agl 41.0.1 → 41.1.0

package/changelog.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2026-10-27 - 41.1.0
+
+### Features
+
+- The CLI and the upgrade worker manage the controller over loopback HTTP instead of the browser's WebSocket (AGL-825). The controller's port now also serves a management endpoint: one TypedRequest per HTTP `POST` to `/management/typedrequest`, answered only to a loopback peer (`127.0.0.1` or `::1`) that addresses `127.0.0.1:<port>` and sends no `Origin` and no forwarding header (`Forwarded`, `X-Forwarded-*`, `X-Real-IP`, the trusted proxy's secret header), with `controller.status`, `controller.upgrade.launch`, `controller.upgrade.prepare.begin` and `controller.upgrade.finalize` and nothing else. Each is the socket's own handler, so the upgrade methods still authorise themselves against the upgrade token and its one-time grant, and every upgrade request counts against the controller's global unauthenticated preflight limit. `agl status`, `agl start`, `agl upgrade` and the upgrade worker use it for a controller that declares it, and the controller's socket for one that does not, with no second attempt over the other transport. A release declares the endpoint's protocol twice: as `controllerManagementProtocolVersion` (1) in its `package.json`, which decides before its controller runs, and as `managementProtocolVersion` in the controller's status (also in `agl status --json`), which decides once it runs; `controllerUpgradeManagementVersion` stays 2. So the worker of this release reads and finalizes the next release's controller through the endpoint whatever transport that release's browser speaks, and a later release can move its browser transport to another TypedSocket major without breaking an online upgrade from this one. A controller of an earlier release declares neither, so it, and a source a recovery restores, is still reached over its socket, and the socket keeps serving the status read and every upgrade method, so an AGL that predates this release upgrades to it online as before. The wire is a contract between releases: `test/helpers.managementwireoracle.ts` freezes what this release's client sends and accepts, and `test/test.controllermanagementwire.node.ts` holds every later build's endpoint to it.
+- Serve Claude Code in confined containers from the ChatGPT pool as well, chosen per run (AGL-1019). `agl proxy confined run --provider openai -- docker run …` takes a run's credential that is a lease of the ChatGPT pool, as `agl proxy run claude --provider openai` leases it: served by the pool's ChatGPT accounts alone, since a translated Messages request never goes to an OpenAI API key, its sessions those of the client `confined` on that pool, accepted on the confined listener alone and ended with the run. Without the option, or with `--provider anthropic`, a run is a Claude-pool run exactly as before. The confined listener serves either pool's run Claude Code's three endpoints alone -- `GET /anthropic/v1/models`, `POST /anthropic/v1/messages` (translated on the ChatGPT pool) and `POST /anthropic/v1/messages/count_tokens` (404 on the ChatGPT pool, as on the loopback listener, on which Claude Code estimates) -- exactly as the loopback listener serves Claude Code on that pool, and refuses every `/openai/v1/` path and every other path and method with 404 before anything is read or routed. The proxy hands a ChatGPT-pool run the pool's models with its credential (`agl.proxy.confined` takes `{ provider: 'openai' }`; an empty request is a Claude-pool run, as every proxy since confined runs takes it, and the grant names its pool), and the launcher passes Claude Code by name what `agl proxy run claude --provider openai` sets on the host: the pool's default model as `ANTHROPIC_MODEL` and for every alias, its context window, no experimental betas, no nonessential traffic and no attribution block, besides the socket, the endpoint and the credential. That command's configuration directory, in the AGL home, and its `/model` picker, an option of Claude Code's command line, are not passed; the model variables are removed from the environment `docker` runs with, so `-e NAME` of one passes nothing. `agl proxy status` names each confined run's pool (`confinedRuns[].provider`; a proxy before this release names none, and its runs are Claude-pool runs). The readme states, for Claude Code on the ChatGPT pool, what the translation adds to a request and drops from a request and an answer, how Claude Code's reasoning effort reaches the model, and what AGL can and cannot know of the ChatGPT account's own personalization. `test/e2e/e2e.proxyconfined.node.ts` now also runs Claude Code in a container without a network on the ChatGPT pool through the socket. Downgrade: 41.0.1 and earlier refuse to start while the proxy's store keeps a ChatGPT-pool run's credential; let every confined run end first, or start this release once with none going and wait out the 60-second reclaim window.
+
+### Fixes
+
+- An AGL rolled back from a later release prunes the audit events it does not know instead of failing (AGL-825). The audit log is shared between releases, and 42 writes types this release does not know (`remote.*`, `device.*`): each pruning pass refused them with "Audit history pruning failed", so the 2,000-event cap and the 7-day prune stopped until the 90-day expiry removed the rows. A stored event of an unknown type is now read when its type is spelled as an audit type (lowercase dotted segments, at most 128 characters) and its envelope passes the same checks as a known type's; only the rules that tie `localCli` to `configuration.*` and a sender label to `session.message` are left to the release that knows the type. Events now have an optional `details` field (bounded plain JSON: an object at most eight levels deep and 4 KiB serialized), which this release never writes and where a later release records what its own types add. A configuration with gateway sources, which a later release's `agl remote set` stores, is still refused, and the refusal now names `gatewaySources` and the remedy: run `agl remote unset --port <port>` on the later release before rolling back. A start lease a later release's command left behind (`agl remote`) counts as live while that command runs and is reclaimed once it ended, instead of blocking every upgrade as unverifiable. 41.1.0 is the release a 42 controller rolls back to; 40.5.0 and older are not rollback targets for 42. See "Rolling back from a later release" in the readme.
+
 ## 2026-10-26 - 41.0.1
 
 ### Fixes