The honcho memory sink needs to observe every user's completed chat turns
from one subscription, keyed by ChatEvent.user_id. But each UserContext
minted its own per-user ChatEventBus, so a single global subscription saw
nothing.
- UserContext now publishes onto the shared Runtime.event_bus (the one
Skald::subscribe_chat_events reads) instead of a fresh per-user bus.
- Expose that bus to plugins as PluginContext.chat_bus (distinct from
system_bus, which carries only infra lifecycle events).
- plugin-honcho subscribes via ctx.chat_bus.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A botched edit left three overlapping fragments in `run()`, one
referencing an undefined `exe_dir`. Only the last was syntactically
balanced, so the file did not compile. Collapse to a single cwd-relative
`init_system_pool(SYSTEM_DB_PATH)` block, consistent with the rest of
the project.
ci/package.sh requires --os (linux|darwin) but both nightly.yml and
release.yml were calling it without --os, causing the build to fail
with 'Missing required argument'. Add --os linux to all 4 package
steps (amd64 + arm64 in each workflow).
The providers.yaml template (declarative OpenAI-compatible LLM
providers) was missing from the package — it's a default config
file like default.config.yaml and should ship with every install.
Turn the flat sidebar into a data-driven nav: each entry declares a
group (workspace/extensions/config/dev) and a numeric priority, and each
section renders by sorting on that key. Split axis is function, not
permission — adminOnly/debugOnly gate individual entries and an empty
section is hidden, so Configuration vanishes for non-admins without a
section-level role check.
- Shared folders moves into 'Your space' (still admin-gated per-entry).
- Plugin pages merge into the workspace group on the same priority line
(>=100 by default); rebase the two in-repo plugins accordingly.
- Configuration and Development are collapsible, closed by default,
state persisted in localStorage. Simple mode unchanged.
- Rename nav.catalog to 'Connectors Catalog' to disambiguate from the
Plugin Catalog; add nav.section.* header keys (en/it/fr).
- Replace dead .sidebar-section-toggle CSS with real section classes.
homes/ directory can contain files owned by other UIDs (root, etc.)
because Docker containers run as different users. Normal rm -rf fails
with Permission denied. Now falls back to sudo rm -rf automatically.
uv venv does not bundle pip by default (unlike python3 -m venv), so when the
venv python was on PATH, ensure_installed_host's 'python3 -m pip install' failed
with 'No module named pip'. Apply --seed across the 4 copies of the venv-setup
block (install.sh, install-nightly.sh, run.sh, run-docker.sh).
Rework projects from single-user leftovers into shareable endeavours.
- DB: move `projects` from the owner bucket to the registry (system.db,
not encrypted); add `owner_user_id` + `slug` (drop free `path`); new
`project_members(project_id, user_id, can_write)` mirroring
`shared_folder_members`. Drop `project_tickets` entirely. Only user↔agent
conversations stay encrypted (per-user DB) — each member keeps a private
project chat. Registry home dissolves the cross-DB-FK problem.
- Filesystem/container: on disk `{WD}/projects/{owner_userid}/{slug}`,
agent/container path `projects/{owner_username}/{slug}`. Two-segment routing
in UserFs (ProjectMount + host_base_and_tail arm) and a second loop in
build_user_fs; read-only members get a :ro mount. Reuse the shared-folder
remount machinery (refresh_user_shared_folders -> refresh_user_mounts).
- Remove the ticket system: ProjectTicketManager, UserContext.tickets, its
wiring, and the project_tickets references in scheduled_jobs/cron.
- API: repoint handlers to the registry pool + membership scoping. Sharing is
self-service — owner or any write-member may add/remove members and set
read/write; only the owner deletes; the owner cannot be removed. New
POST/DELETE /api/projects/{id}/members[/{user_id}]. Seed `@fs_any allow
projects/*`; build_runtime_run_context sets working_directory to the agent
path and drops the host-path allow_fs_writes.
