github-actions[bot]
660fa8cfb6
chore: release main ( #1574 )
...
Docker / docker-manifest (map[bake_target:runtime name:]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-code name:code]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-code-nonroot name:code-nonroot]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-code-slim name:code-slim]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-code-slim-nonroot name:code-slim-nonroot]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-nonroot name:nonroot]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-slim name:slim]) (push) Blocked by required conditions
Docker / docker-manifest (map[bake_target:runtime-slim-nonroot name:slim-nonroot]) (push) Blocked by required conditions
Docker / promote-latest (push) Blocked by required conditions
Init Native E2E / init-native (ubuntu-latest, claude) (push) Failing after 7s
Init Native E2E / init-native (ubuntu-latest, codex) (push) Failing after 6s
Init E2E / docker-init-e2e (push) Failing after 9s
Init Native E2E / init-native (ubuntu-latest, copilot) (push) Failing after 6s
Install Native E2E / install-native (ubuntu-latest) (push) Failing after 6s
Merge Conflicts / merge-conflicts (push) Failing after 5s
Release Please / release-please (push) Failing after 4s
Security / CodeQL (javascript-typescript) (push) Failing after 30s
Security / CodeQL (python) (push) Failing after 18s
Wrap E2E / docker-wrap-e2e (push) Failing after 11s
Security / Dependency audit (pip-audit) (push) Failing after 54s
Wrap Native E2E / wrap-native (ubuntu-latest) (push) Failing after 5s
Security / Secret scan (gitleaks) (push) Failing after 27s
Dev Containers / validate (.devcontainer/devcontainer.json, default) (push) Failing after 14m26s
CI / windows-native-wrapper (push) Has been cancelled
CI / macos-native-wrapper (push) Has been cancelled
Init Native E2E / init-native (macos-latest, claude) (push) Has been cancelled
Init Native E2E / init-native (macos-latest, codex) (push) Has been cancelled
Init Native E2E / init-native (macos-latest, copilot) (push) Has been cancelled
Install Native E2E / install-native (macos-latest) (push) Has been cancelled
Wrap Native E2E / wrap-native (macos-latest) (push) Has been cancelled
🤖 I have created a release *beep* *boop*
---
<details><summary>0.29.0</summary>
##
[0.29.0](https://github.com/headroomlabs-ai/headroom/compare/v0.28.0...v0.29.0 )
(2026-07-03)
### Features
* **proxy:** add --lossless no-CCR mode with format-native compaction
([#1721 ](https://github.com/headroomlabs-ai/headroom/issues/1721 ))
([c75ebdec75ebdee6d#1680 ](https://github.com/headroomlabs-ai/headroom/issues/1680 ))
([2fe19c32fe19c39e4#1726 ](https://github.com/headroomlabs-ai/headroom/issues/1726 ))
([eea667aeea667a720#1553 ](https://github.com/headroomlabs-ai/headroom/issues/1553 ))
([54cfa3654cfa361d3#1456 ](https://github.com/headroomlabs-ai/headroom/issues/1456 ))
([7d87aa27d87aa2f1c#1564 ](https://github.com/headroomlabs-ai/headroom/issues/1564 ))
([96e1dfe96e1dfe395#1610 ](https://github.com/headroomlabs-ai/headroom/issues/1610 ))
([4bf7f924bf7f92417#1634 ](https://github.com/headroomlabs-ai/headroom/issues/1634 ))
([d5bf98dd5bf98df31#1431 ](https://github.com/headroomlabs-ai/headroom/issues/1431 ))
([ddd4adfddd4adf911#1479 ](https://github.com/headroomlabs-ai/headroom/issues/1479 ))
([de24cd5de24cd5fc0#1474 ](https://github.com/headroomlabs-ai/headroom/issues/1474 ))
([f00ace6f00ace6da5#1653 ](https://github.com/headroomlabs-ai/headroom/issues/1653 ))
([646e705646e705514#1511 ](https://github.com/headroomlabs-ai/headroom/issues/1511 ))
([e035aefe035aefce2#1548 ](https://github.com/headroomlabs-ai/headroom/issues/1548 ))
([e386c09e386c097d6#1527 ](https://github.com/headroomlabs-ai/headroom/issues/1527 ))
([99a854099a8540e65#1576 ](https://github.com/headroomlabs-ai/headroom/issues/1576 ))
([816cb85816cb85fa8#1544 ](https://github.com/headroomlabs-ai/headroom/issues/1544 ))
([#1560 ](https://github.com/headroomlabs-ai/headroom/issues/1560 ))
([6b227b96b227b9c90#1288 ](https://github.com/headroomlabs-ai/headroom/issues/1288 ))
([27a546827a5468349#1428 ](https://github.com/headroomlabs-ai/headroom/issues/1428 ))
([1c0e1521c0e15243e#198 ](https://github.com/headroomlabs-ai/headroom/issues/198 ))
([#1559 ](https://github.com/headroomlabs-ai/headroom/issues/1559 ))
([b84afbfb84afbfb83#1691 ](https://github.com/headroomlabs-ai/headroom/issues/1691 ))
([bec47a1bec47a1898#1459 ](https://github.com/headroomlabs-ai/headroom/issues/1459 ))
([adaeb88adaeb88a4d#1596 ](https://github.com/headroomlabs-ai/headroom/issues/1596 ))
([c19347cc19347c310#1573 ](https://github.com/headroomlabs-ai/headroom/issues/1573 ))
([ad0034fad0034f981#1427 ](https://github.com/headroomlabs-ai/headroom/issues/1427 ))
([a932247a9322477e3#1672 ](https://github.com/headroomlabs-ai/headroom/issues/1672 ))
([8cddf9b8cddf9b58e#1647 ](https://github.com/headroomlabs-ai/headroom/issues/1647 ))
([5fe4e7b5fe4e7b195#1430 ](https://github.com/headroomlabs-ai/headroom/issues/1430 ))
([15ac65015ac650d40#1451 ](https://github.com/headroomlabs-ai/headroom/issues/1451 ))
([d337e3bd337e3b828#1473 ](https://github.com/headroomlabs-ai/headroom/issues/1473 ))
([312129a312129a8e7#1598 ](https://github.com/headroomlabs-ai/headroom/issues/1598 ))
([2a34a822a34a822f2#1663 ](https://github.com/headroomlabs-ai/headroom/issues/1663 ))
([9fbd47b9fbd47ba6b#1632 ](https://github.com/headroomlabs-ai/headroom/issues/1632 ))
([814ffa3814ffa36a4#1429 ](https://github.com/headroomlabs-ai/headroom/issues/1429 ))
([72ade3772ade37112#1162 ](https://github.com/headroomlabs-ai/headroom/issues/1162 ))
([64783d864783d8824#1719 ](https://github.com/headroomlabs-ai/headroom/issues/1719 ))
([0d18ef20d18ef26f4#575 ](https://github.com/headroomlabs-ai/headroom/issues/575 ))
([#1563 ](https://github.com/headroomlabs-ai/headroom/issues/1563 ))
([95abca395abca3abd#1393 ](https://github.com/headroomlabs-ai/headroom/issues/1393 ))
([cff7247cff7247efd#1464 ](https://github.com/headroomlabs-ai/headroom/issues/1464 ))
([6cba4416cba4419d0#1477 ](https://github.com/headroomlabs-ai/headroom/issues/1477 ))
([75427bb75427bbd4a#1604 ](https://github.com/headroomlabs-ai/headroom/issues/1604 ))
([c9d717cc9d717c13chttps://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-02 22:54:04 -07:00
github-actions[bot]
aea3c35177
chore: release main ( #1441 )
...
