titan-agent 6.5.2 → 6.5.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -16
- package/dist/utils/constants.js +1 -1
- package/dist/utils/constants.js.map +1 -1
- package/package.json +1 -1
- package/ui/dist/sw.js +1 -1
package/README.md
CHANGED
|
@@ -15,19 +15,19 @@
|
|
|
15
15
|
|
|
16
16
|
<p align="center">
|
|
17
17
|
<strong>The local-first AI agent framework with a team of specialists, a real-time canvas, and a soul.</strong>
|
|
18
|
-
<br><small>Your hardware. Your models. Your control. Built in TypeScript, MIT-licensed,
|
|
18
|
+
<br><small>Your hardware. Your models. Your control. Built in TypeScript, MIT-licensed, 110K+ downloads.</small>
|
|
19
19
|
</p>
|
|
20
20
|
|
|
21
21
|
<p align="center">
|
|
22
22
|
<a href="https://www.npmjs.com/package/titan-agent"><img src="https://img.shields.io/npm/v/titan-agent?color=blue&label=npm" alt="npm version"/></a>
|
|
23
|
-
<a href="https://www.npmjs.com/package/titan-agent"><img src="https://img.shields.io/
|
|
23
|
+
<a href="https://www.npmjs.com/package/titan-agent"><img src="https://img.shields.io/npm/dt/titan-agent?color=blue&label=downloads" alt="npm downloads"/></a>
|
|
24
24
|
<a href="https://github.com/Djtony707/TITAN/stargazers"><img src="https://img.shields.io/github/stars/Djtony707/TITAN?style=social" alt="GitHub Stars"/></a>
|
|
25
25
|
<a href="https://github.com/Djtony707/TITAN/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"/></a>
|
|
26
26
|
<a href="https://github.com/sponsors/Djtony707"><img src="https://img.shields.io/badge/sponsor-♥-ec4899" alt="Sponsor"/></a>
|
|
27
27
|
</p>
|
|
28
28
|
|
|
29
29
|
<p align="center">
|
|
30
|
-
<a href="#whats-new"><img src="https://img.shields.io/
|
|
30
|
+
<a href="#whats-new"><img src="https://img.shields.io/npm/v/titan-agent?color=blueviolet&label=version" alt="npm version"/></a>
|
|
31
31
|
<img src="https://img.shields.io/badge/providers-37-purple" alt="37 LLM Providers"/>
|
|
32
32
|
<img src="https://img.shields.io/badge/channels-19-orange" alt="19 Channels"/>
|
|
33
33
|
<img src="https://img.shields.io/badge/skills-91-teal" alt="91 builtin skills"/>
|
|
@@ -44,18 +44,13 @@
|
|
|
44
44
|
|
|
45
45
|
<a id="whats-new"></a>
|
|
46
46
|
|
|
47
|
-
## What's new in v6.
|
|
47
|
+
## What's new in v6.5.x
|
|
48
48
|
|
|
49
|
-
A
|
|
49
|
+
A security & reliability hardening run.
|
|
50
50
|
|
|
51
|
-
- **6.
|
|
52
|
-
- **6.
|
|
53
|
-
- **6.
|
|
54
|
-
- **6.3.3 — Star on GitHub button.** Sits next to the existing Sponsor link in the bottom-center pill. Live star count cached 15 min, falls back gracefully when GitHub's rate-limited.
|
|
55
|
-
- **6.3.4 — Canvas chrome enforces collapse for existing users too.** Sidebar prefs split into route-scoped keys so a "pinned open" preference on `/missions` doesn't leak into `/space/<id>` and crowd the canvas.
|
|
56
|
-
- **6.3.5 — README refresh + `ws@8.20.1` security patch.**
|
|
57
|
-
|
|
58
|
-
Before this run: **6.2.2** fixed the in-app Update button (had been calling the wrong systemd service name with sudo permissions that didn't exist). The fix uses SIGTERM-to-self + `Restart=always`, no sudo required.
|
|
51
|
+
- **6.5.0 — Hardening sprint.** End-to-end request cancellation — Stop and client-disconnect now abort in-flight provider generation instead of running to completion. The `/v1` OpenAI-compatible endpoint is authenticated when auth is configured. Approval gates can no longer be bypassed by sibling tools in a batch. SSRF guards on the browser tools. Streaming provider errors (429/500/503) flow through retry, the fallback chain, and the circuit breaker. Discord/Telegram group replies post in-channel, Slack Socket Mode connects, and LINE/Lark inbound webhooks are wired.
