From 7b7e7bccfb8712e2c9037c20e7005c6c6a56e32e Mon Sep 17 00:00:00 2001 From: Jason Robert Date: Thu, 13 Aug 2026 13:16:31 -0400 Subject: [PATCH] chore(release): cut 0.1.29 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 35 ++++++++++++++++++++++++++++++++++- pyproject.toml | 2 +- uv.lock | 2 +- 3 files changed, 36 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 589e17dd..de2cf70d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,9 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [Unreleased](https://github.com/microsoft/conductor/compare/v0.1.28...HEAD) +## [Unreleased](https://github.com/microsoft/conductor/compare/v0.1.29...HEAD) + +## [0.1.29](https://github.com/microsoft/conductor/compare/v0.1.28...v0.1.29) - 2026-08-13 ### Security @@ -31,9 +33,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 token. Read-only routes (`/api/state`, `/api/info`, `/api/logs`, `/api/gate-status`, `/api/files/*`, and the replay dashboard) remain unauthenticated, protected by Origin/Host only. +- **Hardened the ACA agent runner's transport surface** (#396). The + experimental `aca` provider's in-container runner previously relied + entirely on the Azure session-gateway network boundary; it now adds four + independent layers, none individually load-bearing. The runner binds + `127.0.0.1` by default (the shipped container image sets + `ACA_RUNNER_HOST=0.0.0.0` explicitly, so a deployed pool is unaffected — + only a runner started by hand changes behaviour). An opt-in transport + token, `ACA_RUNNER_AUTH_TOKEN`, makes `/execute` require a matching + `X-Conductor-Runner-Token` header — checked before the inner Copilot + provider is constructed — and `401` otherwise; the host sends the header + automatically when the same value is set on its side. `GET /health` stays + unauthenticated (the image's own `HEALTHCHECK` sends no header) but now + reports `auth_required` and `auth_token_present`, letting the host warn + when a gateway is silently stripping the header or when only one side has + a token configured. The runner also rejects any `inner_provider_settings` + key outside `base_url` / `api_key` / `bearer_token` / `github_token`, + closing off `runtime_url` and `headers` injection, and + `ACA_RUNNER_ALLOWED_BASE_URLS` optionally restricts which BYOK `base_url` + values are accepted. See `docs/providers/aca.md#security`. ### Fixed +- **A pathological gate or dialog prompt no longer stalls the event loop** + (#395). `linkify_markdown` — which runs on human-gate prompts, dialog + turns, and rendered agent prompts — degraded to quadratic time on inputs + containing long unterminated runs of backticks/tildes or `[` characters, + so agent-generated text could freeze every concurrent agent sharing the + loop. The fenced-code opener no longer backtracks character-by-character, + and existing-markdown-link detection is now a linear single-pass scanner + (fuzz-verified equivalent to the regex it replaces). A defensive 256K + character cap skips linkification entirely on anything larger — whitespace + is still normalized — so a future pathological shape degrades gracefully + rather than hanging. + - **Token cost is no longer massively overstated for cached, tool-calling agents.** `AgentOutput.input_tokens` is the *whole* prompt and already contains `cache_read_tokens` / `cache_write_tokens`, but `calculate_cost` diff --git a/pyproject.toml b/pyproject.toml index 37d187d2..d51a4f2f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "conductor-cli" -version = "0.1.28" +version = "0.1.29" description = "A CLI tool for defining and running multi-agent workflows with the GitHub Copilot SDK" readme = "README.md" requires-python = ">=3.12" diff --git a/uv.lock b/uv.lock index 50f447d2..22594eab 100644 --- a/uv.lock +++ b/uv.lock @@ -464,7 +464,7 @@ wheels = [ [[package]] name = "conductor-cli" -version = "0.1.28" +version = "0.1.29" source = { editable = "." } dependencies = [ { name = "anthropic" },