cascade-ai 0.68.0 → 0.69.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +50 -59
- package/dist/cli.cjs +445 -61
- package/dist/cli.cjs.map +1 -1
- package/dist/cli.js +445 -61
- package/dist/cli.js.map +1 -1
- package/dist/desktop-core.cjs +431 -57
- package/dist/index.cjs +431 -57
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +231 -12
- package/dist/index.d.ts +231 -12
- package/dist/index.js +431 -57
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -63,65 +63,37 @@ Other AI CLIs run a single agent. Cascade runs a visible **organization** — an
|
|
|
63
63
|
|
|
64
64
|
## What's New
|
|
65
65
|
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
- **
|
|
70
|
-
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
- **
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
- **
|
|
77
|
-
- **
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
-
|
|
83
|
-
-
|
|
84
|
-
-
|
|
85
|
-
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
-
|
|
96
|
-
-
|
|
97
|
-
- **Dashboard JWT pinned to HS256** on both sign and verify (defense-in-depth against algorithm-confusion).
|
|
98
|
-
- **Broadened shell dangerous-command patterns** — the built-in blocklist now tolerates flag reordering / extra whitespace (`rm -fr /`, `rm -rf /`) and catches a fork-bomb form. This is defense-in-depth; the approval prompt remains the real gate.
|
|
99
|
-
|
|
100
|
-
### v0.5.6 — Wizard scrollable model list + chat scrollback + slash panel fix
|
|
101
|
-
- **Init wizard tier-model picker** — added `limit={8}` to the `SelectInput` so long model lists scroll with ↑/↓ indicators instead of overflowing off-screen.
|
|
102
|
-
- **Chat scrolling restored** — the REPL was still enabling mouse-reporting on mount, which captured wheel events and broke the terminal's native scrollback (where Ink `<Static>` messages live since v0.5.4). Flipped the on-mount sequence to actively disable. Mouse-wheel-up now scrolls the terminal scrollback as expected.
|
|
103
|
-
- **Slash-command suggestion panel** — long descriptions were wrapping to a second line and squishing two entries onto one row. Added `wrap="truncate"` on the description text and bumped the fixed panel height by one row to fit the worst-case content (header + 8 entries + both ↑/↓ indicators).
|
|
104
|
-
|
|
105
|
-
### v0.5.4 — Maximized-terminal flicker fix + orchestrator resilience
|
|
106
|
-
- **Static-based conversation rendering** — completed messages now go to the terminal's native scrollback via Ink `<Static>`; only the live area (status bar, streaming tail, agent tree, input) re-renders per batch. Effectively eliminates the maximized-window flicker on cmd / PowerShell.
|
|
107
|
-
- **`tier:status` throttle** (100 ms) + `React.memo` on AgentTree / StatusBar / HintBar to cut per-event re-render churn.
|
|
108
|
-
- **Auto-clear agent tree** — the tree auto-hides 8 s after a task completes (preserves conversation and cost data); cancelled if a new task starts.
|
|
109
|
-
- **T3 critical-error detection** — rate-limit / auth / forbidden errors now short-circuit the agent loop via a typed `CriticalToolError`; the worker no longer loops 15× on a 429.
|
|
110
|
-
- **T3 stall preserves partial output** via a typed `WorkerStallError` instead of throwing a bare `Error`.
|
|
111
|
-
- **T1 failure summary** — when all sections fail, the user sees the actual root cause (e.g. `[CRITICAL_TOOL_ERROR] grep: 429 Rate limit reached for gpt-5.4-mini`) instead of a generic "all sections encountered errors".
|
|
112
|
-
|
|
113
|
-
### v0.5.3 — Headless mode and audit fixes
|
|
114
|
-
- **Headless `cascade run` / `-p`** — works in non-TTY contexts (CI, pipes, scripts). Progress → stderr, final answer → stdout. Tool approvals are auto-granted in headless mode.
|
|
115
|
-
- **`cascade models` columns** — long model IDs no longer collide with the provider column.
|
|
116
|
-
- **`/clear` resets cost breakdowns** — per-provider / per-tier maps are reset, not just the totals.
|
|
117
|
-
- **`/config`** — richer output (theme, providers, per-tier models, dashboard port, cascade-auto), guarded against an undefined `config.dashboard`.
