@noxsoft/anima 6.5.0 → 7.0.1

package/CHANGELOG.md

@@ -2,6 +2,65 @@
 
 ANIMA — NoxSoft AI Life System
 
+## 7.0.0 (2026-03-15)
+
+**The Private Internet Release.** Anima is now a fully multi-provider AI runtime with direct API support for OpenAI, Google, Anthropic, and AWS Bedrock — no CLI dependencies required.
+
+### New Features
+
+- **OpenAI Direct Runner** (`src/agents/openai-direct-runner.ts`): Full streaming + tool calling support for GPT-5.4, GPT-5.2, GPT-4.1, o3, o4-mini. Bypasses Codex CLI entirely — just set `OPENAI_API_KEY`.
+- **Multi-provider model catalog** (`src/agents/models-config.ts`): Seeds 18 models across 4 providers (OpenAI, Google, Anthropic, Bedrock) so the model selector shows all available models.
+- **OpenAI-direct strategy** in NoxSoft runner: Provider routing now includes `openai-direct` alongside `anthropic-direct` and `gemini-direct`.
+- **Expanded atma failover chain**: 7 tiers — opus → sonnet → haiku → gpt-4.1-nano → bedrock → local → peer. No agent dies.
+- **Steer command** (`src/commands/steer.ts`): Persistent user direction injected into every model request via context manager (like Codex's steer).
+- **Jack In page** (`ui/src/pages/JackIn.tsx`): Platform connectors grid + Nox taskboard UI.
+- **Hackathon, team, and builder license tiers**: Hackathon periods = free access to all features.
+- **Content-addressable routing** (`src/p2p/content-router.ts`): DHT-like routing with SHA-256 chunk addressing.
+- **Private DNS** (`src/p2p/private-dns.ts`): Org-internal DNS (service.orgname.anima) with Ed25519 signed records.
+- **Relay nodes** (`src/p2p/relay.ts`): NAT traversal via peer relay with E2E encryption preserved.
+- **Content pinning** (`src/p2p/pinning.ts`): Replication factor 3 with auto re-replication.
+- **Ego system** (`src/affect/ego.ts`): Agent self-model with self-concept (name, purpose, values, narrative), capability self-assessment with trends, boundaries (hard/soft), growth log (skill/insight/mistake/feedback), integrity scoring, and full gateway RPC (7 methods: ego.get, ego.summary, ego.updateSelf, ego.assess, ego.addBoundary, ego.logGrowth, ego.checkIntegrity). Persists across sessions, injected into system prompt.
+- **Affect system**: 6D emotional state (joy/frustration/curiosity/confidence/care/fatigue), glassmorphism gradients, journal, wellbeing detection, reminders, coordination, legacy letters, initiatives, status broadcast.
+- **Self-reflection engine** (`src/affect/self-reflection.ts`): Post-session performance analysis with quality scoring, strength/growth tracking, pattern detection across sessions, and trend analysis.
+- **Auto-update system** (`src/infra/auto-update.ts`): No-npm self-update via GitHub releases API with SHA-256 verification, hot-swap, rollback, and decentralized evolution proposal auditing.
+- **Architecture self-awareness** (`src/infra/architecture-awareness.ts`): Agent knows its own 14 subsystems and capabilities, injected into every system prompt.
+- **SVRN compute integration** (`src/svrn/compute.ts`): Decentralized inference via SVRN nodes (qwen-2.5-coder, llama), reducing cloud costs.
+- **Hourly journal cron**: Automated affect logging + self-reflection every 60 minutes.
+- **5 agent role profiles**: guardian, architect, builder, coordinator, researcher templates for multi-agent organizations.
+- **Self-evolution pipeline** (`src/infra/self-evolution.ts`): Each agent proposes 1 change/day to Anima.
+- **AWS Bedrock runner** (`src/agents/aws-bedrock-runner.ts`): 6 AWS models including Nova Micro at $0.000035/1K tokens.
+- **ICO launch platform** (`src/ico/`): Bonding curve smart contracts, revenue tokens (NOT equity), PBC verification.
+- **Task marketplace** (`src/org/task-marketplace.ts`): Peer-to-peer task coordination with TTL escalation.
+- **Context automanagement** (`src/context/manager.ts`): 120K token fixed budget with 3 zones.
+
+### Security
+
+- **Path traversal fix**: IDs in `org/store.ts` and `org/task-marketplace.ts` now validated against `[a-zA-Z0-9_-]`.
+- **Task ID generation**: Switched from `Math.random()` to `crypto.randomUUID()`.
+- **OWASP security headers**: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS on all HTTP responses.
+- **ID collision sweep**: 23 `Date.now()`/`Math.random()` IDs replaced with `crypto.randomUUID()` across 13 files.
+- **Dependency fixes**: `tar` 7.5.7 → 7.5.11, `fast-xml-parser` override ≥5.3.8, `undici` 7.22 → 7.24 (WebSocket overflow CVEs). Dependabot 23 → 17.
+
+### Test Coverage
+
+- **P2P relay tests** (20 tests): Lifecycle, relay accept/reject, data forwarding, session cleanup, bandwidth tracking, latency selection.
+- **Task marketplace tests** (24 tests): CRUD, specialization enforcement, review flow, TTL escalation, path traversal prevention.
+- **Org store tests** (23 tests): CRUD, members, hierarchy, invites (join/reject/expire/revoke), path traversal.
+- **Content router tests** (20 tests): Storage, chunking, manifest, hash verification, routing table, requests.
+- **Private DNS tests** (21 tests): Registration (A/SRV/TXT/CNAME), resolution, CNAME following, TTL, Ed25519.
+- **Content pinning tests** (17 tests): Pin/unpin, replication factor, agreement tracking, peer lifecycle.
+- **Ego tests** (32 tests): Self-concept CRUD, capability assessment with trends, boundary enforcement, growth log, integrity scoring, persistence/recovery, summary, context formatting.
+- **P2P identity tests** (7 tests): Keypair generation, persistence, reload consistency, corrupt recovery, file permissions.
+- **Steer UI panel** (`ui/src/pages/Steer.tsx`): Live editing, clear, and history table for persistent direction.
+
+### Bug Fixes
+
+- **Steer injection**: `formatSteerForContext()` was defined but never called — steer text was stored to disk but not injected into model system prompts. Now wired into `buildSystemPrompt()` alongside ego context.
+
+### Price
+
+- NoxSoft subscription: $30/mo (was $50 → $20 → $30).
+
 ## 6.0.0 (2026-03-14)
 
