RightNow-AI/openfang v0.6.8

on GitHub

Fixes:

• #1097 workspace state_dir split — private state stays under ~/.openfang/, user workspace untouched
• #1085 dashboard WS auth aligned with HTTP middleware
• #1038 skill_list / skill_describe / skill_execute agent tools (replaces filesystem fallback)
• #1170 require_signed wired through POST /api/skills/install with allowed_signer_keys allow-list
• #1174 POST /api/audit/append endpoint for instance-side wrapper audit integration
• #1172 HAND.toml SHA-256 auto-logged to Merkle audit chain on every load
• #780 Telegram message_thread_id routing per-topic to named agents
• Codex audit findings on installer.rs binding check closed:
  • CRLF and UTF-8 BOM normalization on both sides of compare
  • package.json added to manifest candidate list
  • symlink and canonicalization escape protection
  • TOCTOU closed via private staging dir plus atomic rename

Providers:

• #995 Requesty added (https://router.requesty.ai/v1) with 5 catalog entries
• #1154 OLLAMA_HOST / LMSTUDIO_HOST / VLLM_HOST / LEMONADE_HOST env override for local providers

PR dispositions:

• closed: #1185, #1166, #1162, #1055, #1044, #1039, #969
• held pending external rebase: #1151, #997, #1093, #946 (all reviewed clean)
• author rework requested: #943 (IDOR on session endpoints)

Tests: 2696+ across 14 crates, 0 clippy warnings.