|
|
52
|
+
- **6.5.1 — Security dependencies + CI.** axios → 1.17.0 and react-router → 7.17.0 (clears proxy-auth credential leak, ReDoS, prototype-pollution MITM, and XSS/DoS advisories); regenerated the lockfile to fix `npm ci`.
|
|
53
|
+
- **6.5.2 — Dependency hygiene.** Removed a vestigial pnpm lockfile and bumped `hono` + a transitive `uuid` — open Dependabot alerts dropped 38 → 4.
|
|
59
54
|
|
|
60
55
|
See [CHANGELOG.md](CHANGELOG.md) for everything.
|
|
61
56
|
|
|
@@ -139,15 +134,15 @@ The LLM picks which specialists to spawn based on the goal. You can also call th
|
|
|
139
134
|
|
|
140
135
|
| Thing | Count | Verify with |
|
|
141
136
|
|---|---|---|
|
|
142
|
-
| **Version** | 6.
|
|
143
|
-
| **
|
|
137
|
+
| **Version** | 6.5.x | `package.json`, `src/utils/constants.ts` |
|
|
138
|
+
| **Downloads** | 110K+ | `npm view titan-agent` + npm stats |
|
|
144
139
|
| **LLM providers** | 37 (5 native + 32 OpenAI-compat) | `src/providers/openai_compat.ts` |
|
|
145
140
|
| **Channel adapters** | 19 | `src/channels/*.ts` (minus base) |
|
|
146
141
|
| **Built-in skill files** | 91 | `src/skills/builtin/` |
|
|
147
142
|
| **Skills loaded at runtime** | ~143 | `GET /api/skills` |
|
|
148
143
|
| **Tools registered** | ~250 | `GET /api/skills` |
|
|
149
144
|
| **Test files** | 345 | `tests/` (vitest) |
|
|
150
|
-
| **Test cases** | 7,
|
|
145
|
+
| **Test cases** | 7,837+ passing, documented skips, 0 failing | `npm test` |
|
|
151
146
|
| **Live-eval suites** | 11 | `src/eval/harness.ts` |
|
|
152
147
|
| **Mission Control admin panels** | 43 | `ui/src/components/admin/` |
|
|
153
148
|
| **Soma drives** | 5 (purpose, curiosity, hunger, safety, social) | `src/organism/` |
|
package/dist/utils/constants.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
import { homedir } from "os";
|
|
3
3
|
import { join } from "path";
|
|
4
|
-
const TITAN_VERSION = "6.5.
|
|
4
|
+
const TITAN_VERSION = "6.5.3";
|
|
5
5
|
const TITAN_CODENAME = "Living Canvas";
|
|
6
6
|
const TITAN_NAME = "TITAN";
|
|
7
7
|
const TITAN_FULL_NAME = "The Intelligent Task Automation Network";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/utils/constants.ts"],"sourcesContent":["/**\n * TITAN Constants\n */\nimport { homedir } from 'os';\nimport { join } from 'path';\n\nexport const TITAN_VERSION = '6.5.
