openab-0.10.0-beta.1

OpenAB 0.10.0-beta.1

Beta release: please validate in a non-production environment before upgrading critical workloads.

Highlights

Kimi Code CLI backend

• Added Kimi Code CLI as a first-class ACP backend, available in both standalone and unified images. It uses Kimi's native kimi acp adapter, supports interactive authentication with kimi login, and is registered in Helm examples, image builds, smoke tests, and documentation. #1429
• Fixed the package-image Kimi target so pre-beta Kimi images build and publish correctly. #1432

Updated bundled coding CLIs

• Kiro CLI: 2.8.1 → 2.13.0

• Codex ACP: 1.1.2 → 1.1.4

• GitHub Copilot CLI: 1.0.63 → 1.0.71

• Devin CLI: 2026.8.18 → 3000.2.17

• Google Antigravity CLI: 1.1.1 → 1.1.4

  These images now include stronger cross-image pin checks, post-install version smoke tests, and verified release artifacts where available. #1427

• Grok CLI: 0.1.220 → 0.2.106, with refreshed AMD64 and ARM64 SHA256 checksums. #1430

Installation

Helm repository

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.10.0-beta.1

OCI registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.10.0-beta.1

Full changelog

openab-0.9.0...openab-0.10.0-beta.1

oabctl pre-beta (6859733)

Rolling pre-beta build of oabctl from main@6859733. Overwritten on every pre-beta build — not a stable version, matches the pre-beta-* image tags. For a pinned version, use the openab-<version> release attached to a real openab release instead.

openab-0.9.0

A lightweight, secure, cloud-native ACP harness that bridges Discord, Slack, and webhook platforms to any ACP-compatible coding CLI.

openab 0.9.0 rolls up 12 beta releases (~150 merged PRs) since openab-0.8.5.

✨ Highlights

• Cargo workspace + unified binary — restructured into openab-core / openab-gateway crates with an opt-in unified build that embeds all gateway adapters (Telegram, LINE, Feishu/Lark, Google Chat, WeCom, Teams) in one binary (#1146, #1171, #1173)
• Identity trust framework (trust-none default) — a shared trust gate now guards ingress on every platform, with L3 identity phases for Discord, Slack, and the gateway (#1264, #1266, #1267, #1270, #1273, #1363, #1391)
• First-class platform config sections — [telegram], [line], [wecom], [googlechat], [teams], [feishu] are now fully config-first (credentials + connection), with a CI conformance guard (#1265, #1381–#1385, #1387)
• oabctl operator for AWS ECS — provision and manage OpenAB agents on ECS Fargate, including Telegram/LINE webhook ingress (API Gateway + VPC Link + Cloud Map), scheduling, and scale commands (#1275, #1285, #1296, #1308, #1321, #1336, #1404)
• Ambient mode — batch-flush dispatcher that observes configured channels/threads and lets the agent respond ambiently without @mentions (#1211, #1217, #1220, #1221, #1222)
• New agent backends & auth — Devin CLI support (#1229), Anthropic OAuth (Claude Pro/Max) for openab-agent (#1187), xAI SuperGrok / X Premium device-code OAuth (#1424), multi-vendor OAuth ADR + cross-process auth.json locking (#1190)
• S3/R2 file store — object-store-backed file attachments with streaming multipart upload (#1348, #1351)
• pre_seed lifecycle phase — S3 zip/tar.gz download before pre_boot, enabled by default, with security hardening (#1189, #1196, #1197, #1199)

⚠️ Breaking Changes

• Codex ACP adapter migrated (#1353) — feat(codex)!: the runtime moves off @zed-industries/codex-acp (which pinned Codex core 0.137.0) to the actively maintained adapter, fixing newer-model failures like gpt-5.6-sol; existing OpenAB mode settings are preserved across upstream mode-ID changes. Review docs/codex.md before upgrading Codex deployments.
• Standalone gateway WS path routed through the shared trust gate (#1391) — feat(gateway)!: with the new trust-none default, gateway ingress that previously passed implicitly may now be denied until trust is configured. See the identity trust ADR (#1264, #1291).
• Helm TOML rendering removed (#1277) — the chart no longer renders config.toml from values; use configToml pass-through (#1276) or configUrl instead (ADR #1271).