🤖 I have created a release *beep* *boop*
---
<details><summary>0.28.0</summary>
##
[0.28.0](https://github.com/headroomlabs-ai/headroom/compare/v0.27.0...v0.28.0 )
(2026-06-29)
### Features
* add --disable-kompress-fallback to restore legacy PASSTHROUGH fallback
([#1185 ](https://github.com/headroomlabs-ai/headroom/issues/1185 ))
([f309244f309244a77#559 ](https://github.com/headroomlabs-ai/headroom/issues/559 ))
([91cd21091cd2102d7#1124 ](https://github.com/headroomlabs-ai/headroom/issues/1124 ))
([85786b385786b33a3#1138 ](https://github.com/headroomlabs-ai/headroom/issues/1138 ))
([e5031b0e5031b0121#1313 ](https://github.com/headroomlabs-ai/headroom/issues/1313 ))
([#1343 ](https://github.com/headroomlabs-ai/headroom/issues/1343 ))
([46587214658721ea0#1125 ](https://github.com/headroomlabs-ai/headroom/issues/1125 ))
([f39858cf39858c233#1105 ](https://github.com/headroomlabs-ai/headroom/issues/1105 ))
([b4571ccb4571cc346#1160 ](https://github.com/headroomlabs-ai/headroom/issues/1160 ))
([14e8dc414e8dc4c84#1115 ](https://github.com/headroomlabs-ai/headroom/issues/1115 ))
([ced75e4ced75e4718#738 ](https://github.com/headroomlabs-ai/headroom/issues/738 ))
([c0745d4c0745d4161#1537 ](https://github.com/headroomlabs-ai/headroom/issues/1537 ))
([546ab55546ab553dc#870 ](https://github.com/headroomlabs-ai/headroom/issues/870 ))
([#1259 ](https://github.com/headroomlabs-ai/headroom/issues/1259 ))
([a2159c0a2159c0b66#1068 ](https://github.com/headroomlabs-ai/headroom/issues/1068 ))
([723b80c723b80c091#1127 ](https://github.com/headroomlabs-ai/headroom/issues/1127 ))
([978ffa0978ffa0a6a#1158 ](https://github.com/headroomlabs-ai/headroom/issues/1158 ))
([#1351 ](https://github.com/headroomlabs-ai/headroom/issues/1351 ))
([b50d9c1b50d9c17ce#1230 ](https://github.com/headroomlabs-ai/headroom/issues/1230 ))
([dca9853dca9853ed9#1037 ](https://github.com/headroomlabs-ai/headroom/issues/1037 ))
([84f987184f9871e30#1312 ](https://github.com/headroomlabs-ai/headroom/issues/1312 ))
([#1336 ](https://github.com/headroomlabs-ai/headroom/issues/1336 ))
([5986c225986c2260f#1486 ](https://github.com/headroomlabs-ai/headroom/issues/1486 ))
([4db3bc94db3bc91d9#1284 ](https://github.com/headroomlabs-ai/headroom/issues/1284 ))
([530318b530318b425#1532 ](https://github.com/headroomlabs-ai/headroom/issues/1532 ))
([c2fc4d3c2fc4d3753#1022 ](https://github.com/headroomlabs-ai/headroom/issues/1022 ))
([#1197 ](https://github.com/headroomlabs-ai/headroom/issues/1197 ))
([0c9b42a0c9b42a919#1273 ](https://github.com/headroomlabs-ai/headroom/issues/1273 ))
([2cae13d2cae13dd79#1539 ](https://github.com/headroomlabs-ai/headroom/issues/1539 ))
([d2565a6d2565a6983#1399 ](https://github.com/headroomlabs-ai/headroom/issues/1399 ))
([2e29c722e29c7223f#1012 ](https://github.com/headroomlabs-ai/headroom/issues/1012 ))
([51943885194388b66#1126 ](https://github.com/headroomlabs-ai/headroom/issues/1126 ))
([#1164 ](https://github.com/headroomlabs-ai/headroom/issues/1164 ))
([a0cb798a0cb7982e3#1206 ](https://github.com/headroomlabs-ai/headroom/issues/1206 ))
([38f140438f1404432#1491 ](https://github.com/headroomlabs-ai/headroom/issues/1491 ))
([bd76235bd76235f5c#1373 ](https://github.com/headroomlabs-ai/headroom/issues/1373 ))
([e06b616e06b61671f#1375 ](https://github.com/headroomlabs-ai/headroom/issues/1375 ))
([8aab8f28aab8f22cb#1332 ](https://github.com/headroomlabs-ai/headroom/issues/1332 ))
([823840282384022bd#1302 ](https://github.com/headroomlabs-ai/headroom/issues/1302 ))
([cbd361dcbd361de2a#1231 ](https://github.com/headroomlabs-ai/headroom/issues/1231 ))
([#1299 ](https://github.com/headroomlabs-ai/headroom/issues/1299 ))
([5e0bb695e0bb69725#961 ](https://github.com/headroomlabs-ai/headroom/issues/961 ))
([#1349 ](https://github.com/headroomlabs-ai/headroom/issues/1349 ))
([e6bbc40e6bbc40b11#1269 ](https://github.com/headroomlabs-ai/headroom/issues/1269 ))
([ad7993bad7993bf15#1324 ](https://github.com/headroomlabs-ai/headroom/issues/1324 ))
([35939c335939c3536#1509 ](https://github.com/headroomlabs-ai/headroom/issues/1509 ))
([5771a805771a8020e#1118 ](https://github.com/headroomlabs-ai/headroom/issues/1118 ))
([5912d655912d65674#1382 ](https://github.com/headroomlabs-ai/headroom/issues/1382 ))
([615848e615848eba4#1276 ](https://github.com/headroomlabs-ai/headroom/issues/1276 ))
([17ecad917ecad9d89#1301 ](https://github.com/headroomlabs-ai/headroom/issues/1301 ))
([8da0b4e8da0b4e565#1290 ](https://github.com/headroomlabs-ai/headroom/issues/1290 ))
([da1a397da1a3973ed#833 ](https://github.com/headroomlabs-ai/headroom/issues/833 ))
([#1348 ](https://github.com/headroomlabs-ai/headroom/issues/1348 ))
([feedeadfeedead077#1498 ](https://github.com/headroomlabs-ai/headroom/issues/1498 ))
