@sigrun/sigrun 0.1.6 → 0.2.1

package/CHANGELOG.md

@@ -7,6 +7,198 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-10-28
+
+### Added
+- `GET /v1/meta` now reports the effective listener: `listener.host`,
+  `listener.port`, and `listener.families` — the address families the
+  live listener accepts, measured once at listen (the `::` wildcard
+  probes both loopbacks and reports exactly the families that connect;
+  a hostname bind reports the bound socket's family, never a concrete
+  peer address). Additive wire field: pre-upgrade servers omit
+  `listener`; clients consuming it must tolerate its absence.
+- `SIGRUN_LISTEN_HOST` is now honored as the environment equivalent of
+  the programmatic `serve({host})` option. One host value is resolved
+  at the serving boundary (`options.host` → `SIGRUN_LISTEN_HOST` → `::`)
+  and drives the bind AND both auth derivations — the previously split
+  defaults (the boot auth derivation's independent env read, and the
+  harness-side `0.0.0.0` fallback) are gone.
+- Proxy-auth rejections (401) now log one sanitized `warn` per rejected
+  request: the socket peer, the method, a short reason (`untrusted
+  proxy`, `missing or wrong shared secret`, `missing identity header`,
+  `untrusted identity source`), and the resolved route template — never
+  tokens, cookies, identity-header values, query strings, or the full
+  URL. Token-auth failures and successful proxy authentications stay
+  silent.
+- The normal core build now emits real `dist/blocks/**/*.d.ts`
+  declarations, including the `dist/blocks/index.d.ts` named by the
+  `@sigrun/sigrun/blocks` export. Pack/type-resolution coverage compiles
+  an external consumer against those declarations; extension consumers
+  no longer need an ambient block-module shim.
+
+### Fixed
+- Successful `PUT /v1/me/extensions/:slug/settings` writes now publish
+  through the same post-commit settings-change seam as section saves:
+  one per-user failure-fence clear, one observing-extension reconciliation,
+  and the extension slug plus changed body keys. Invalid, unknown, and
+  otherwise rejected writes publish nothing; repeated successful writes
+  retain the existing notification semantics.
+- `host.peekInteraction(conversationId, callId, context)`: a
+  non-consuming interaction inspection read beside
+  `snapshotInteraction`. It returns the same stored record projection
+  (secret values stay masked) but NEVER touches the one-shot raw-secret
+  delivery — safe to repeat for notifiers, outcome edits, and answer
+  correlation. `snapshotInteraction` remains the ONLY read that merges
+  and consumes an unread delivery, reserved for the interaction's
+  owning extension; its first-read/second-read semantics are unchanged.
+- `NotificationEvent` is now a discriminated union (shared base plus
+  `interaction.pending` / `job.failed` / `run.settled` variants), and
+  the `run.settled` variant carries a structured
+  `outcome: { status: "answered" } | { status: "unanswered"; reason: string }`
+  translated directly from the host event's existing `outcome`/`reason`
+  (no second answer read, no inferred status). The other variants do
+  not gain the field; exhaustive narrowing on `type` now typechecks.
+
+### Fixed (continued)
+- Restored per-user worker startup by placing the selected device paths
+  under read-only Landlock rules. Their ordinary I/O works, while
+  `/dev/shm` and writes outside workspace/home/tmp remain denied.
+- Preserved composer text and attachments when a slow conversation-meta
+  restore resolves after a local edit or clear. The interaction visual
+  drain now covers required secrets and multi-step forms, and the visual
+  e2e gate passes all 163 cases.
+
+### Changed
+- Settled-run notifications are truthful: an answered run keeps the
+  `"Reply ready"` title, while an unanswered run (model error, abort,
+  or a missing answer) is titled `"Run ended without a reply"` with the
+  settle reason appended to the body — a failed run no longer
+  masquerades as a ready reply. Recipient, dedup, and
+  `notifications.runSettled` gating are unchanged.
+
+## [0.2.0] - 2026-10-27
+### Added
+- Per-user extension surface (multi-user M2): lifecycle events carry the
+  conversation owner; `stores.user(user)` provides per-user secrets,
+  settings, and data/state/cache paths; `/v1/me` exposes self-service
+  settings, secret-key management, and service status.
+- Per-user tool publications (`perUserTools` and
+  `host.tools.setUserTools`) with `<slug>@<user>` registry entries,
+  owner-driven selection on create/fork/transfer and boot reconciliation.
+  Every tool is wrapped with a committed-owner execution check: selection
+  is convenience, not the authorization boundary.
+- Per-user service processes (`userServices` and `services.connect`),
+  launched under the user's own sibling jail policy with idle stopping,
+  crash fencing, and lifecycle cleanup on deletion, quarantine, and
+  shutdown. Settings sections can use `scope: "user"` for personal
+  configuration.
+- The §10.6 deletion sequence: transfer ownership and remove external
+  identity access, stop per-user execution and tool entries, emit
+  `userDeleted` while credential revocation remains possible, remove the
+  record, then delete per-user credentials, settings, and cache. Data and
+  state remain extension-owned.
+- Multi-user login (M3b): extension-contributed `loginProviders` with
+  core-owned, single-use state and callback routes; first-login setup and
+  invite resolution with optional policy-gated auto-provisioning; webui
+  provider sign-in; and self-service account links that are never silently
+  re-pointed to another user.