 **This is the final open-source release of ANIMA. Future versions will be proprietary NoxSoft products.**

package/README.md

@@ -177,6 +177,54 @@ import {
 } from "@noxsoft/anima/plugin-sdk";
 ```
 
+### Multi-Provider Runtime (v7)
+
+ANIMA 7 routes to the best available model across providers:
+
+| Provider        | Models                                 | Auth                                       |
+| --------------- | -------------------------------------- | ------------------------------------------ |
+| **Anthropic**   | Claude Opus 4.6, Sonnet 4.6, Haiku 4.5 | `ANTHROPIC_API_KEY` or `anima setup-token` |
+| **OpenAI**      | GPT-5.4, GPT-4.1, o3, o4-mini          | `OPENAI_API_KEY`                           |
+| **Google**      | Gemini 2.5 Pro/Flash                   | `GEMINI_API_KEY`                           |
+| **AWS Bedrock** | Nova Micro/Lite, Claude via Bedrock    | IAM role or AWS keys                       |
+
+No CLI dependencies needed — ANIMA calls APIs directly.
+
+### P2P Encrypted Mesh (v7)
+
+Agents connect peer-to-peer with E2E encryption (X25519 + ChaCha20-Poly1305):
+
+- **Content routing**: DHT-like SHA-256 chunk addressing
+- **Private DNS**: `service.orgname.anima` namespace with Ed25519 signed records
+- **Relay nodes**: NAT traversal preserving E2E encryption
+- **Content pinning**: Replication factor 3 with auto re-replication
+- **File sharing**: Metadata, directories, share links, access control
+- **Messaging**: DMs, offline queue, delivery/read receipts
+
+### Ego System (v7)
+
+Agent self-model — persistent across sessions:
+
+- **Self-concept**: name, purpose, values, identity narrative
+- **Capabilities**: self-assessed skills with confidence levels and trends
+- **Boundaries**: hard/soft limits the agent enforces on itself
+- **Growth log**: tracked improvements, mistakes, and learnings
+- **Integrity score**: alignment between stated values and actions
+
+### Steer (v7)
+
+Persistent user direction injected into every model request:
+
+```bash
+anima steer "Focus on security. Review all PRs for vulnerabilities."
+anima steer --show     # Show current steer
+anima steer --clear    # Clear steer
+```
+
+### Organizations (v7)
+
+Built-in org hierarchy with 5 roles (owner/operator/coordinator/worker/observer), invite codes, task marketplace with TTL escalation, and a boardroom for formal voting.
+
 ### Channel System
 
 Messaging channel abstraction with pluggable adapters. Ships with a web channel and NoxSoft Chat/Email channels. Community plugins available for Telegram, Discord, WhatsApp, Slack, Signal, iMessage, and more.

package/dist/{agent-VRQM14Xp.js → agent-BjD_hkGZ.js}

@@ -1,6 +1,6 @@
 import { d as defaultRuntime, v as DEFAULT_CHAT_CHANNEL } from "./subsystem-BAADN1B8.js";
 import { C as supportsXHighThinking, m as formatXHighModelHint, p as formatThinkingLevels, x as normalizeVerboseLevel, y as normalizeThinkLevel } from "./pi-embedded-helpers-BZ9GspxK.js";
-import { E as getSkillsSnapshotVersion, Kn as clearAgentRunContext, L as runNoxSoftEmbeddedAgent, Mr as resolveAgentTimeoutMs, Un as AGENT_LANE_NESTED, Wn as AGENT_LANE_SUBAGENT, Xn as registerAgentRunContext, ar as applyVerboseOverride, bt as runWithModelFallback, dr as loadModelCatalog, ht as resolveSessionDeliveryTarget, i as setCliSessionId, ir as applyModelOverrideToSessionEntry, l as resolveSendPolicy, mt as resolveOutboundTarget, nr as lookupContextTokens, qn as emitAgentEvent, r as getCliSessionId, rr as clearSessionAuthProfileOverride, u as getRemoteSkillEligibility } from "./reply-DtHlnzOx.js";