([1baa04e1baa04ef65#1400 ](https://github.com/headroomlabs-ai/headroom/issues/1400 ))
([42612c842612c86df#1287 ](https://github.com/headroomlabs-ai/headroom/issues/1287 ))
([3590046359004646b#1386 ](https://github.com/headroomlabs-ai/headroom/issues/1386 ))
([22def9322def93177#1106 ](https://github.com/headroomlabs-ai/headroom/issues/1106 ))
([f216e43f216e43055#1381 ](https://github.com/headroomlabs-ai/headroom/issues/1381 ))
([6c837906c83790680#1499 ](https://github.com/headroomlabs-ai/headroom/issues/1499 ))
([80fa08680fa086660#571 ](https://github.com/headroomlabs-ai/headroom/issues/571 ))
([b618d2db618d2d11a#1433 ](https://github.com/headroomlabs-ai/headroom/issues/1433 ))
([936274793627471b7#1374 ](https://github.com/headroomlabs-ai/headroom/issues/1374 ))
([51d4bcf51d4bcfc11#1331 ](https://github.com/headroomlabs-ai/headroom/issues/1331 ))
([3be25263be2526b76#1321 ](https://github.com/headroomlabs-ai/headroom/issues/1321 ))
([bb3e040bb3e040a46#1500 ](https://github.com/headroomlabs-ai/headroom/issues/1500 ))
([d5ac07fd5ac07fc45#1134 ](https://github.com/headroomlabs-ai/headroom/issues/1134 ))
([561ba17561ba17ec2#1100 ](https://github.com/headroomlabs-ai/headroom/issues/1100 ))
([#1258 ](https://github.com/headroomlabs-ai/headroom/issues/1258 ))
([3d59df73d59df7be8#1338 ](https://github.com/headroomlabs-ai/headroom/issues/1338 ))
([acafb2dacafb2d0f6#996 ](https://github.com/headroomlabs-ai/headroom/issues/996 ))
([b4682d6b4682d6f91#296 ](https://github.com/headroomlabs-ai/headroom/issues/296 ))
([#1352 ](https://github.com/headroomlabs-ai/headroom/issues/1352 ))
([90734b690734b691a#1501 ](https://github.com/headroomlabs-ai/headroom/issues/1501 ))
([27e010e27e010e38f#1103 ](https://github.com/headroomlabs-ai/headroom/issues/1103 ))
([cdfeeaccdfeeacc63#1377 ](https://github.com/headroomlabs-ai/headroom/issues/1377 ))
([b09f027b09f027062#1376 ](https://github.com/headroomlabs-ai/headroom/issues/1376 ))
([55c700c55c700c686#1132 ](https://github.com/headroomlabs-ai/headroom/issues/1132 ))
([#1305 ](https://github.com/headroomlabs-ai/headroom/issues/1305 ))
([70cc96a70cc96a386#1329 ](https://github.com/headroomlabs-ai/headroom/issues/1329 ))
([90bee8990bee89243#1495 ](https://github.com/headroomlabs-ai/headroom/issues/1495 ))
([547b15d547b15dab2#1323 ](https://github.com/headroomlabs-ai/headroom/issues/1323 ))
([43494ff43494ff526#1543 ](https://github.com/headroomlabs-ai/headroom/issues/1543 ))
([5d3803a5d3803a21c#1488 ](https://github.com/headroomlabs-ai/headroom/issues/1488 ))
([91571739157173018#1465 ](https://github.com/headroomlabs-ai/headroom/issues/1465 ))
([16c638b16c638bc21#1540 ](https://github.com/headroomlabs-ai/headroom/issues/1540 ))
([a7d3360a7d3360a05#549 ](https://github.com/headroomlabs-ai/headroom/issues/549 ))
([24cf25624cf256e50#1489 ](https://github.com/headroomlabs-ai/headroom/issues/1489 ))
([8e0dadf8e0dadfe02#1123 ](https://github.com/headroomlabs-ai/headroom/issues/1123 ))
([#1260 ](https://github.com/headroomlabs-ai/headroom/issues/1260 ))
([a00fb67a00fb6761e#1314 ](https://github.com/headroomlabs-ai/headroom/issues/1314 ))
([97588179758817979#1130 ](https://github.com/headroomlabs-ai/headroom/issues/1130 ))
([27d6f8e27d6f8e2a7#1255 ](https://github.com/headroomlabs-ai/headroom/issues/1255 ))
([8d6c1758d6c175d60#1263 ](https://github.com/headroomlabs-ai/headroom/issues/1263 ))
([f03021ff03021f1b6#1296 ](https://github.com/headroomlabs-ai/headroom/issues/1296 ))
([c30ec4cc30ec4cda8#1117 ](https://github.com/headroomlabs-ai/headroom/issues/1117 ))
([fda4670fda4670ef8#1308 ](https://github.com/headroomlabs-ai/headroom/issues/1308 ))
([#1341 ](https://github.com/headroomlabs-ai/headroom/issues/1341 ))
([52068dd52068dd650#1093 ](https://github.com/headroomlabs-ai/headroom/issues/1093 ))
([a35fe86a35fe86e87#1307 ](https://github.com/headroomlabs-ai/headroom/issues/1307 ))
([#1387 ](https://github.com/headroomlabs-ai/headroom/issues/1387 ))
([c6c921ac6c921a7c1#1481 ](https://github.com/headroomlabs-ai/headroom/issues/1481 ))
([c632023c632023cc1#1311 ](https://github.com/headroomlabs-ai/headroom/issues/1311 ))
([d633e81d633e8172c#1251 ](https://github.com/headroomlabs-ai/headroom/issues/1251 ))
([b4fde0cb4fde0c3a4#1191 ](https://github.com/headroomlabs-ai/headroom/issues/1191 ))
([959ab0d959ab0de47#1294 ](https://github.com/headroomlabs-ai/headroom/issues/1294 ))
([b829cebb829ceba84#1313 ](https://github.com/headroomlabs-ai/headroom/issues/1313 ))
([b0146c4b0146c4ccd#1171 ](https://github.com/headroomlabs-ai/headroom/issues/1171 ))
([#1298 ](https://github.com/headroomlabs-ai/headroom/issues/1298 ))
([6c68ff46c68ff4e9fhttps://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-29 12:53:17 -07:00
Tejas Chopra
5771a8020e
fix(deps): remediate dependency CVEs and publish SBOM ( #1509 )
...
