@qvac/harness 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -0,0 +1,262 @@
+# Changelog
+
+All notable changes to `@qvac/harness` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+While the major version is `0`, a breaking change bumps the minor version.
+
+## [Unreleased]
+
+## [0.3.2] - 2026-09-23
+
+### Changed
+
+- A networked python run's approval prompt lists every host its source names in
+  a URL, or says it names none. On an approved run those hosts (and their `www.`
+  form) are reached without asking. Any other host is asked about through
+  `askUser` before it is resolved, and silence past a minute counts as a no. A
+  host that does not wire `askUser` refuses every unnamed host. (#109)
+
+### Fixed
+
+- A python call reached the network whenever the runtime allowed it, so an
+  auto-run read call, such as a document build that loads an image from a URL,
+  could reach the web without anyone approving it. The network now opens only to
+  a call a person approved or that skip-all allowed. (#108)
+- A timed-out python run on a host with no worker thread spun forever. It is now
+  interrupted at the deadline. (#104)
+- A timed-out python run on the worker could miss its SIGINT, which killed the
+  worker along with the interpreter's state. The interrupt is resent until the
+  run settles. (#112)
+- A python run that failed partway through a save attached the half-written
+  file. A non-zero exit now attaches nothing and reports every declared output in
+  `missingOutputs`. (#110)
+
+## [0.3.1] - 2026-09-23
+
+### Added
+
+- Python in `exec` reaches the network on Bare: `urllib`, `http.client` and
+  `requests` go through the host's guarded fetch. (#94)
+- `SkillOAuthConfig.verify`: an optional probe a skill manifest declares, so a
+  host can check a fresh token before saving it. It is carried over the wire.
+  (#105)
+- A skill operation may name `response.decode` to turn a provider response into
+  a compact shape, starting with `gmail-message`. (#69)
+
+### Fixed
+
+- A malformed `<tool_call>` left its JSON arguments in the reply. The whole span
+  is now stripped. (#100)
+- A misspelt, placeholder or repeated `skill` load returned an error the model
+  retried. It now resolves to the file that was meant, or to the already-loaded
+  body. (#101)
+- When the model reached for `pip` or a video tool on the shell path, the
+  redirect it got now names the call that works. (#71)
+
+## [0.3.0] - 2026-09-23
+
+### Added
+
+- `translate` capability: translates text without loading an LLM. The language
+  pair picks the route before anything loads: the TranslatePsy-EuroNano packs for
+  English and nine European languages, per-pair Bergamot models for the other 43,
+  and TranslatePsy-AfriSLM for 16 languages Bergamot has no model for, named by
+  ISO 639-1 or FLORES-200 code. An omitted `from` is detected from the text. (#76)
+- `translationPlanFor`, `NMT_TO_ENGLISH`, `NMT_FROM_ENGLISH`, `EURONANO_LANGUAGES`,
+  `SLM_LANGUAGE_CODES` and `SLM_LANGUAGE_NAMES` exports, so a host can show a
+  language picker or preview a route without a registry lookup (#76)
+- `enhance: 'never' | 'auto'` on `invoke`. With `'auto'`, an image prompt is
+  rewritten by a model already resident on the device and never triggers a load;
+  `metrics` reports the `route` taken, the model used and the tokens the rewrite
+  spent. Omitting `enhance` behaves as `'never'`. (#77)
+
+## [0.2.12] - 2026-09-22
+
+### Fixed
+
+- Sandbox mode refused every `exec` call that installs packages, which broke the
+  pdf, presentations, word and excel skills. Packages the harness vendors now
+  install; one that would fall back to PyPI is still refused. (#91)
+
+## [0.2.11] - 2026-09-22
+
+Tagged but never published to npm; these changes first shipped in 0.2.12.
+
+### Added
+
+- `Harness#invoke({ capability, args })` runs one capability on its own, with no
+  model, dispatch or approval callback. It is a frame on the existing
+  `completion` stream, with the same callbacks and events. (#74)
+- `Harness#detectLanguage({ text, topK })`, the `detect-language` hrpc method and
+  its `RemoteHarness` client: language detection with no model to load (#75)
+- `SkillOAuthConfig` on `SkillSetupRoute.oauth`, parsed from a skill manifest's
+  `setup.routes[].oauth` (#88)
+
+### Fixed
+
+- `web_fetch` offers file downloads (PDF, Office documents, images) in its
+  description, and `attachDocument` returns the `attachmentId`, `fileName` and
+  `byteLength` it creates, so a downloaded file survives a history fold (#89)
+
+## [0.2.10] - 2026-09-22
+
+### Added
+
+- `sandboxMode` agent option: an agent with no network access. It withholds
+  every tool that reaches the network, not just web search. (#73)
+- `@qvac/harness/office`: XLSX and PPTX text extraction for Knowledge beside the
+  existing DOCX support, keeping sheets, column positions, cached formula values,
+  slide text, grouped shapes and tables (#83)
+
+### Fixed
+
+- A tool call that already failed this turn with the same arguments is answered
+  from its first result instead of running again, so a small model can no longer
+  loop on the same failure (#78)
+- A guessed `auth.tokenCredentialKey` is resolved by URL instead of being refused