|
|
1
|
+
{"version":3,"sources":["../../src/utils/constants.ts"],"sourcesContent":["/**\n * TITAN Constants\n */\nimport { homedir } from 'os';\nimport { join } from 'path';\n\nexport const TITAN_VERSION = '6.5.3';\nexport const TITAN_CODENAME = 'Living Canvas';\nexport const TITAN_NAME = 'TITAN';\nexport const TITAN_FULL_NAME = 'The Intelligent Task Automation Network';\nexport const TITAN_ASCII_LOGO = `\n╔══════════════════════════════════════════════════════╗\n║ ║\n║ ████████╗██╗████████╗ █████╗ ███╗ ██╗ ║\n║ ██║ ██║ ██║ ██╔══██╗████╗ ██║ ║\n║ ██║ ██║ ██║ ███████║██╔██╗ ██║ ║\n║ ██║ ██║ ██║ ██╔══██║██║╚██╗██║ ║\n║ ██║ ██║ ██║ ██║ ██║██║ ╚████║ ║\n║ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ║\n║ ║\n║ The Intelligent Task Automation Network ║\n║ v${TITAN_VERSION} • by Tony Elliott ║\n╚══════════════════════════════════════════════════════╝`;\n\n// Paths\n// Hunt Finding #03 (2026-04-14): honor TITAN_HOME env var if set.\n// Previously this was hardcoded to `~/.titan`, which meant:\n// - Docker containers couldn't override the config path\n// - Shared machines couldn't isolate per-user state\n// - Test fixtures couldn't run against an isolated home\n// - The systemd unit's `Environment=TITAN_HOME=...` was silently ignored\n// The env var is read once at module load (constants are resolved at import time).\n// If TITAN_HOME starts with `~/`, expand it to the user's home dir.\nfunction resolveTitanHome(): string {\n const envHome = process.env.TITAN_HOME;\n if (envHome && envHome.trim().length > 0) {\n const trimmed = envHome.trim();\n if (trimmed.startsWith('~/')) {\n return join(homedir(), trimmed.slice(2));\n }\n if (trimmed === '~') {\n return homedir();\n }\n return trimmed;\n }\n return join(homedir(), '.titan');\n}\nexport const TITAN_HOME = resolveTitanHome();\nexport const TITAN_CONFIG_PATH = join(TITAN_HOME, 'titan.json');\nexport const TITAN_DB_PATH = join(TITAN_HOME, 'titan.db');\nexport const TITAN_WORKSPACE = join(TITAN_HOME, 'workspace');\nexport const TITAN_SKILLS_DIR = join(TITAN_WORKSPACE, 'skills');\nexport const TITAN_LOGS_DIR = join(TITAN_HOME, 'logs');\nexport const TITAN_MEMORY_DIR = join(TITAN_HOME, 'memory');\n\n// Workspace prompt files (injected into agent context)\nexport const AGENTS_MD = join(TITAN_WORKSPACE, 'AGENTS.md');\nexport const SOUL_MD = join(TITAN_WORKSPACE, 'SOUL.md');\nexport const TOOLS_MD = join(TITAN_WORKSPACE, 'TOOLS.md');\nexport const TITAN_MD_FILENAME = 'TITAN.md';\nexport const AUTOPILOT_MD = join(TITAN_HOME, 'AUTOPILOT.md');\nexport const AUTOPILOT_RUNS_PATH = join(TITAN_HOME, 'autopilot-runs.jsonl');\nexport const TITAN_CREDENTIALS_DIR = join(TITAN_HOME, 'credentials');\n\n// Income & lead tracking\nexport const INCOME_LEDGER_PATH = join(TITAN_HOME, 'income-ledger.jsonl');\nexport const FREELANCE_LEADS_PATH = join(TITAN_HOME, 'freelance-leads.jsonl');\nexport const FREELANCE_PROFILE_PATH = join(TITAN_HOME, 'freelance-profile.json');\nexport const LEADS_PATH = join(TITAN_HOME, 'leads.jsonl');\nexport const TELEMETRY_EVENTS_PATH = join(TITAN_HOME, 'telemetry-events.jsonl');\nexport const SOMADRIVE_STATE_PATH = join(TITAN_HOME, 'soma-drive-state.json');\nexport const ACTIVITY_LOG_PATH = join(TITAN_HOME, 'activity-log.jsonl');\n\n// v6.1.0 — Mission Chat\nexport const MISSIONS_DIR = join(TITAN_HOME, 'missions');\nexport const PLAYS_DIR = join(TITAN_HOME, 'plays');\n\n// Gateway defaults\nexport const DEFAULT_GATEWAY_HOST = '0.0.0.0';\nexport const DEFAULT_GATEWAY_PORT = 48420;\nexport const DEFAULT_WEB_PORT = 48421;\n\n// Agent defaults\n// v6.0.1 — Hardcoded floor only. The actual default at runtime is picked\n// by `getDefaultModelId()` in `src/providers/defaultModel.ts`, which\n// detects the user's available API keys (Anthropic / OpenAI / Google /\n// OpenRouter) and selects accordingly. Falls back to local Ollama when\n// no cloud keys are set. This constant is the last-resort fallback for\n// callsites that don't go through the schema thunk.