## Description
Supply-chain hardening: takes the **shipped** dependency surface from
**26 known CVEs to 0**. `pip install headroom-ai[all]` now resolves with
no known vulnerabilities (verified with Anchore syft + grype). Also
publishes a checked-in SBOM package (`sbom/`) so any user — especially
pilots running their own security review — can verify what's inside and
that we track it.
This addresses the Dependabot alerts on `main` (9 high / 4 moderate / 7
low at time of writing).
Closes #
## Type of Change
- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)
## Changes Made
**Rust**
- `pyo3` 0.24 → 0.29 (GHSA-36hh-v3qg-5jq4 High, GHSA-chgr-c6px-7xpp
Med). Migrated `Python::allow_threads` → `Python::detach` (10 sites) and
added `from_py_object` to the `Clone`-deriving `#[pyclass]` types (both
required by the 0.25+ API).
- `pyo3-log` 0.12 → 0.13; `lru` 0.12 → 0.18 (GHSA-rhfx-m35p-ff5j).
**Python**
- `torch` → 2.12.1, `mem0ai` → 2.x.
- Floor-pinned transitive CVE deps via `[tool.uv]
constraint-dependencies`: `pygments>=2.20.0`,
`pydantic-settings>=2.14.2`, `gitpython>=3.1.50`, `langsmith>=0.9.0`.
- **Removed `benchmark` from the `[all]` aggregate** so the default
install is CVE-free. `lm-eval` is invoked as an external subprocess
(`python -m lm_eval`) and never imported, so it is not a true runtime
dep — it remains available via the opt-in `[benchmark]` extra. See
[Accepted Risks](#additional-notes).
**npm (build/test tooling — never shipped in the
wheel/container/published SDK)**
- `esbuild` override `>=0.28.1` in `sdk/typescript` + `plugins/openclaw`
(GHSA-g7r4-m6w7-qqqr).
- `docs/`: `@anthropic-ai/sdk` → `^0.106.0` (GHSA-p7fg-763f-g4gf),
`postcss` override to force Next.js's bundled copy ≥8.5.10
(GHSA-qx2v-qp2m-jg93); regenerated a stale `bun.lock` that carried a
**Critical** vitest/vite.
**CI**
- Pinned `pypa/gh-action-pypi-publish` `@release/v1` → `@v1.13.0`
(GHSA-vxmw-7h4f-hqxh) in `release.yml` + `publish.yml`.
**SBOM**
- New `sbom/` directory: CycloneDX 1.7 + SPDX 2.3 SBOMs, grype scan
evidence, 330-package license inventory, and a regeneration guide.
## Testing
- [ ] Unit tests pass (`pytest`) — N/A, no Python source changed
(deps/config only)
- [x] Linting passes — `cargo fmt --check` + `cargo clippy` clean on the
changed crate; 0 `.py` files changed so `ruff`/`mypy` scope is
unaffected
- [x] Type checking passes — `cargo check --workspace` (0 errors)
- [ ] New tests added — N/A (dependency bumps; covered by existing
suites)
- [x] Manual testing performed — see Real Behavior Proof
### Test Output
```text
# headroom-ai[all] product surface — the number that matters
$ grype sbom:sbom/headroom-sbom-all-extra.cdx.json
No vulnerabilities found
# full repo scan (universal lock incl. opt-in [benchmark] + dev)
$ grype sbom:sbom/headroom-sbom.cdx.json
NAME INSTALLED TYPE VULNERABILITY SEVERITY
sqlitedict 2.1.0 python GHSA-g4r7-86gm-pgqc High # [benchmark]-only, unpatchable, accepted
nltk 3.9.4 python GHSA-p4gq-832x-fm9v High # [benchmark]-only, unpatchable, accepted
# pyo3 0.29 migration — extension builds + imports + runs
$ cargo check --workspace
Finished `dev` profile [unoptimized + debuginfo] target(s)
$ maturin develop && python -c "from headroom._core import DiffCompressor, SmartCrusher; ..."
extension OK — detach + from_py_object paths exercised
# lru 0.18 — eviction path
$ cargo test -p headroom-proxy --lib drift
14 passed, 213 filtered out
# per-ecosystem npm audits
$ (cd sdk/typescript && npm audit) -> found 0 vulnerabilities
$ (cd plugins/openclaw && npm audit) -> found 0 vulnerabilities
$ (cd docs && npm audit && bun audit) -> found 0 vulnerabilities / No vulnerabilities found
```
## Real Behavior Proof
- Environment: macOS (darwin 25.4.0, arm64), Python 3.12 `.venv`, Rust
1.95 toolchain, syft 1.46.0, grype 0.115.0, bun 1.3.14, maturin 1.13.3.
- Exact command / steps: (1) `uv export --extra all --no-dev
--no-emit-project | syft → grype` for the product surface; (2) `cargo
check --workspace` + `maturin develop` + extension import/compress smoke
test; (3) `cargo test -p headroom-proxy --lib drift`; (4) `cargo fmt
--check` + `cargo clippy -p headroom-py`; (5) `npm audit` in
sdk/openclaw/docs + `bun audit` in docs.
