synartesis 0.6.10 → 0.6.12

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 What changed, and why it mattered. Dates are release dates.
 
+## 0.6.12 — 2026-09-13
+
+### Security
+
+- **Nine advisories, none of them ours, all of them shipped anyway.** Four
+  high and five moderate arrived through one dependency's dependencies --
+  `fast-uri`, `qs` and `hono`, by way of the MCP SDK. Nothing in the published
+  npm package contained them: that bundle imports the SDK rather than inlining
+  it, so a fresh install resolves patched versions on its own. The desktop
+  application is the opposite -- it bundles everything, so it was carrying
+  `fast-uri` 3.1.5 and its four high advisories into every installer. Pinned to
+  patched versions; `pnpm audit --prod` now reports nothing.
+
+### Fixed
+
+- **Two lookups that ran while somebody was waiting were full table scans.**
+  Finding a standing approval happens twice on every call that needs one, and
+  listing what is held backs both `synartesis gates` and the console. Neither
+  had an index, so both read every row in the journal -- including the
+  snapshots, which are the largest column there. At fifty thousand actions with
+  two-kilobyte snapshots, measured: 61ms and 56ms, on every irreversible call,
+  growing with the journal.
+
+  Both are now indexed: **61ms to 0.01ms, and 56ms to nothing.**
+
+  Deliberately without a schema version bump. This build refuses to open a
+  journal written by a different schema, so bumping would have told everybody
+  with history to abandon it in exchange for an index. Adding an index changes
+  no row and no meaning, the statement is idempotent, and it runs on every
+  open -- so an existing journal gains both the next time it is opened, and an
+  older build opening the same file afterwards neither notices nor cares.
+
+## 0.6.11 — 2026-09-13
+
+### Fixed
+
+- **A conversation with Gemini died on the round after its first tool call.**
+  Gemini 3 signs the reasoning behind every function call it makes, and
+  refuses the next request outright if that signature does not come back on
+  the part it arrived on: `Function call is missing a thought_signature in
+  functionCall parts`. Nothing here was keeping it. The signature is now
+  carried through the loop and handed back untouched -- opaque, unread, and
+  never shown to anybody.
+- **The same failure was waiting in the Claude adapter.** Passing thinking
+  blocks back is required when tools are in play, and the adapter was
+  rebuilding each assistant turn out of its text and its tool calls alone --
+  so the first tool call would have worked and the round after it would have
+  been a 400. The thinking blocks are kept in the order they were produced,
+  signature intact, and go back at the front of the turn they belong to.
+- The loop between the two is what actually lost them, and now has a test of
+  its own: the adapters were each correct in isolation.
+
+Nothing changes for OpenAI-compatible endpoints -- Mistral, Ollama, LM Studio,
+vLLM, OpenAI itself. That protocol asks for nothing back, and inventing
+something to send would be worse than sending nothing.
+
 ## 0.6.10 — 2026-09-13
 
 ### Added

package/dist/{chunk-DRDKIFD3.js → chunk-FUVEHRJP.js}

@@ -240,6 +240,23 @@ CREATE TABLE IF NOT EXISTS actions (
 );
 
 CREATE INDEX IF NOT EXISTS actions_by_run ON actions(run_id, seq);
+
+-- Deliberately not a schema version bump. Adding an index changes no row and
+-- no meaning, IF NOT EXISTS makes it idempotent, and the statement is run on
+-- every open -- so a journal written months ago gains these the next time it
+-- is opened, and an older build opening the same file afterwards neither
+-- notices nor cares. A version bump would have been the opposite: this build
+-- refuses to open a journal from a different schema, and telling somebody to
+-- abandon everything an agent has ever done in order to gain an index would
+-- be a poor trade.
+--
+-- Both of these sit in front of a person waiting. findApproval runs twice on
+-- every gated call and findGated backs the gates command and the console;
+-- without them each is a full scan over rows that carry the snapshots, which
+-- is the largest thing in the table. Measured at fifty thousand actions with
+-- two-kilobyte snapshots: 61ms to 0.01ms, and 56ms to 0.00ms.
+CREATE INDEX IF NOT EXISTS actions_approved ON actions(server, tool, status, approved_at);
+CREATE INDEX IF NOT EXISTS actions_gated ON actions(status, ts);
 `;
 
 // src/journal/journal.ts
@@ -1580,4 +1597,4 @@ export {
   observeState,
   connectStdioUpstream
 };
-//# sourceMappingURL=chunk-DRDKIFD3.js.map
+//# sourceMappingURL=chunk-FUVEHRJP.js.map

package/dist/cli.js

@@ -27,7 +27,7 @@ import {
   toResolvedRead,
   verifyAgainstServers,
   wasRefused
-} from "./chunk-DRDKIFD3.js";
+} from "./chunk-FUVEHRJP.js";
 import {
   DriftConflict,
   ManifestError,

package/dist/proxy.js

@@ -19,7 +19,7 @@ import {
   runRead,
   toPayload,
   verifyAgainstServers
-} from "./chunk-DRDKIFD3.js";
+} from "./chunk-FUVEHRJP.js";
 import {
   SnapshotError,
   UpstreamError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,
@@ -70,7 +70,12 @@
   "pnpm": {
     "neverBuiltDependencies": [
       "better-sqlite3"
-    ]
+    ],
+    "overrides": {
+      "fast-uri": "^3.1.7",
+      "hono": "^4.13.7",
+      "qs": "^6.16.0"
+    }
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "^0.125.0",