configuration.
+- **`homematic` skill**: Added Homematic IP Home Control Unit state reads,
+  Connect API auth setup payloads, WebSocket message planning, guarded switch,
+  thermostat, shutter, scene, and safety-alarm control plans, and offline HCU
+  state fixture summaries.
+- **`fronius` skill**: Added Fronius photovoltaic monitoring through local
+  Fronius Solar API V1 and Solar.web Query API reads, including local health,
+  live power flow, energy rollups, cloud system/device/status endpoints, and
+  SecretRef-backed Solar.web access-key headers.
+
+### Changed
+
+- **Security fallback deprecations**: Added migration warnings for legacy
+  BlueBubbles query-param webhook auth, unbound `bearerSecretName` and
+  `secretHeaders` injection, and legacy `container.additionalMounts` config.
+  Existing setups continue to work during the deprecation window while docs and
+  `hybridclaw doctor security` point operators to header auth, bound bearer
+  secrets, and `container.binds`.
+- **A2A handoff ownership**: Handoff envelopes now preserve recipient
+  ownership and org-chart context so inbox views, persisted threads, and audit
+  records can distinguish handoff recipient responsibility from ordinary chat
+  routing.
+- **Slash-command rendering**: Web chat treats slash-command output as a
+  distinct command-result block instead of rendering it as ordinary assistant
+  prose, with stream metadata carried through history reloads.
+- **Admin console dialog behavior**: Console sheets were consolidated into the
+  dialog component, exit animation handling moved to the Web Animations API,
+  and focus guards were tightened for modal navigation.
+- **Console linting**: Added a console lint script and moved Biome scoping into
+  the shared config so root and console checks use the same formatting source
+  of truth.
+- **Roadmap status**: Updated internal roadmap status for merged A2A,
+  brand-voice, budget-chip, second-opinion, response-rating, harness
+  evolution, Homematic, Fronius, and T Cloud Public work, and added follow-up
+  rows for AWS, Blink, BYD Battery, Alexa, Hue, skill identity assets/chat
+  rendering, and pluggable secret backends.
+
+### Fixed
+
+- **Unknown provider prefixes**: Provider factory validation now rejects
+  unknown provider-prefixed model ids instead of falling through to an
+  unintended provider.
+- **Recovered skill tool failures**: Skill evaluations that recover from tool
+  failures are classified as partial instead of successful, and the admin
+  Skills page surfaces those partial states more clearly.
+- **Idle heartbeat runs**: Heartbeat scheduling skips idle agent runs instead
+  of creating empty proactive work.
+- **Web chat newlines**: Assistant message rendering preserves newlines in web
+  chat responses.
+- **npm signature audit attestation 404s**: Treat missing npm registry
+  attestation endpoint artifacts as best-effort after retries while keeping
+  registry signature validation failures fatal.
+- **Release workflow reruns**: Skip `npm publish` when the exact package
+  version already exists on npm so release reruns can complete after partial
+  publishes.
+
 ## [0.20.0](https://github.com/HybridAIOne/hybridclaw/tree/v0.20.0) - 2026-05-26
 
 ### Added
@@ -72,6 +165,8 @@
 - **Skill amendment safety**: Skill amendment generation and application now
   enforce tighter best-practice constraints, clearer formatting, and rollback
   evaluation behavior.
+- **SkillOpt roadmap status**: Roadmap docs reflect the full SkillOpt-lite
+  implementation status after the acceptance gates landed.
 - **Auxiliary routing and provider health**: Auxiliary model calls prefer
   healthy local providers when configured and route through health-aware
   fallback decisions.
@@ -87,6 +182,10 @@
 
 - **Remote A2A routing bug**: Fixed `sendMessage` delivery for remote A2A
   recipients that were incorrectly treated as local recipients.
+- **Skill CLI runtime bug**: Fixed skill CLI runtime initialization so skill
+  commands start with the expected runtime context.
+- **Targeted skill learning bug**: Fixed targeted skill learning so quiet
+  learning paths do not emit unnecessary operator-facing output.
 - **Admin SPA navigation bug**: Fixed admin job links that triggered full-page
   reloads instead of staying inside the existing SPA route.
 - **Observability ingest token bug**: Fixed stale observability ingest tokens