🚀 Features

Platforms

• Slack: [slack].streaming toggle for send-once mode (#1115)
• Discord: /auth slash command for device-flow auth (#1185), /usage command backed by kiro-cli ACP usage query (#1392), image attachment URL passthrough to agent prompt (#1208)
• Telegram: allow_all_users/allowed_users (#1297), native table rendering (#1313), webhook source-IP logging (#1248), cron support (#1315)
• Google Chat: scheduled-message (cron) support (#1374)
• Gateway: warn when webhook L1 auth is unenforceable (#1373), echo-on-deny (#1273)

Config & Ops

• s3:// config source via -c (#1183)
• default_config_options for auto-setting agent mode/model (#1307)
• Helm: configToml pass-through (#1276), unified image tag format openab:<tag>-<agent> (#1179)
• Force-evict hung sessions so zombie slots cannot exhaust the pool (#1300)

🐛 Bug Fixes

• Surface error on agent EOF without a final response (#1198); diagnostic on empty 0-token end_turn (#1213)
• Slack: bound reconnect-path and socket-write calls with timeouts (#1334); collapse duplicate tool lines in Full display (#1397)
• Discord: truncate select-menu options to the 100-char cap (#1398); clickable URLs in /auth output (#1232, #1240)
• Telegram: thinking-indicator cleanup — emoji reactions only (#1238, #1247, #1249, #1256)
• LINE: no duplicate messages when streaming (#1292)
• agy-acp: surface swallowed backend errors (quota 429) instead of "(no response)" (#1320)
• agentcore bridge: integer protocolVersion per latest ACP spec (#1323)
• pre_seed: safe relative symlinks; lifecycle hooks Unix-only (#1255)
• ANSI escape stripping in /auth output (#1206); ctl thread resolution for single-adapter bots (#1216)
• oabctl: task/execution role wiring (#1280), stage-prefix stripping on private API GW (#1283), ECS-native secret :jsonKey:: suffix (#1288), service drain on delete (#1305), execute-command always on (#1314), cluster resolution from bootstrap state (#1324), scale restricted to oabctl-managed services (#1327)

🏗️ Build, CI & Security

• Runtime base upgraded to Debian Trixie (#1251); Rust builder image pinned by digest (#1246)
• Unified image repo with shared builder and tag-based variants (#1175); one build per arch with packaging fan-out (#1242); stage aliasing to skip Rust recompilation (#1227)
• CI hardening: no expression/script injection in workflows (#1393, #1395), third-party actions pinned to commit SHA (#1396)
• Windows build kept green with cfg(unix) gating (#1231)
• CLI version bumps: kiro 2.8.1, codex 0.141.0 + codex-acp 0.16.0, claude 2.1.179, gemini 0.47.0, copilot 1.0.63, cursor 2026.06.19, opencode 1.17.9, antigravity 1.1.1, pi 0.79.9, hermes v2026.6.19 (#1168, #1371, #1419)

📖 Docs

• Traditional Chinese README (#1347)
• Tailscale integration guide (#1299)
• Reference architectures: Telegram/LINE bots on AWS (#1274), GitHub App token vending machine (#1341), Kiro defined agents (#1403)
• Canary testing guide + fork-PR preview workflow (#1369); frozen Review Contract policy (#1422)
• Schema-driven platform facts knowledge base with CI conformance (#1295)