- Observed result: `headroom-ai[all]` resolution scans clean — "No
vulnerabilities found" (179 pkgs); full/prod SBOM shows only the 2
documented accepted CVEs; pyo3 0.29 extension imports and runs (detach +
from_py_object paths exercised); drift tests 14/14 pass; cargo fmt +
clippy clean; all npm/bun audits report 0.
- Not tested: full `pytest` suite (no Python source changed);
release-profile wheel build (used dev-profile `maturin develop` for the
import proof — the extension is semantically identical).
## Review Readiness
- [x] I have performed a self-review
- [x] This PR is ready for human review
## Checklist
- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have made corresponding changes to the documentation
(`sbom/README.md`)
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective — N/A
(dependency bumps; existing suites + scans cover it)
- [x] New and existing unit tests pass locally with my changes
- [ ] I have updated the CHANGELOG.md — N/A (Release Please
auto-generates from the conventional commit)
## Additional Notes
**Accepted risks (the 2 residual CVEs).** Both originate solely from the
EleutherAI `lm-evaluation-harness` under the **opt-in `[benchmark]`
extra**, which Headroom invokes as a subprocess (never imports):
- `sqlitedict` CVE-2024-35515 (High) — pickle deserialization; package
abandoned (last release 2021), **no upstream fix exists**.
- `nltk` CVE-2026-54293 (High) — path traversal in `nltk.data.load()`;
affects ≤3.9.4 (current latest), **no patched release**.
Neither is in `[all]`, the published wheel, or the container. They are
documented in `sbom/README.md` and will be picked up automatically once
upstream ships fixes.
**Release/CHANGELOG:** N/A items above are because this is a
dependency/security PR with no Python source changes; CHANGELOG is
Release-Please-managed via the conventional commit message.
2026-06-27 15:28:12 -07:00
github-actions[bot]
95b2333ee5
chore: release main ( #1274 )
...
🤖 I have created a release *beep* *boop*
---
<details><summary>0.27.0</summary>
##
[0.27.0](https://github.com/chopratejas/headroom/compare/v0.26.0...v0.27.0 )
(2026-06-22)
### Features
* **cli:** add headroom doctor setup diagnostics
([#926 ](https://github.com/chopratejas/headroom/issues/926 ))
([e45cf4ee45cf4e061#1088 ](https://github.com/chopratejas/headroom/issues/1088 ))
([26be2c326be2c39cb#818 ](https://github.com/chopratejas/headroom/issues/818 ))
([b7be381b7be3814f1#983 ](https://github.com/chopratejas/headroom/issues/983 ))
([0d89c670d89c674cd#965 ](https://github.com/chopratejas/headroom/issues/965 ))
([a99dc61a99dc61424#856 ](https://github.com/chopratejas/headroom/issues/856 ) P3b)
([#1028 ](https://github.com/chopratejas/headroom/issues/1028 ))
([fe4f9eefe4f9ee478#1190 ](https://github.com/chopratejas/headroom/issues/1190 ))
([d9d0bf4d9d0bf4b79#1030 ](https://github.com/chopratejas/headroom/issues/1030 ))
([e8fc8a0e8fc8a0d18#1090 ](https://github.com/chopratejas/headroom/issues/1090 ))
([6904d476904d47a01#946 ](https://github.com/chopratejas/headroom/issues/946 ))
([#991 ](https://github.com/chopratejas/headroom/issues/991 ))
([addebdbaddebdb29c#1128 ](https://github.com/chopratejas/headroom/issues/1128 ))
([d789a7cd789a7c528#1113 ](https://github.com/chopratejas/headroom/issues/1113 ))
([0e059150e0591506c#1095 ](https://github.com/chopratejas/headroom/issues/1095 ))
([#1141 ](https://github.com/chopratejas/headroom/issues/1141 ))
([9f7f3ad9f7f3adfea#1213 ](https://github.com/chopratejas/headroom/issues/1213 ))
([#1236 ](https://github.com/chopratejas/headroom/issues/1236 ))
([08fb84508fb845fe3#1108 ](https://github.com/chopratejas/headroom/issues/1108 ))
([8894ee08894ee0c18#1064 ](https://github.com/chopratejas/headroom/issues/1064 ))
([5eae32b5eae32ba47#956 ](https://github.com/chopratejas/headroom/issues/956 ))
([#993 ](https://github.com/chopratejas/headroom/issues/993 ))
([b2f04e4b2f04e4ef7#1240 ](https://github.com/chopratejas/headroom/issues/1240 ))
([#1254 ](https://github.com/chopratejas/headroom/issues/1254 ))
([bc12acebc12acef59#746 ](https://github.com/chopratejas/headroom/issues/746 ))
([#995 ](https://github.com/chopratejas/headroom/issues/995 ))
([500ec2b500ec2b7fa#1161 ](https://github.com/chopratejas/headroom/issues/1161 ))
([3fc2a783fc2a78a5e#1092 ](https://github.com/chopratejas/headroom/issues/1092 ))
([#1262 ](https://github.com/chopratejas/headroom/issues/1262 ))
([4f9feda4f9fedaa7a#1218 ](https://github.com/chopratejas/headroom/issues/1218 ))
([2e6c4422e6c442dc8#1038 ](https://github.com/chopratejas/headroom/issues/1038 ))
([#1137 ](https://github.com/chopratejas/headroom/issues/1137 ))
([bcabc5cbcabc5cb11#1265 ](https://github.com/chopratejas/headroom/issues/1265 ))
([b5f63d8b5f63d8fa9#940 ](https://github.com/chopratejas/headroom/issues/940 ))
([#1053 ](https://github.com/chopratejas/headroom/issues/1053 ))
([f03e77bf03e77bec0#1222 ](https://github.com/chopratejas/headroom/issues/1222 ))
([1f18d591f18d59809#1215 ](https://github.com/chopratejas/headroom/issues/1215 ))
([381d771381d771e46#1226 ](https://github.com/chopratejas/headroom/issues/1226 ))
([bd55a42bd55a426bc#1036 ](https://github.com/chopratejas/headroom/issues/1036 ))
([b0cd032b0cd0329c7#998 ](https://github.com/chopratejas/headroom/issues/998 ))
([#1031 ](https://github.com/chopratejas/headroom/issues/1031 ))
([c987283c98728363a#1223 ](https://github.com/chopratejas/headroom/issues/1223 ))
([b998697b99869778b#956 ](https://github.com/chopratejas/headroom/issues/956 ))
([#994 ](https://github.com/chopratejas/headroom/issues/994 ))
([7e86baf7e86bafb90#992 ](https://github.com/chopratejas/headroom/issues/992 ))
([5b846915b84691770#1240 ](https://github.com/chopratejas/headroom/issues/1240 ))
([7c26a547c26a54d53#1071 ](https://github.com/chopratejas/headroom/issues/1071 ))
([9f712cc9f712ccbd7#951 ](https://github.com/chopratejas/headroom/issues/951 ))
([#1078 ](https://github.com/chopratejas/headroom/issues/1078 ))
([a554c3aa554c3a0e6https://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-21 22:28:55 -07:00
github-actions[bot]
b81a4a7a16
chore: release main ( #931 )
...
