@qvac/harness 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -8,6 +8,82 @@ While the major version is `0`, a breaking change bumps the minor version.
 
 ## [Unreleased]
 
+## [0.3.3] - 2026-09-24
+
+### Changed
+
+- `@qvac/sdk` 0.20.0. Some addons now ship their prebuilds as per-platform
+  packages (`@qvac/<addon>-<os>-<cpu>`, e.g. `audiogen-ggml` 0.4, `tts-ggml`
+  0.9), and `@qvac/model-fit` and `@qvac/fabric` join the native graph. A host
+  that bundles the harness resolves prebuilds through each addon's
+  `#host-addon` map, defers the new addons, and exempts the platform packages
+  from any install age gate. (#85)
+- `@qvac/skills` 0.1.8: the diagrams skill carries every recipe inline, so a
+  2B no longer loops on a second `skill` load for a reference file it cannot
+  name (QVAC-24436, QVAC-24502); the excel skill routes a chat image to create,
+  not edit; the Google OAuth routes drop the loopback port. (#115)
+- A user message with several images reaches the SDK as one turn again. The
+  per-image split added for QVAC-24156 is gone: SDK 0.20 carries the upstream
+  mtmd fix (llama.cpp #27348), so equal-size still images no longer merge as
+  video frames and abort the encode. `<key>-vision-history-v1` cache
+  directories left by the split are no longer read; clearing all caches
+  removes them. (#116)
+
+### Fixed
+
+- Retrying or regenerating in a chat that held a multi-image message could
+  reuse a stale cached prefix, because the split kept that chat's cache under a
+  key the host never deletes. (#116)
+- `@qvac/skills` 0.1.9: the Asana skill's first setup step names the Asana MCP
+  app to connect. (#118)
+
+## [0.3.2] - 2026-09-23
+
+### Changed
+
+- A networked python run's approval prompt lists every host its source names in
+  a URL, or says it names none. On an approved run those hosts (and their `www.`
+  form) are reached without asking. Any other host is asked about through
+  `askUser` before it is resolved, and silence past a minute counts as a no. A
+  host that does not wire `askUser` refuses every unnamed host. (#109)
+
+### Fixed
+
+- A python call reached the network whenever the runtime allowed it, so an
+  auto-run read call, such as a document build that loads an image from a URL,
+  could reach the web without anyone approving it. The network now opens only to
+  a call a person approved or that skip-all allowed. (#108)
+- A timed-out python run on a host with no worker thread spun forever. It is now
+  interrupted at the deadline. (#104)
+- A timed-out python run on the worker could miss its SIGINT, which killed the
+  worker along with the interpreter's state. The interrupt is resent until the
+  run settles. (#112)
+- A python run that failed partway through a save attached the half-written
+  file. A non-zero exit now attaches nothing and reports every declared output in
+  `missingOutputs`. (#110)
+
+## [0.3.1] - 2026-09-23
+
+### Added
+
+- Python in `exec` reaches the network on Bare: `urllib`, `http.client` and
+  `requests` go through the host's guarded fetch. (#94)
+- `SkillOAuthConfig.verify`: an optional probe a skill manifest declares, so a
+  host can check a fresh token before saving it. It is carried over the wire.
+  (#105)
+- A skill operation may name `response.decode` to turn a provider response into
+  a compact shape, starting with `gmail-message`. (#69)
+
+### Fixed
+
+- A malformed `<tool_call>` left its JSON arguments in the reply. The whole span
+  is now stripped. (#100)
+- A misspelt, placeholder or repeated `skill` load returned an error the model
+  retried. It now resolves to the file that was meant, or to the already-loaded
+  body. (#101)
+- When the model reached for `pip` or a video tool on the shell path, the
+  redirect it got now names the call that works. (#71)
+
 ## [0.3.0] - 2026-09-23
 
 ### Added
@@ -193,7 +269,9 @@ Tagged but never published to npm; these changes first shipped in 0.2.12.
   and the hash-pinned Python wheels), and `prebuilds-manifest.json` naming the
   native addons it defers (#13, #15)
 
-[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.3.2...HEAD
+[0.3.2]: https://github.com/tetherto/qvac-harness/compare/v0.3.1...v0.3.2
+[0.3.1]: https://github.com/tetherto/qvac-harness/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/tetherto/qvac-harness/compare/v0.2.12...v0.3.0
 [0.2.12]: https://github.com/tetherto/qvac-harness/compare/v0.2.11...v0.2.12
 [0.2.11]: https://github.com/tetherto/qvac-harness/compare/v0.2.10...v0.2.11