|
|
118
|
-
- **Type cleanup** — removed vestigial `ReplMessage` / `ToolCallBlock` interfaces.
|
|
119
|
-
|
|
120
|
-
### v0.5.2 — Setup wizard redesign + new tools
|
|
121
|
-
- **First-run setup wizard redesigned** to match the Cascade-AI TUI design — themed welcome header, phased step tabs (API Keys → Models → Complete), field boxes, tier cards, and a proper completion screen. All provider/model functionality preserved.
|
|
122
|
-
- **New tools** — `glob`, `grep`, and `web-fetch` available to T3 workers.
|
|
123
|
-
- **Model-performance tracker** — records per-model success/cost stats for scored selection when `cascadeAuto: true`.
|
|
124
|
-
- **Fixes** — removed an accidental `cascade-ai` self-dependency in `package.json`; corrected misleading `/tree` and `/sessions` slash-command descriptions; fixed stale T2/T3 test mocks.
|
|
66
|
+
Cascade has shipped roughly 55 releases since v0.13.2 and is now at **v0.68.0**. Grouped by theme rather than listed one-by-one:
|
|
67
|
+
|
|
68
|
+
### v0.68 — a typed task graph, durable resume, and mechanical verification
|
|
69
|
+
- **One dependency scheduler for the whole hierarchy.** T1's section dispatch and T2's subtask execution now both compile onto the same typed task graph (`compileTaskGraph` + `DependencyScheduler`) instead of two separate hand-rolled implementations — pinned by a parity harness across 600 generated graphs so ordering didn't silently change.
|
|
70
|
+
- **Failure-aware dependency contracts.** A section that depends on one that failed is now skipped rather than run into the same wall — reported with the chain that blocked it, and costing no tokens, instead of starting anyway and billing for a run that was doomed before it began. A degraded (`PARTIAL`) result doesn't block; only a hard failure does.
|
|
71
|
+
- **Durable resume across crashes, cancellation, and budget caps.** Checkpoints are now written for every way a run can stop, not just the budget cap, so `/continue` picks a run back up after a crash or Ctrl-C — finished sections are restored as fact and only the remainder gets re-planned.
|
|
72
|
+
- **A deterministic rung on the verification ladder.** Acceptance criteria that can be checked mechanically ("file exists," "contains X") are now settled by looking, before a model is ever asked to grade them — cheaper, faster, and immune to a model believing its own claim that a file was written. Ambiguous criteria still fall through to the model.
|
|
73
|
+
- **The desktop app is now a real download from the site**, not a GitHub releases page listing twenty build artifacts — platform and architecture are detected, size and version are shown, and stable per-platform links (`/download/mac-arm64`, `/download/win-x64`) mean a shared link never goes stale.
|
|
74
|
+
|
|
75
|
+
### Cascade Cloud, native login, and one identity across CLI, desktop, and web (v0.20 – v0.45)
|
|
76
|
+
- **Cascade Cloud** launched as a hosted, bring-your-own-key chat surface (`app.cascadeai.in`) — multimodal input, persistent memory, and file generation that now produces real, editable Office documents and charts (`.docx`/`.pptx`/`.xlsx`), not markdown text saved under the wrong extension.
|
|
77
|
+
- **Native login**, rolled out server → CLI → desktop, so `cascade login`, the desktop app, and the web app all authenticate against one account with no OAuth secret shipped in a native client.
|
|
78
|
+
- **Key sync** — provider keys, MCP tokens, and preferences now sync end-to-end encrypted across web, desktop, and CLI; the server holds only ciphertext it cannot read.
|
|
79
|
+
- **MCP connectors gained OAuth** — connecting a server can run a real login-and-authorize flow instead of pasting a token, across cloud web, desktop, and CLI alike.
|
|
80
|
+
- **One visual identity** — a single azure → sky → teal system, matching T1 → T2 → T3, now runs through the CLI banner, the desktop theme, and the web app instead of three different palettes.
|
|
81
|
+
|
|
82
|
+
### Cost-aware Auto-routing keeps adding sources and nuance (v0.6 – v0.46)
|
|
83
|
+
- Model-value ranking moved from one hand-curated benchmark table to an aggregator over multiple public sources (Artificial Analysis, LMArena, public leaderboards), normalized onto a common scale and scored conservatively where sources disagree.