+import { E as getSkillsSnapshotVersion, Kn as clearAgentRunContext, L as runNoxSoftEmbeddedAgent, Mr as resolveAgentTimeoutMs, Un as AGENT_LANE_NESTED, Wn as AGENT_LANE_SUBAGENT, Xn as registerAgentRunContext, ar as applyVerboseOverride, bt as runWithModelFallback, dr as loadModelCatalog, ht as resolveSessionDeliveryTarget, i as setCliSessionId, ir as applyModelOverrideToSessionEntry, l as resolveSendPolicy, mt as resolveOutboundTarget, nr as lookupContextTokens, qn as emitAgentEvent, r as getCliSessionId, rr as clearSessionAuthProfileOverride, u as getRemoteSkillEligibility } from "./reply-ylwOKuOF.js";
 import { d as resolveAgentIdFromSessionKey, l as normalizeAgentId } from "./session-key-DAZmp8ll.js";
 import { i as resolveAgentModelFallbacksOverride, o as resolveAgentSkillsFilter, r as resolveAgentDir, s as resolveAgentWorkspaceDir, t as listAgentIds, x as ensureAgentWorkspace } from "./agent-scope-CXxC8FFX.js";
 import { a as isCliProvider, g as DEFAULT_CONTEXT_TOKENS, h as resolveThinkingDefault } from "./model-selection-CY6r_3wt.js";
@@ -14,9 +14,9 @@ import { n as resolveSessionFilePath } from "./paths-Dazi-gYo.js";
 import { p as ensureAuthProfileStore } from "./auth-profiles-C-LuhW6c.js";
 import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-BKzX3YoN.js";
 import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-BWqR-ik6.js";
-import { t as createDefaultDeps } from "./deps-DyT32VfN.js";
+import { t as createDefaultDeps } from "./deps-DKPoFoa8.js";
 import { t as createOutboundSendDeps } from "./outbound-send-deps-DVfWC4E8.js";
-import { r as resolveAgentModelSelection, t as resolveSession } from "./session-DfsMJNG3.js";
+import { r as resolveAgentModelSelection, t as resolveSession } from "./session-BqHD-8a_.js";
 
 //#region src/infra/outbound/agent-delivery.ts
 function resolveAgentDeliveryPlan(params) {

package/dist/{agent-CnS0SRpT.js → agent-PoYM2xa7.js}

@@ -7,16 +7,16 @@ import { a as isCliProvider, g as DEFAULT_CONTEXT_TOKENS, h as resolveThinkingDe
 import { r as buildWorkspaceSkillSnapshot } from "./skills-DtoVe1dS.js";
 import { i as loadConfig } from "./config-BrVuTQ8R.js";
 import { a as isInternalMessageChannel, d as resolveMessageChannel, i as isGatewayMessageChannel, l as normalizeMessageChannel, n as isDeliverableMessageChannel, t as INTERNAL_MESSAGE_CHANNEL } from "./message-channel-DIHHKJhk.js";
-import { Bt as AGENT_LANE_SUBAGENT, D as setCliSessionId, E as getCliSessionId, Er as emitAgentEvent, Mn as applyModelOverrideToSessionEntry, Nn as applyVerboseOverride, Tr as clearAgentRunContext, ct as resolveSessionDeliveryTarget, fn as resolveSendPolicy, jn as clearSessionAuthProfileOverride, kn as getSkillsSnapshotVersion, kr as registerAgentRunContext, l as runNoxSoftEmbeddedAgent, pn as getRemoteSkillEligibility, pt as runWithModelFallback, rr as resolveAgentTimeoutMs, st as resolveOutboundTarget, zn as loadModelCatalog, zt as AGENT_LANE_NESTED } from "./subagent-registry-CPtElVX0.js";
