By devasher · Edited by Nominiclaw
This beta release introduces significant security hardening for device pairing and trusted proxies, enhances the Plugin SDK with workflow seams, and fixes critical stability issues in the auto-reply and memory systems.
This release focuses on hardening the security posture of the Gateway, expanding the capabilities of the Plugin SDK, and resolving several high-impact stability regressions in agent coordination and memory management.
nominiclaw/act interactions (select, fill, type, evaluate), ensuring that page scripts cannot move a tab to a policy-denied URL between calls.node_modules) to detect blocked code patterns before a plugin is published.items: {} to array parameters, preventing validation rejections from OpenAI-compatible providers./props endpoint, ensuring session budgeting reflects real server limits rather than training ceilings.└─ prefix, and isolated heartbeat sessions are hidden to prevent users from accidentally routing chat input into background sessions.MEMORY.md during dreaming promotions by implementing a bounded compaction budget.EACCES permission errors during Docker setup on Windows/WSL by pinning container environment paths.ConfigMutationConflictError and data loss during simultaneous agents add calls.allowFrom entries for iMessage now strictly require sender handles. Conversation IDs or chat GUIDs are no longer accepted as proof of sender identity (though they remain valid for group admission and message targeting). Users should update their allowFrom configurations to use specific sender handles.gateway.trustedProxies will no longer authenticate direct requests from that address. Use a distinct proxy peer address or the loopback trusted-proxy path.allowFrom settings for iMessage to ensure they use sender handles rather than chat IDs.