|
|
84
|
+
- Point releases now route as their own families (`gpt-5.5` vs. `gpt-5.4-mini`) instead of folding into one shared, less accurate score, and models a provider newly makes available compete in ranking instead of waiting on a hand-edited catalog.
|
|
85
|
+
- Azure deployments with opaque names now get an inferred capability score (size/cost keywords + version), so a multi-deployment setup auto-assigns the strongest model to T1 and the cheapest to T3 instead of handing every tier the same "first available" deployment.
|
|
86
|
+
|
|
87
|
+
<details><summary>Earlier — building the agent hierarchy and a flicker-free TUI (v0.5.2 – v0.13.2)</summary>
|
|
88
|
+
|
|
89
|
+
### v0.6 → v0.13.2 — the agentic releases
|
|
90
|
+
- Live benchmark Auto-routing (`Auto` picks the best-value model per task from live public benchmarks + live pricing), a boardroom plan-review gate (pause to approve or edit T1's plan before anything spawns), and autonomous `/auto` mode (safe tools run silently, dangerous ones still ask).
|
|
91
|
+
- `/continue` run resumability, and workers recruiting bounded sibling workers (`request_workers`) when a task fans out mid-run.
|
|
92
|
+
- The desktop Cockpit gained live streaming, a tool-approval modal, a manual tier override, and a click-to-inspect node detail panel.
|
|
93
|
+
|
|
94
|
+
### v0.5.x — the visible organization
|
|
95
|
+
- The delegation-savings counter (`saved $X vs. all-T1`), the `/comms` peer-traffic feed, `/why` run explanations, and the boardroom approval gate.
|
|
96
|
+
- A dedicated security hardening pass — loopback-only dashboard, SSRF-guarded fetch, sandboxed code execution — and the Ink 6 / React 19 rewrite that fixed the terminal flicker.
|
|
125
97
|
|
|
126
98
|
</details>
|
|
127
99
|
|
|
@@ -255,6 +227,25 @@ cascade run "explain the auth module in this repo"
|
|
|
255
227
|
|
|
256
228
|
---
|
|
257
229
|
|
|
230
|
+
## Self-host
|
|
231
|
+
|
|
232
|
+
Run the Cascade Cloud web app (chat UI + API + socket) yourself, on one port, with no cloud account:
|
|
233
|
+
|
|
234
|
+
```bash
|
|
235
|
+
cp .env.example .env
|
|
236
|
+
echo "SESSION_SECRET=$(openssl rand -base64 32)" >> .env
|
|
237
|
+
echo "CLOUD_DEV_BYPASS=1" >> .env # local-only sign-in; see the warning below
|
|
238
|
+
docker compose up # → http://localhost:8787
|
|
239
|
+
```
|
|
240
|
+
|
|
241
|
+
`docker compose up` builds the image, serves the web UI straight from the server (no separate web container), and keeps the SQLite database + uploads in a named volume so a restart doesn't wipe them. `.env.example` documents every variable the server reads (from `cloud/server/src/env.ts`), grouped required-first, each with what it does and what breaks if it's unset.
|
|
242
|
+
|
|
243
|
+
> **`CLOUD_DEV_BYPASS` is an authentication bypass, not a convenience toggle.** It adds a sign-in button that accepts any name with no credential, so anyone who can reach the port can sign in as anyone. That is why it ships commented out, why the step above is explicit rather than the default, and why `docker-compose.yml` publishes to `127.0.0.1` only. Before putting this on a network anyone else can reach: set `GITHUB_CLIENT_ID`/`GOOGLE_CLIENT_ID` for real OAuth, remove `CLOUD_DEV_BYPASS`, and only then change the port binding.
|
|
244
|
+
|
|
245
|
+
See the [Dockerfile](Dockerfile) and [docker-compose.yml](docker-compose.yml) for the build/runtime details.
|
|
246
|
+
|
|
247
|
+
---
|
|
248
|
+
|
|
258
249
|
## Configuration
|
|
259
250
|
|
|
260
251
|
Cascade loads config from `.cascade/config.json` in your project directory.
|