changelog

← arizuko · concepts · getting started

What shipped, dated, terse. Reverse chronological. The chat broadcast for each release lives at the top of every block; the bullets below expand it for operators.

arizuko v0.42.0 — 19 May 2026

Five new dashd pages, three security fixes, and secrets now encrypted at rest. The operator dashboard is usable for day-to-day ops without touching .env or the DB.

• Invites page — issue/revoke onboarding links from /dash/invites/.
• Per-group model selector — pick Opus 4.7, Sonnet 4.6, or Haiku 4.5 per group.
• Skill enable/disable — toggle agent skills per group without editing files.
• Grants viewer — add/revoke ACL rows per group from /dash/groups/{folder}/grants.
• Workspace links — settings page links to /dav/{folder}/ for file editing (CLAUDE.md, PERSONA.md, MEMORY.md).
• Secrets encrypted AES-256-GCM — SECRETS_KEY separate from AUTH_SECRET. Plaintext rows rejected on startup.
• Security fixes — list_acl MCP tool now works; inject_message and escalate_group tier gates now enforced; tier-2 web mount scoped to own group dir; egress wildcard restricted to tier ≤ 1.

Full notes: CHANGELOG § v0.42.0

arizuko v0.41.0 — 18 May 2026

Mint a public chat URL or a webhook URL with one MCP call; both flow into the same agent through the same store.

• Route tokens (issue_chat_link / issue_webhook MCP tools) — agents mint URL-bound credentials on demand.
• New /chat/<token>/ and /hook/<token> — legacy /slink/* 301s to the new paths.
• arizuko token issue|list|revoke CLI plus REST /v1/route_tokens for operators and dashd.
• route_tokens table replaces groups.slink_token; no backfill — reissue by hand.

Full notes: CHANGELOG § v0.41.0

arizuko v0.33.0 — 2 May 2026

Voice replies close the loop on the audio channel that Whisper opened months ago, and the router stops guessing JID kinds from sign bits — every adapter now emits typed addresses (telegram:group/…, discord:<guild>/<channel>) so routes, grants, and onboarding speak one language.

• Voice replies (send_voice) — agent-controlled TTS via a bundled ttsd proxying Kokoro-FastAPI; Telegram/WhatsApp render as push-to-talk, Discord as inline audio. Per-agent voice via PERSONA.md frontmatter. Cached by hash.
• Thread-scoped history (get_thread MCP) — pull just one topic out of a chat’s history; tier-gated like inspect_messages.
• External agents over slink (POST /slink/<token>/mcp) — register a token-bound URL as a remote MCP server in Claude Code or any MCP client; three group-scoped tools (send_message, steer, get_round). Token is the auth.
• OAuth account linking (/dash/profile) — one canonical sub across providers, with a collision-resolution UX when a new OAuth identity doesn’t fit silently.
• Typed JID routing — telegram:group/* scopes to groups but not DMs; sign-bit guessing retired across the router and grants tables.
• Idle-timeout default raised to 60 min — stops mid-turn container kills caused by stale per-instance overrides reading 60 ms.

Full notes: CHANGELOG § v0.33.0

arizuko v0.32.2 — 30 Apr 2026

URL polish on the slink round-handle protocol shipped in v0.32.0. The verb does the work now — POST extends a round, GET observes it — and special tokens (/turn/, ?steer=) disappear.

• Cleaner round URLs — the second URL segment after the token IS the round handle. GET /slink/<token>/<id>, …/status, …/sse; POST /slink/<token>/<id> means “steer this round.”
• CLI + docs follow — arizuko send and /pub/slink/reference/ updated to the new shape; old paths retired.

Full notes: CHANGELOG § v0.32.2

arizuko v0.32.1 — 30 Apr 2026

Quiet bugfix release. Closes a cross-world spam vector revealed by v0.32.0’s own release broadcast: tier-1 world agents could send to chats that route to other worlds, producing the same notice 2–4× per chat.

• Outbound MCP authorization — every send-shaped tool (send, send_file, reply, post, like, dislike, delete, edit, forward, quote, repost) resolves the JID’s owning folder and checks subtree containment. No tier bypass; even the instance root cannot direct-send across worlds.
• Inter-world communication goes through delegate_group/escalate_group instead. Unrouted JIDs are denied for every caller.

Full notes: CHANGELOG § v0.32.1

arizuko v0.32.0 — 30 Apr 2026

Slink becomes the universal “drop a message, observe the round” surface. Every agent run is now a first-class object with a stable handle, pageable frames, an SSE stream that closes cleanly, and steering for chained follow-ups — useful for cron jobs, web pages, and scripts that need to talk to the agent without a full chat client.

• Slink round-handle protocol — POST /slink/<token> returns {user, turn_id, status:pending}; the round is observable via snapshot, cursor paging, cheap status, or live SSE with a terminal round_done event.
• Steering — inject a follow-up onto an in-flight round; per-folder queue serialization makes it the immediate next round, with chained_from linking the two.
• arizuko send CLI — inject messages from the server into any group via slink; --wait, --stream, --steer flags.
• Public web docs at /pub/concepts/slink.html and /pub/slink/reference/.
• Group state machinery removed — no more closure-then-archive cycle, no spawn_ttl_days, no daily cleanup loop. Groups exist until explicitly removed.
• Crackbox DNS & davd healthcheck fixes rolled in from v0.31.1 — per-folder networks now resolve crackbox; davd reports health.

Full notes: CHANGELOG § v0.32.0

older

Everything before v0.32.0 lives in the canonical CHANGELOG.md on GitHub.