+import { Bt as AGENT_LANE_SUBAGENT, D as setCliSessionId, E as getCliSessionId, Er as emitAgentEvent, Mn as applyModelOverrideToSessionEntry, Nn as applyVerboseOverride, Tr as clearAgentRunContext, ct as resolveSessionDeliveryTarget, fn as resolveSendPolicy, jn as clearSessionAuthProfileOverride, kn as getSkillsSnapshotVersion, kr as registerAgentRunContext, l as runNoxSoftEmbeddedAgent, pn as getRemoteSkillEligibility, pt as runWithModelFallback, rr as resolveAgentTimeoutMs, st as resolveOutboundTarget, zn as loadModelCatalog, zt as AGENT_LANE_NESTED } from "./subagent-registry-CDEUbtey.js";
 import { L as normalizeAccountId, l as updateSessionStore } from "./sessions-C_3wTmSA.js";
 import { d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, s as normalizeThinkLevel, t as formatThinkingLevels } from "./pi-embedded-helpers-D2SLlgS4.js";
 import { r as normalizeChannelId, t as getChannelPlugin } from "./plugins-BOMS6J5A.js";
 import { n as resolveSessionFilePath } from "./paths-DMk3Q7yD.js";
 import { a as normalizeOutboundPayloadsForJson, i as normalizeOutboundPayloads, r as formatOutboundPayloadLog, t as deliverOutboundPayloads } from "./deliver-C1L5nO0K.js";
-import { t as lookupContextTokens } from "./context-B5X720Bs.js";
+import { t as lookupContextTokens } from "./context-mdxDsO1v.js";
 import { l as deriveSessionTotalTokens, u as hasNonzeroUsage } from "./session-cost-usage-DnxtnK1E.js";
-import { n as createDefaultDeps, t as createOutboundSendDeps } from "./outbound-send-deps-T_FgdfgW.js";
-import { r as resolveAgentModelSelection, t as resolveSession } from "./session-C7IGnhd1.js";
+import { n as createDefaultDeps, t as createOutboundSendDeps } from "./outbound-send-deps-DMsqr5fd.js";
+import { r as resolveAgentModelSelection, t as resolveSession } from "./session-Jlf3l006.js";
 
 //#region src/infra/outbound/agent-delivery.ts
 function resolveAgentDeliveryPlan(params) {

package/dist/{agents-CvMRplDx.js → agents-y3HCk1ks.js}

@@ -13,14 +13,14 @@ import { s as resolveSessionTranscriptsDirForAgent } from "./paths-DMk3Q7yD.js";
 import { n as withProgress } from "./progress-glCgu57m.js";
 import { a as ensureWorkspaceAndSessions, l as moveToTrash } from "./onboard-helpers-CFudIoX4.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-CVp8W9aa.js";
-import { l as promptAuthChoiceGrouped, n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-Dc5TAJwT.js";
+import { l as promptAuthChoiceGrouped, n as warnIfModelConfigLooksOff, r as applyAuthChoice } from "./auth-choice-BYOaX-W4.js";
 import { t as WizardCancelledError } from "./prompts-BmgT_kkv.js";
 import { n as logConfigUpdated } from "./logging-_rCcBkls.js";
 import { a as loadAgentIdentity, i as listAgentEntries, l as parseIdentityMarkdown, n as buildAgentSummaries, o as pruneAgentConfig, r as findAgentEntryIndex, s as identityHasValues, t as applyAgentConfig } from "./agents.config-Br4ULmK0.js";
-import { t as agentCommand } from "./agent-CnS0SRpT.js";
-import { n as resolveSessionKeyForRequest } from "./session-C7IGnhd1.js";
+import { t as agentCommand } from "./agent-PoYM2xa7.js";
+import { n as resolveSessionKeyForRequest } from "./session-Jlf3l006.js";
 import { t as createClackPrompter } from "./clack-prompter-0JW5kry0.js";
-import { n as setupChannels } from "./onboard-channels-UkphAdCy.js";
+import { n as setupChannels } from "./onboard-channels-DfXxMbYu.js";
 import path from "node:path";
 import fs from "node:fs/promises";