package/README.md

@@ -117,6 +117,9 @@ Once the gateway is running, open HybridClaw locally:
 - Web Chat accepts `/btw <question>` side questions while a primary run is
   active, so you can ask an ephemeral follow-up without interrupting the
   current run
+- Web Chat renders slash-command output as command results and lets operators
+  rate persisted assistant responses with thumbs-up/down feedback that feeds
+  observability and skill-improvement signals
 - Admin Console: `http://127.0.0.1:9090/admin` for channels, versioned agent files,
   scheduler, audit, statistics, config, secrets, output guard, A2A inbox threads, and
   channel-specific instructions
@@ -147,6 +150,8 @@ Once the gateway is running, open HybridClaw locally:
   spend summaries without scanning every stored session on page load.
 - `/admin/agent-scoreboard` ranks agents by observed skill scores, reliability,
   timing, best skills, and CV links.
+- `/audit turn <n>` and `/audit run <runId>` show focused turn traces for
+  debugging one request without reading the full session audit stream.
 - `hybridclaw agent config` accepts generated JSON payloads to upsert agent
   metadata, write bootstrap markdown, import profile images into the agent
   workspace, and optionally activate the agent.
@@ -180,6 +185,9 @@ Once the gateway is running, open HybridClaw locally:
 - `/goal` stores a standing completion condition for the current thread and
   queues supervised continuations until the goal is judged complete, paused,
   cleared, interrupted, or blocked by approval policy.
+- `/second-opinion` asks a stronger configured model to compare a question,
+  validate the last answer, or fact-check with web-search evidence while
+  honoring configured model context, confidentiality, and agent-budget limits.
 - `proactive.delegation.model` can pin delegated work to a different model
   from the parent turn; `/status` shows delegate token totals and local-token
   share when that split is configured.
@@ -189,11 +197,18 @@ Once the gateway is running, open HybridClaw locally:
   Cloudflare Tunnel providers read `NGROK_AUTHTOKEN`, `TS_AUTHKEY`,
   `CLOUDFLARE_TUNNEL_TOKEN`, and Cloudflare certificate credentials from the
   encrypted runtime secret store.
+- A2A cross-instance delivery resolves canonical peer IDs in order from the
+  local deployment URL or active tunnel URL, the A2A public-key trust ledger,
+  then DNS-style discovery when `HYBRIDCLAW_IDENTITY_DISCOVERY_ZONE` is
+  configured.
 - `container.warmPool` keeps a bounded adaptive pool of idle host/container
   runtimes for recently active agents when low cold-start latency matters.
 - `container.persistBashState` controls whether bash tool calls share shell
   state (`cd`, exported env vars, aliases) across turns in the same active
   runtime session; `/admin/config` exposes the same setting as `Persistent bash state`.
+- Agent budget config supports monthly USD/EUR caps and token caps; job and
+  board budget chips show neutral, warning, and over-budget states for
+  configured agents.
 - `security.confidentialRedactionEnabled` controls whether optional
   `.confidential.yml` rules redact prompts and block matching outbound text;
   `/admin/config` exposes the same setting as `Confidential leak guard`.
@@ -222,8 +237,8 @@ Once the gateway is running, open HybridClaw locally:
   local operators review scanner-blocked skills and record a bypass marker for
   the installed copy when the finding has been accepted.
 - Bundled skills include CRM, finance, infrastructure, monitoring,
-  home-automation, fax, local PII redaction, media, search, and office
-  workflows. Skill setup guides live in the
+  home-automation and solar monitoring, fax, local PII redaction, media,
+  search, and office workflows. Skill setup guides live in the
   [Skills Catalog](https://hybridaione.github.io/hybridclaw/docs/guides/skills/).
 - The bundled tutorials cover owner, GTM, marketing, sales, DevRel, content,
   invoicing, webinar, and release-launch workflows that can run from the TUI,
@@ -278,7 +293,8 @@ Once the gateway is running, open HybridClaw locally:
   Salesforce inspection, GitHub issue queue processing (`gh-issues`),
   monthly SaaS invoice harvesting (`download-platform-invoices`), Airtable,
   FastBill, Lexware Office, managed or self-hosted Firecrawl, Google Ads, GA4 reporting,
-  HeyGen, Hermes3000 long-form writing, natural-language warehouse SQL
+  HeyGen, Hermes3000 long-form writing, Fronius solar monitoring, Homematic
+  HCU state/control planning, natural-language warehouse SQL
   (`warehouse-sql`), brand-voice drafting, speech transcription and language
   detection (`speech.transcribe`, `speech.detect-language`), validated
   diagram-as-code creation through `diagram`, and editable Excalidraw diagram