🤖 I have created a release *beep* *boop*
---
<details><summary>0.26.0</summary>
##
[0.26.0](https://github.com/chopratejas/headroom/compare/v0.25.0...v0.26.0 )
(2026-06-16)
### Features
* add Copilot BYOK provider wrapper utilities and CLI support
([#1041 ](https://github.com/chopratejas/headroom/issues/1041 ))
([e67ee2ae67ee2af65#814 ](https://github.com/chopratejas/headroom/issues/814 ))
([6d3f39f6d3f39f213#935 ](https://github.com/chopratejas/headroom/issues/935 ))
([0932b8b0932b8bef4#901 ](https://github.com/chopratejas/headroom/issues/901 ))
([f928576f9285766dd#999 ](https://github.com/chopratejas/headroom/issues/999 ))
([0dc2e1c0dc2e1cb3f#913 ](https://github.com/chopratejas/headroom/issues/913 ))
([2a4d3002a4d300841#918 ](https://github.com/chopratejas/headroom/issues/918 ))
([59390045939004185#909 ](https://github.com/chopratejas/headroom/issues/909 ))
([7d4ae867d4ae86ec0#856 ](https://github.com/chopratejas/headroom/issues/856 ) P3a)
([#1015 ](https://github.com/chopratejas/headroom/issues/1015 ))
([c2e52fec2e52fe743#856 ](https://github.com/chopratejas/headroom/issues/856 ) P2)
([#905 ](https://github.com/chopratejas/headroom/issues/905 ))
([553ade4553ade4ec6#720 ](https://github.com/chopratejas/headroom/issues/720 ))
([7edb27a7edb27ab24#651 ](https://github.com/chopratejas/headroom/issues/651 ))
([0c5c89d0c5c89d05c#942 ](https://github.com/chopratejas/headroom/issues/942 ))
([#954 ](https://github.com/chopratejas/headroom/issues/954 ))
([a7ee8a6a7ee8a60a7#950 ](https://github.com/chopratejas/headroom/issues/950 ))
([1ec93201ec9320888#1018 ](https://github.com/chopratejas/headroom/issues/1018 ))
([3b0bcee3b0bceecf4#1021 ](https://github.com/chopratejas/headroom/issues/1021 ))
([4558bc24558bc2465#1047 ](https://github.com/chopratejas/headroom/issues/1047 ))
([74dff9474dff94fb8#898 ](https://github.com/chopratejas/headroom/issues/898 ))
([b9e2761b9e27614c6#924 ](https://github.com/chopratejas/headroom/issues/924 ))
([8c00f718c00f7103c#986 ](https://github.com/chopratejas/headroom/issues/986 ))
([99c874d99c874d423#1034 ](https://github.com/chopratejas/headroom/issues/1034 ))
([74ae78174ae781644#743 ](https://github.com/chopratejas/headroom/issues/743 ))
([dff6a19dff6a19946#892 ](https://github.com/chopratejas/headroom/issues/892 ))
([b1f700fb1f700fc27#887 ](https://github.com/chopratejas/headroom/issues/887 ))
([d6f0f0fd6f0f0f642#890 ](https://github.com/chopratejas/headroom/issues/890 ))
([16ed73b16ed73bca6#889 ](https://github.com/chopratejas/headroom/issues/889 ))
([65b0e8c65b0e8c58d#893 ](https://github.com/chopratejas/headroom/issues/893 ))
([6cdb8466cdb846200#897 ](https://github.com/chopratejas/headroom/issues/897 ))
([9b0c8409b0c840dd7#997 ](https://github.com/chopratejas/headroom/issues/997 ))
([#1027 ](https://github.com/chopratejas/headroom/issues/1027 ))
([2d3701b2d3701b59e#1045 ](https://github.com/chopratejas/headroom/issues/1045 ))
([0ddd4ed0ddd4ed9e9#947 ](https://github.com/chopratejas/headroom/issues/947 ))
([7c8c9097c8c909c85#903 ](https://github.com/chopratejas/headroom/issues/903 ))
([0632eba0632eba6c3#917 ](https://github.com/chopratejas/headroom/issues/917 ))
([b08ec15b08ec15b0d#1000 ](https://github.com/chopratejas/headroom/issues/1000 ))
([7dbbb407dbbb4077e#885 ](https://github.com/chopratejas/headroom/issues/885 ))
([a14ab45a14ab45cf0#957 ](https://github.com/chopratejas/headroom/issues/957 ))
([b70fccbb70fccbe17#821 ](https://github.com/chopratejas/headroom/issues/821 ))
([e20f16be20f16b1a6#1003 ](https://github.com/chopratejas/headroom/issues/1003 ))
([919379a919379a8a1#641 ](https://github.com/chopratejas/headroom/issues/641 ))
([0b4a4bd0b4a4bd483#943 ](https://github.com/chopratejas/headroom/issues/943 ))
([9b7b4369b7b436b04#884 ](https://github.com/chopratejas/headroom/issues/884 ))
([dd22cfddd22cfd72a#704 ](https://github.com/chopratejas/headroom/issues/704 ))
([e36fccde36fccd8cfhttps://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-16 15:35:00 -07:00
github-actions[bot]
8a53c8ec3b
chore: release main ( #891 )
...