+  with an error claiming the skill was not loaded (#72)
+
+## [0.2.9] - 2026-09-22
+
+### Added
+
+- `captureInferenceCalls` harness option: emits `inference-call` and
+  `inference-sent` events carrying the exact payload of every inference call (#51)
+- The `metrics` event carries the last round's `stopReason`, so a turn cut off by
+  the context window is distinguishable from a complete one (#62)
+
+### Changed
+
+- The published tarball no longer includes docs, agent files or eval output (#79)
+
+## [0.2.8] - 2026-09-17
+
+### Added
+
+- `weather_lookup` tool: looks weather up and leads with the place the service
+  actually resolved, refusing when it disagrees with the country or state asked
+  for, instead of reporting the weather of wherever a nonexistent place landed
+  (#52)
+
+### Fixed
+
+- `@qvac/skills` 0.1.4: Apple Notes create-note no longer renames a note after
+  creating it, which failed on iCloud accounts and left duplicates (#48)
+
+## [0.2.7] - 2026-09-16
+
+### Added
+
+- `@qvac/harness/docx`: DOCX text extraction with the bundled Python runtime,
+  preserving paragraph and table order (#46)
+
+## [0.2.6] - 2026-09-15
+
+### Added
+
+- `completionModelCap` harness option, default 1: a completion model waits for a
+  live run to release its model instead of loading beside it (#41)
+- `writeClient` and `writeCapabilities` take a `CallSiteOptions` argument whose
+  `optionalRequests` names the requests the generated client may omit (#44)
+
+## [0.2.5] - 2026-09-14
+
+### Added
+
+- `HarnessOptions.gpuStats`: a host that already has the GPU reading can pass it
+  and skip the probe (#36)
+
+### Fixed
+
+- On a Linux snap the harness exited about a second after `open`, in a loop. GPUs
+  are now enumerated in a short-lived child process. (#36)
+- On Windows, an image request after a presentation stuck on "Loading … into
+  memory": Pyodide's boot no longer touches the process streams (#34)
+
+## [0.2.4] - 2026-09-12
+
+### Added
+
+- The sidecar entry is published, so a host can spawn the engine without the
+  prebuilt bundle and with its native addons resolved at matching versions (#31)
+
+## [0.2.3] - 2026-09-12
+
+### Fixed
+
+- Every `./lib/tools/*` subpath is published. Only the 12 that `qvac-core` used
+  were, so the mobile worklet's file tools could not resolve. (#29)
+
+## [0.2.2] - 2026-09-11
+
+### Fixed
+
+- The lockfile no longer resolves a stale nested `@qvac/inference` (#27)
+
+## [0.2.1] - 2026-09-11
+
+### Fixed
+
+- The generated wire spec matches the schema it is built from (#25)
+
+## [0.2.0] - 2026-09-11
+
+### Added
+
+- Chat compaction when the context window fills (#22)
+- Per-chat KV cache invalidation and reclaim (#22)
+- Notifications delivered from device-local state (#22)
+- A log of the tool prompt, and cheaper model-facing tool schemas (#22)
+- The target sample rate threaded through the Bare audio decoder (#22)
+
+### Changed
+
+- QVAC SDK 0.19: `@qvac/inference` serves the Bare condition behind a new `#sdk`
+  import alias (#22)
+- `bare-http1` is pinned to 4.5.9 (#24)
+
+## [0.1.2] - 2026-09-11
+
+### Fixed
+
+- `@qvac/harness/sdk-storage` and `#sdk-config-loader` failed to resolve under
+  Bare: the tarball carried only the Node loader (#20)
+
+## [0.1.1] - 2026-09-10
+
+### Added
+
+- A compiled library surface (`dist-lib/`, JavaScript and declarations), so the
+  package's exports import without shipping TypeScript source (#18)
+
+## [0.1.0] - 2026-09-10
+
+### Added
+
+- First release of the QVAC engine as `@qvac/harness`: the prebuilt
+  `harness.bundle` a host spawns, its runtime content (skills from `@qvac/skills`
+  and the hash-pinned Python wheels), and `prebuilds-manifest.json` naming the
+  native addons it defers (#13, #15)
+
+[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.3.2...HEAD
+[0.3.2]: https://github.com/tetherto/qvac-harness/compare/v0.3.1...v0.3.2
+[0.3.1]: https://github.com/tetherto/qvac-harness/compare/v0.3.0...v0.3.1
+[0.3.0]: https://github.com/tetherto/qvac-harness/compare/v0.2.12...v0.3.0
+[0.2.12]: https://github.com/tetherto/qvac-harness/compare/v0.2.11...v0.2.12
+[0.2.11]: https://github.com/tetherto/qvac-harness/compare/v0.2.10...v0.2.11
+[0.2.10]: https://github.com/tetherto/qvac-harness/compare/v0.2.9...v0.2.10
+[0.2.9]: https://github.com/tetherto/qvac-harness/compare/v0.2.8...v0.2.9
+[0.2.8]: https://github.com/tetherto/qvac-harness/compare/v0.2.7...v0.2.8
+[0.2.7]: https://github.com/tetherto/qvac-harness/compare/v0.2.6...v0.2.7
+[0.2.6]: https://github.com/tetherto/qvac-harness/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/tetherto/qvac-harness/compare/v0.2.4...v0.2.5
+[0.2.4]: https://github.com/tetherto/qvac-harness/compare/v0.2.3...v0.2.4
+[0.2.3]: https://github.com/tetherto/qvac-harness/compare/v0.2.2...v0.2.3
+[0.2.2]: https://github.com/tetherto/qvac-harness/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/tetherto/qvac-harness/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/tetherto/qvac-harness/compare/v0.1.2...v0.2.0
+[0.1.2]: https://github.com/tetherto/qvac-harness/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/tetherto/qvac-harness/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/tetherto/qvac-harness/releases/tag/v0.1.0