- Frontend: create form without the free path field, owner/read-write badges;
the detail page becomes header + description + sharing panel + Open chat + a
file-explorer placeholder (the future primary surface). i18n en/it/fr.
install.sh / install-nightly.sh:
- Write .release-channel file ('release' or 'nightly') for future updates
- install.sh also writes .release-version (for update --check)
update.sh (new):
- Reads .release-channel to determine which channel to pull from
- Release: checks releases/LATEST vs .release-version, skips if current
- Nightly: always downloads latest
- Stops service before extraction, restarts after
- Rebuilds Python venv on update
ci/package.sh:
- Include update.sh in distribution tarball
Web / mobile:
- Add settings-page component for mobile
- Wire settings page into mobile-app navigation
- Chat page: load current user (/api/auth/me) for sender identity
- Full mobile.css redesign
- i18n: add mobile settings strings (en/fr/it)
torch and bitsandbytes pull in hundreds of MB of CUDA libraries
(nvidia_cublas ~423 MB) which are useless on headless servers
without an NVIDIA GPU like the NiPoGi.
- requirements.txt: keep only lightweight essential dependencies
- requirements-optional.txt (new): Orpheus TTS deps (torch, transformers,
bitsandbytes, snac, huggingface_hub)
- Installers and update.sh: show hint about optional deps after install
- ci/package.sh: include requirements-optional.txt in tarball
A user's session sees global MCP connectors through UserMcpView, filtered by
accessible_global — a snapshot of mcp_global_access taken when the user's
UserContext is built at login. That context is cached until restart, so an admin
enabling/deleting a global connector or changing its access set was invisible in
MCP_LIST (and in the tool surface) until the whole process restarted.
Make accessible_global a swappable cell (SharedGlobalAccess, the MCP twin of
SharedFs for §6 fs remount): UserContext::refresh_global_access re-reads the
registry and stores it in place, and Skald::refresh_global_mcp_access broadcasts
that to every live context. Wire it into global_enable, global_delete,
global_set_access and user_connectors_set so a grant/enable is reflected in
running sessions immediately.
Also add the shared common/mcp.md include (the <!-- MCP_LIST --> sentinel) to the
kid agent, aligning it with the other agents.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Strip ~55 stale upstream docs (dev docs never meant for the agents)
- Write new slim index.md as an agent-facing guide to the app's features
- Add new plugin docs: comfyui, elevenlabs, kokoro_tts, orpheus_tts_3b,
remote_connectivity, whisper_local (replacing old names)
- Add docs_host to UserFs: docs/… and ~/docs/… resolve to {WD}/docs,
mounted read-only at /root/docs in every user's container
- Instruct assistant/kid/project-coordinator agents to read docs/index.md
when users ask how the software works
When the resolved model declares an input modality (vision → images,
video, document → PDFs), read_file now hands a binary media file back to
the model as native input instead of failing on non-UTF-8 bytes.
- ToolResult gains a Media { text, media } variant carrying MediaRef
{ host_path, mime }; the tool message keeps only the text note, the
bytes travel out of band in a new additive chat_llm_tools.media column
(mirrors preview_old/new).
- read_file sniffs the resolved host file; a recognized medium becomes a
Media result (with a neutral note), everything else keeps the textual
path. Capability gating lives in the message builder, so read_file
never needs the model caps and degrades cleanly on a text-only model.
- MessageBuilder inlines current-turn tool media as a synthetic user
message right after the tool-result group (media_turn_start boundary,
so older turns are never re-billed), reusing media.rs primitives via a
new inline_paths helper that contains against the caller's workspace
roots. OpenAI forwards the parts verbatim; the Anthropic client now
also translates the PDF `file` part into a native `document` block
(image_url → image was already handled).
- read_file's description is annotated per serving model in
call_llm_round, listing the formats it can open, so the model knows
reading one shows it the content.
Tests: media sniff (PDF), PDF file-part build, inline_paths containment
+ capability gating, capability hint, read_file media-vs-text, Anthropic
file→document, and the owner-schema-stands-alone check with the new
column.
LM Studio: delegate streaming to the inner OpenAI client.