🤖 I have created a release *beep* *boop*
---
<details><summary>0.25.0</summary>
##
[0.25.0](https://github.com/chopratejas/headroom/compare/v0.24.0...v0.25.0 )
(2026-06-12)
### Features
* add differential network capture harness
([#761 ](https://github.com/chopratejas/headroom/issues/761 ))
([11ab5f811ab5f83a1#834 ](https://github.com/chopratejas/headroom/issues/834 ))
([c425893c425893d12#778 ](https://github.com/chopratejas/headroom/issues/778 ))
([#784 ](https://github.com/chopratejas/headroom/issues/784 ))
([eb2e50feb2e50feb2#793 ](https://github.com/chopratejas/headroom/issues/793 ))
([3c77e523c77e52ce4#640 ](https://github.com/chopratejas/headroom/issues/640 ))
([028efab028efabb4e#851 ](https://github.com/chopratejas/headroom/issues/851 ))
([c0cadccc0cadccff9#807 ](https://github.com/chopratejas/headroom/issues/807 ))
([34dafe634dafe69d9#854 ](https://github.com/chopratejas/headroom/issues/854 ))
([5f1d88a5f1d88ad27#817 ](https://github.com/chopratejas/headroom/issues/817 ))
([53a08c653a08c63bf#859 ](https://github.com/chopratejas/headroom/issues/859 ))
([06b262506b2625b17#204 ](https://github.com/chopratejas/headroom/issues/204 ))
([6367d0b6367d0b722#766 ](https://github.com/chopratejas/headroom/issues/766 ))
([c71592dc71592d421#856 ](https://github.com/chopratejas/headroom/issues/856 ) P1)
([#857 ](https://github.com/chopratejas/headroom/issues/857 ))
([d5f5802d5f58026e2#824 ](https://github.com/chopratejas/headroom/issues/824 ))
([058bced058bcedab8#862 ](https://github.com/chopratejas/headroom/issues/862 ))
([c2106cbc2106cbdab#823 ](https://github.com/chopratejas/headroom/issues/823 ))
([693d9d2693d9d20e2#791 ](https://github.com/chopratejas/headroom/issues/791 ))
([0b8b8d90b8b8d92de#261 ](https://github.com/chopratejas/headroom/issues/261 ))
([2269e402269e40bde#803 ](https://github.com/chopratejas/headroom/issues/803 ))
([914a60a914a60a2b0#516 ](https://github.com/chopratejas/headroom/issues/516 ))
([19eac8e19eac8e00d#799 ](https://github.com/chopratejas/headroom/issues/799 ))
([74392b274392b238e#249 ](https://github.com/chopratejas/headroom/issues/249 ))
([8f374268f374263d3#838 ](https://github.com/chopratejas/headroom/issues/838 ))
([8db5efc8db5efc6f9#852 ](https://github.com/chopratejas/headroom/issues/852 ))
([bfcb07dbfcb07d78e#715 ](https://github.com/chopratejas/headroom/issues/715 ))
([2533f772533f7703e#839 ](https://github.com/chopratejas/headroom/issues/839 ))
([30078f830078f8465#875 ](https://github.com/chopratejas/headroom/issues/875 ))
([249af6c249af6cc7b#878 ](https://github.com/chopratejas/headroom/issues/878 ))
([b716c8cb716c8c2ee#774 ](https://github.com/chopratejas/headroom/issues/774 ))
([199d693199d693f98#731 ](https://github.com/chopratejas/headroom/issues/731 ))
([96abf3896abf38b09#771 ](https://github.com/chopratejas/headroom/issues/771 ))
([2f9ff072f9ff07e6c#647 ](https://github.com/chopratejas/headroom/issues/647 ))
([84ac33284ac332d14#836 ](https://github.com/chopratejas/headroom/issues/836 ))
([0ffe2b60ffe2b6ea4#481 ](https://github.com/chopratejas/headroom/issues/481 ))
([fd73b88fd73b88368#772 ](https://github.com/chopratejas/headroom/issues/772 ))
([574bbae574bbae2cb#557 ](https://github.com/chopratejas/headroom/issues/557 ))
([6b0c09f6b0c09ffd5#744 ](https://github.com/chopratejas/headroom/issues/744 ))
([5dfb4465dfb446da1#616 ](https://github.com/chopratejas/headroom/issues/616 ))
([9252d859252d852c5#788 ](https://github.com/chopratejas/headroom/issues/788 ))
([6ea6e316ea6e31f09#760 ](https://github.com/chopratejas/headroom/issues/760 ))
([b439599b4395993ae#373 ](https://github.com/chopratejas/headroom/issues/373 ))
([9bff5759bff5752bb#581 ](https://github.com/chopratejas/headroom/issues/581 ))
([163677b163677b405#815 ](https://github.com/chopratejas/headroom/issues/815 ))
([929698a929698af10d10bd5fd10bd5f59c#442 ](https://github.com/chopratejas/headroom/issues/442 ))
([93c693793c69372e6#770 ](https://github.com/chopratejas/headroom/issues/770 ))
([d76a729d76a7296df#783 ](https://github.com/chopratejas/headroom/issues/783 ))
([841663d841663da16#577 ](https://github.com/chopratejas/headroom/issues/577 ))
([#794 ](https://github.com/chopratejas/headroom/issues/794 ))
([0ce68de0ce68dedd7#785 ](https://github.com/chopratejas/headroom/issues/785 ))
([ae2122fae2122fda8#605 ](https://github.com/chopratejas/headroom/issues/605 ))
([b4b5025b4b50253f1#745 ](https://github.com/chopratejas/headroom/issues/745 ))
([e50fbb3e50fbb3e0d#874 ](https://github.com/chopratejas/headroom/issues/874 ))
([f9384eff9384ef4b7#604 ](https://github.com/chopratejas/headroom/issues/604 ))
([2ad300a2ad300aff8#877 ](https://github.com/chopratejas/headroom/issues/877 ))
([05bd56b05bd56bcb6ec7d006ec7d0065cchttps://github.com/googleapis/release-please ). See
[documentation](https://github.com/googleapis/release-please#release-please ).
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-11 22:18:46 -08:00
github-actions[bot]
01762b1ec7
chore: release main ( #607 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-08 11:21:23 -07:00
github-actions[bot]
f7c2552264
chore: release main
2026-06-04 14:05:56 +00:00
github-actions[bot]
cc71e07d01
chore: release main
2026-05-26 03:54:25 +00:00
chopratejas
8e4ab187e9
ci(release): align manifest + pyproject + package.json to 0.22.3
...