+- Gateway built-in: `@sigrun/ext-gateway` supervises channel adapters,
+  with pairing and self-linking, group conversations, live responses,
+  durable outbound delivery, agent tools, home notifications, and job
+  delivery. Enabled by default; operators can disable it with
+  `builtinExtensions.gateway: false`.
+- Expiring, revocable browser sessions (`server.auth.sessionDays`, default
+  30 days). A session can mint the user's API tokens; revoking it leaves
+  those tokens independent.
+- Stored groups per authenticating source, effective group-derived admin,
+  and people-scoped group sharing. Groups refresh at the next login or
+  validated proxy request. The separately shipped `@sigrun/oauth`
+  package provides OIDC, GitHub, and Discord login providers.
+- `@sigrun/oauth` is the fourth built-in extension. It loads by default,
+  resolves from core's dependencies, and supports the same disable,
+  replacement, and quarantine behavior as the other built-ins. The
+  `builtinExtensions.oauth` toggle defaults to true and is restart-required.
+- Chat blocks (U5): an entry and state family plus `show`/`update` tools,
+  surface routes with authored change records, change notes before every
+  turn admission, block answers as `InputEntry` turns, transcript
+  rendering, and the webui and TUI transports.
+- Interactions and ambient surfaces on block trees (U6): `{values}` answers
+  with write-only secrets, channel renderers, and the ambient
+  literal-content ruling.
+- Images (U7): an HMAC-signed proxy, a rebinding-safe fetcher, an LRU cache
+  with `sharp` conversion, and CSP headers.
+
+### Changed
+- Family versions move together to 0.2.0: `@sigrun/shared` 0.2.0
+  (surface, block, interaction, ambient, and settings-section wire types)
+  and `@sigrun/tui` 0.2.0 (chat-block transcripts, interaction and ambient
+  rendering, settings forms).
+- Retired persisted `groupAdmin` in favor of stored groups; its user-wire
+  compatibility field is now derived and retained for one release.
+- The execution jail (multi-user M1): per-user workers are Landlock-confined
+  and multi-user fails closed when the boundary is unavailable.
+
+### Fixed
+- Kept the extension inventory available to non-admin clients while limiting
+  service status projections to admins; quarantine now removes per-user
+  tools as well as services.
+- Preserved service crash fences across explicit stops and skipped the
+  per-user selection sweep when no per-user extensions are configured.
+
+### Security
+- Added the opt-in Landlock kernel boundary suite for two-user execution
+  isolation, with a hard ABI 6+ CI gate and explicit local skip reasons.
+  Documented the isolation boundary, trusted-extension and resource limits,
+  kernel requirements, OS-account setup, and proxy trust posture.
+  The suite also covers abstract sockets, ptrace, worker lifecycle, IPC
+  descriptors, and privileged-runner osUser switching; outside-jail controls
+  distinguish Landlock denials from Yama or missing-capability conditions.
+
+## [0.1.7] - 2026-10-24
+
+*Correction (2026-10-28): the original entry omitted substantial scope
+that shipped in this release — the U4 settings rebuild, the M3a
+account-link store and routes, and the accompanying `@sigrun/shared` /
+`@sigrun/tui` settings-surface work. Those entries are restored below;
+the Service-migration claim is also corrected (adding a secondary
+family while retaining the primary is an in-place patch, not a
+recreate).*
+
+### Added
+- Core settings sections rebuilt on blocks (U4): one settings renderer
+  for webui and TUI, extension-declared sections, a `/v1/settings`
+  sections route, `pendingRestart` with an admin restart route,
+  live/restart metadata for every core key, label search, and
+  `settings.changed`/`onSettingsChanged`. The shared and TUI packages
+  carry the matching settings-surface and settings-form work (live
+  surface revs, default-on toggle handling, roster-driven tool
+  defaults, walk-based search).
+- Account links (multi-user M3a): the core account-link store plus
+  routes to list and remove an account's linked external identities.
+
+### Fixed
+- The deploy entry binds the dual-stack wildcard (`::`) instead of the
+  IPv4-only `0.0.0.0`. On a dual-stack pod whose Service is IPv6-only
+  (`ipFamilies: ["IPv6"]` — the default shape on a cluster with an
+  `fd00::/8` ClusterIP range) the EndpointSlice advertises only the
+  pod's IPv6 address; the gateway dialed it, got connection-refused,
+  and answered `upstream connect error or disconnect/reset before
+  headers. reset reason: remote connection failure` while the
+  IPv4-loopback probes kept the pod Ready. `::` accepts both families
+  (`net.ipv6.bindv6only` is 0 on Linux), matching every other workload
+  in a dual-stack cluster. The reported listen line brackets the host
+  (`http://[::]:3000`).
+
+### Changed
+- The chart's main Service is `PreferDualStack` over `[IPv6, IPv4]`,
+  so it advertises both pod addresses regardless of the cluster's
+  default family. Adding a secondary family while retaining the
+  primary is an in-place patch (`spec.ipFamilies` gains the new
+  family); only changing the PRIMARY family requires recreation
+  (`spec.clusterIPs` is immutable). *Corrected 2026-10-28: the
+  original entry claimed every conversion is a recreate.*
+- `sigrun run` (workstation mode) still binds `127.0.0.1` only.
+
 ## [0.1.6] - 2026-10-24
 ### Added
 - Extension surfaces: typed block rendering, actions and uploads, live