LoggingChatbotClient: extract shared log_and_return helper, add
streaming override so deltas are forwarded and metadata still logged.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rework projects from single-user leftovers into shareable endeavours. - DB: move `projects` from the owner bucket to the registry (system.db, not encrypted); add `owner_user_id` + `slug` (drop free `path`); new `project_members(project_id, user_id, can_write)` mirroring `shared_folder_members`. Drop `project_tickets` entirely. Only user↔agent conversations stay encrypted (per-user DB) — each member keeps a private project chat. Registry home dissolves the cross-DB-FK problem. - Filesystem/container: on disk `{WD}/projects/{owner_userid}/{slug}`, agent/container path `projects/{owner_username}/{slug}`. Two-segment routing in UserFs (ProjectMount + host_base_and_tail arm) and a second loop in build_user_fs; read-only members get a :ro mount. Reuse the shared-folder remount machinery (refresh_user_shared_folders -> refresh_user_mounts). - Remove the ticket system: ProjectTicketManager, UserContext.tickets, its wiring, and the project_tickets references in scheduled_jobs/cron. - API: repoint handlers to the registry pool + membership scoping. Sharing is self-service — owner or any write-member may add/remove members and set read/write; only the owner deletes; the owner cannot be removed. New POST/DELETE /api/projects/{id}/members[/{user_id}]. Seed `@fs_any allow projects/*`; build_runtime_run_context sets working_directory to the agent path and drops the host-path allow_fs_writes. - Frontend: create form without the free path field, owner/read-write badges; the detail page becomes header + description + sharing panel + Open chat + a file-explorer placeholder (the future primary surface). i18n en/it/fr.install.sh / install-nightly.sh: - Write .release-channel file ('release' or 'nightly') for future updates - install.sh also writes .release-version (for update --check) update.sh (new): - Reads .release-channel to determine which channel to pull from - Release: checks releases/LATEST vs .release-version, skips if current - Nightly: always downloads latest - Stops service before extraction, restarts after - Rebuilds Python venv on update ci/package.sh: - Include update.sh in distribution tarball Web / mobile: - Add settings-page component for mobile - Wire settings page into mobile-app navigation - Chat page: load current user (/api/auth/me) for sender identity - Full mobile.css redesign - i18n: add mobile settings strings (en/fr/it)- Strip ~55 stale upstream docs (dev docs never meant for the agents) - Write new slim index.md as an agent-facing guide to the app's features - Add new plugin docs: comfyui, elevenlabs, kokoro_tts, orpheus_tts_3b, remote_connectivity, whisper_local (replacing old names) - Add docs_host to UserFs: docs/… and ~/docs/… resolve to {WD}/docs, mounted read-only at /root/docs in every user's container - Instruct assistant/kid/project-coordinator agents to read docs/index.md when users ask how the software worksWhen the resolved model declares an input modality (vision → images, video, document → PDFs), read_file now hands a binary media file back to the model as native input instead of failing on non-UTF-8 bytes. - ToolResult gains a Media { text, media } variant carrying MediaRef { host_path, mime }; the tool message keeps only the text note, the bytes travel out of band in a new additive chat_llm_tools.media column (mirrors preview_old/new). - read_file sniffs the resolved host file; a recognized medium becomes a Media result (with a neutral note), everything else keeps the textual path. Capability gating lives in the message builder, so read_file never needs the model caps and degrades cleanly on a text-only model. - MessageBuilder inlines current-turn tool media as a synthetic user message right after the tool-result group (media_turn_start boundary, so older turns are never re-billed), reusing media.rs primitives via a new inline_paths helper that contains against the caller's workspace roots. OpenAI forwards the parts verbatim; the Anthropic client now also translates the PDF `file` part into a native `document` block (image_url → image was already handled). - read_file's description is annotated per serving model in call_llm_round, listing the formats it can open, so the model knows reading one shows it the content. Tests: media sniff (PDF), PDF file-part build, inline_paths containment + capability gating, capability hint, read_file media-vs-text, Anthropic file→document, and the owner-schema-stands-alone check with the new column.