\nexport const DEFAULT_MODEL = 'anthropic/claude-sonnet-4-20250514';\n/** v5.4.1: User-preference ceiling. Providers clamp per-model via\n * clampMaxTokens() so this can be high without causing 400s on\n * capped endpoints (e.g. Claude Sonnet 4 8K, Cohere 4K). */\nexport const DEFAULT_MAX_TOKENS = 200000;\nexport const DEFAULT_TEMPERATURE = 0.7;\nexport const MAX_CONTEXT_MESSAGES = 50;\nexport const SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes\n\n// Security\nexport const DEFAULT_SANDBOX_MODE = 'host';\n/** Default allowed tools. Empty = allow ALL registered tools.\n * Use security.deniedTools to block specific tools instead. */\nexport const ALLOWED_TOOLS_DEFAULT: string[] = [];\nexport const DENIED_TOOLS_DEFAULT: string[] = [];\n"],"mappings":";AAGA,SAAS,eAAe;AACxB,SAAS,YAAY;AAEd,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AACvB,MAAM,aAAa;AACnB,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAW1B,aAAa;AAAA;AAYnB,SAAS,mBAA2B;AAChC,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACtC,UAAM,UAAU,QAAQ,KAAK;AAC7B,QAAI,QAAQ,WAAW,IAAI,GAAG;AAC1B,aAAO,KAAK,QAAQ,GAAG,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC3C;AACA,QAAI,YAAY,KAAK;AACjB,aAAO,QAAQ;AAAA,IACnB;AACA,WAAO;AAAA,EACX;AACA,SAAO,KAAK,QAAQ,GAAG,QAAQ;AACnC;AACO,MAAM,aAAa,iBAAiB;AACpC,MAAM,oBAAoB,KAAK,YAAY,YAAY;AACvD,MAAM,gBAAgB,KAAK,YAAY,UAAU;AACjD,MAAM,kBAAkB,KAAK,YAAY,WAAW;AACpD,MAAM,mBAAmB,KAAK,iBAAiB,QAAQ;AACvD,MAAM,iBAAiB,KAAK,YAAY,MAAM;AAC9C,MAAM,mBAAmB,KAAK,YAAY,QAAQ;AAGlD,MAAM,YAAY,KAAK,iBAAiB,WAAW;AACnD,MAAM,UAAU,KAAK,iBAAiB,SAAS;AAC/C,MAAM,WAAW,KAAK,iBAAiB,UAAU;AACjD,MAAM,oBAAoB;AAC1B,MAAM,eAAe,KAAK,YAAY,cAAc;AACpD,MAAM,sBAAsB,KAAK,YAAY,sBAAsB;AACnE,MAAM,wBAAwB,KAAK,YAAY,aAAa;AAG5D,MAAM,qBAAqB,KAAK,YAAY,qBAAqB;AACjE,MAAM,uBAAuB,KAAK,YAAY,uBAAuB;AACrE,MAAM,yBAAyB,KAAK,YAAY,wBAAwB;AACxE,MAAM,aAAa,KAAK,YAAY,aAAa;AACjD,MAAM,wBAAwB,KAAK,YAAY,wBAAwB;AACvE,MAAM,uBAAuB,KAAK,YAAY,uBAAuB;AACrE,MAAM,oBAAoB,KAAK,YAAY,oBAAoB;AAG/D,MAAM,eAAe,KAAK,YAAY,UAAU;AAChD,MAAM,YAAY,KAAK,YAAY,OAAO;AAG1C,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAC7B,MAAM,mBAAmB;AASzB,MAAM,gBAAgB;AAItB,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB,KAAK,KAAK;AAGrC,MAAM,uBAAuB;AAG7B,MAAM,wBAAkC,CAAC;AACzC,MAAM,uBAAiC,CAAC;","names":[]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "titan-agent",
|
|
3
|
-
"version": "6.5.
|
|
3
|
+
"version": "6.5.3",
|
|
4
4
|
"description": "TITAN — TypeScript AI agent framework with multi-agent orchestration, provider routing, approval gates, receipts, evals, gateway APIs, and a React Mission Control dashboard. Open-source, MIT licensed.",
|
|
5
5
|
"author": "Tony Elliott (https://github.com/Djtony707)",
|
|
6
6
|
"repository": {
|
package/ui/dist/sw.js
CHANGED
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
* but a default falls back to the source-controlled value here.
|
|
21
21
|
*/
|
|
22
22
|
|
|
23
|
-
const CACHE_NAME = 'titan-' + ('
|
|
23
|
+
const CACHE_NAME = 'titan-' + ('1780951483483');
|
|
24
24
|
const ASSETS_PREFIX = '/assets/';
|
|
25
25
|
|
|
26
26
|
self.addEventListener('install', (event) => {
|