The repo had drifted: pyproject.toml said 0.9.1 but PyPI's latest
published headroom-ai was 0.22.3. release_version.py papered over
this by taking max(canonical, latest_tag) at release time;
release-please does NOT do that — it trusts the manifest verbatim.
Left as-is, release-please would propose 0.9.2 on the next merge
and PyPI would reject it ("400 Cannot publish version lower than
latest"), looping the bot forever.
Fix: align every version-bearing file to 0.22.3 (the truth on
PyPI). Done via `scripts/version-sync.py --version 0.22.3`:
- .release-please-manifest.json
- pyproject.toml
- sdk/typescript/package.json
- plugins/openclaw/package.json (+ headroom-ai dep range -> ^0.22.3)
- .claude-plugin/marketplace.json
- .github/plugin/marketplace.json
- plugins/headroom-agent-hooks/.claude-plugin/plugin.json
- plugins/headroom-agent-hooks/.github/plugin/plugin.json
After this lands, the bot's next release PR will propose 0.22.4
(patch) or 0.23.0 (minor) depending on conventional-commit traffic
since v0.22.3.
2026-05-25 18:41:38 -07:00
dependabot[bot]
2f659535d2
chore(deps): bump the npm_and_yarn group across 3 directories with 4 updates
...
Bumps the npm_and_yarn group with 1 update in the /sdk/typescript directory: [esbuild](https://github.com/evanw/esbuild ).
Bumps the npm_and_yarn group with 1 update in the /plugins/openclaw directory: [esbuild](https://github.com/evanw/esbuild ).
Bumps the npm_and_yarn group with 2 updates in the /docs directory: [postcss](https://github.com/postcss/postcss ) and [next](https://github.com/vercel/next.js ).
Updates `esbuild` from 0.21.5 to 0.27.4
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.21.5...v0.27.4 )
Updates `postcss` from 8.5.8 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.10 )
Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite )
Updates `esbuild` from 0.21.5 to 0.27.4
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.21.5...v0.27.4 )
Updates `postcss` from 8.5.8 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.10 )
Updates `vite` from 5.4.21 to 8.0.10
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.10/packages/vite )
Updates `postcss` from 8.5.8 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.8...8.5.10 )
Updates `next` from 16.2.2 to 16.2.4
- [Release notes](https://github.com/vercel/next.js/releases )
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js )
- [Commits](https://github.com/vercel/next.js/compare/v16.2.2...v16.2.4 )
---
updated-dependencies:
- dependency-name: esbuild
dependency-version: 0.27.4
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 8.0.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: esbuild
dependency-version: 0.27.4
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 8.0.10
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.10
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: next
dependency-version: 16.2.4
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-24 22:15:53 +00:00
JerrettDavis
91c5835852
chore: bump openclaw plugin version
2026-04-15 19:09:29 -05:00
JerrettDavis
6e69c4ef2c
Add OpenClaw hook shim for local link installs
2026-04-06 21:28:59 -05:00
JerrettDavis
95f7a0b74e
Fix OpenClaw dist plugin installs
2026-04-06 21:21:23 -05:00
JerrettDavis
89f3e5f01f
fix(openclaw): proxyPort only applies to local URLs, consistency pass
...
- proxyPort default (8787) now only applied to local URLs; remote URLs
use their protocol default (80/443) as expected
- Remove redundant localhost-only entries from network capabilities
(covered by http://*:* and https://*:* wildcards)
- Sync package.json capabilities with openclaw.plugin.json
- Export isLocalProxyUrl from barrel index
- Fix JSDoc indentation in start() method
- Rename "Required Proxy Setup" to "Manual Proxy Setup" with accurate
description for remote proxy users
- Clarify autoStart description: local-only, ignored for remote
- Add test: remote URL does not get proxyPort applied
Build: tsc clean, 30 tests passed
2026-04-03 10:30:10 -05:00
JerrettDavis
777ffeb716
Add controlled proxy autostart and unsafe-install guidance
2026-04-02 21:47:27 -05:00
JerrettDavis
205ec54df2
Harden openclaw plugin proxy handling and metadata
2026-04-02 21:27:12 -05:00
chopratejas
a1cd1c16dc
Rename plugin to headroom-openclaw (npm scope not available)
2026-03-28 23:55:39 -07:00
chopratejas
a41c7f0c89
OpenClaw plugin fixes, telemetry fix, cost tracker improvement, tokenBudget support
...
OpenClaw plugin:
- Fix assistant content always returned as array (fixes flatMap crash)
- Clean up debug logging, restore clean plugin entry point
- Add test for text-only assistant round-trip
- Set headroom-ai dependency to npm (not local path)
Telemetry:
- Switch from sb_publishable_ to JWT anon key (PostgREST needs JWT for RLS)
- Switch from upsert to plain INSERT (anon role upsert was failing with 42501)
- Verified: full payload with all JSONB columns writes successfully (201)
Cost tracker:
- Use output_buffer instead of hardcoded 500 for cost estimation in client.py
- CostTracker counterfactual: value removed tokens at avg effective $/token
(actual_spend / billed_tokens) instead of uncached list price — aligns
savings with real billing mix (cache reads, writes, uncached)
- Add debug log for /stats summary payload
- Add 3 tests for new cost savings calculation
TypeScript SDK:
- Add tokenBudget param to compress(), HeadroomClient, CompressOptions
- Proxy /v1/compress accepts optional token_budget to override model limit
2026-03-28 23:46:03 -07:00
chopratejas
053c4a06af
feat: add OpenClaw ContextEngine plugin (@headroom-ai/openclaw)
...
- HeadroomContextEngine: implements ContextEngine interface (bootstrap, ingest,
assemble, compact, afterTurn, prepareSubagentSpawn, dispose)
- ProxyManager: auto-detects running proxy or spawns one as child process,
health checks, restart on crash, graceful shutdown
- AgentMessage ↔ OpenAI format conversion (user, assistant/tool_use, toolResult)
- headroom_retrieve CCR tool: agent can retrieve original uncompressed content
- Plugin manifest (openclaw.plugin.json) with config schema
- 11 tests (6 unit + 5 integration), all passing
- Integration tested: 100 servers compressed, 3,735 tokens saved (82%)
2026-03-28 13:43:40 -07:00
github-actions[bot]