Full Changelog: openab-0.8.5...openab-0.9.0

Version Info

• Chart Version: 0.9.0
• App Version: 0.9.0

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0

openab-0.9.0-beta.12

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

Version Info

• Chart Version: 0.9.0-beta.12
• App Version: 0.9.0-beta.12

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.12

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.12

openab-0.9.0-beta.11

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed since 0.9.0-beta.10

🐛 Bug Fixes

• claude: default agent command is now claude-agent-acp (bare claude is the interactive REPL and broke ACP login), plus version bumps, auth docs, and CI coverage (#1419)
• slack: consecutive duplicate tool lines in ToolDisplay::Full now collapse into a single line with an (×N) suffix — order- and state-preserving (#1397)

🏗️ Refactoring

• oabctl: operator split into a reusable library crate plus a thin CLI binary — downstream control planes can now call typed manifest validation and ECS apply reconciliation in-process (#1404)

📖 Documentation

• Kiro defined-agents reference architecture (#1403)
• Microsoft Teams enterprise guide: Unified Mode section (#1408)
• AWESOME.md: openab-dashboard (#1406)

🔧 Repo CI (contributor-facing)

• /review comment command for targeted PR review (#1412, #1413)
• ⚠️ Stale issue lifecycle: open issues with no linked PR for 14+ days are now automatically commented on and closed as not planned (#1414, #1417). Reopened issues are permanently exempt; manual dispatch defaults to dry-run.

Full Changelog: openab-0.9.0-beta.10...openab-0.9.0-beta.11

Version Info

• Chart Version: 0.9.0-beta.11
• App Version: 0.9.0-beta.11

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.11

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.11

openab-0.9.0-beta.10

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed (since openab-0.9.0-beta.9)

⚠️ Breaking Changes

• gateway: standalone WS path now routes through the shared trust gate — existing standalone gateway deployments must ensure their trust config passes the gate (#1391)
• codex: migrate to @agentclientprotocol/codex-acp v1.1.2 adapter — old codex command removed from image (#1353)

🚀 Features

• discord: /usage slash command — reports Kiro account billing (credits, overage, plan, cycle reset) via ACP extension (#1392)
• discord: truncate select menu option text to Discord's 100-char limit instead of crashing (#1398)
• cron: support Google Chat platform for scheduled messages (#1374)
• gateway: warn when webhook L1 auth is unenforceable (#1373)
• trust: first-class trust sections for Slack, LINE, WeCom, Google Chat, and Teams (Phase 1) (#1363, #1365, #1366)
• config-first: full per-platform config sections for LINE (#1381), WeCom (#1382), Google Chat (#1383), Teams (#1384), Feishu (#1385) — all credentials and connection settings now live in config.toml

🐛 Bug Fixes

• googlechat: enable config-only startup without gateway (#1390)
• wecom: enable config-only unified startup without gateway (#1389)

🔒 Security

• ci: pin all third-party actions to commit SHA (#1396)
• ci: eliminate script injection in pending-decision.yml (#1395)
• ci: harden release-pr workflow against expression injection (#1393)

📖 Documentation

• ADR: first-class per-platform configuration (#1263)
• ADR: revise identity-trust-none — three-layer architecture (#1291)
• Platform facts: schema-driven knowledge base with CI conformance (#1295)
• Platform quirks: WeCom DM-only L2, ISV id formats, is_bot no-op (#1386)
• Canary testing guide + fork-PR preview workflow (#1369)
• README: refresh architecture diagram and platform list (#1370)

🏗️ Infrastructure

• build: bump agy CLI 1.0.10 → 1.1.1 (#1371)
• test: gateway config-first conformance guard (#1387)

Full Changelog: openab-0.9.0-beta.9...openab-0.9.0-beta.10

Version Info

• Chart Version: 0.9.0-beta.10
• App Version: 0.9.0-beta.10

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.10

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.10

openab-0.9.0-beta.9

A lightweight, secure, cloud-native ACP harness that bridges Discord and any ACP-compatible coding CLI.

What's Changed (since openab-0.9.0-beta.8)

🚀 Features

• filestore: S3/R2 object store for file attachments with streaming multipart upload (#1348), with hardening and cleanup follow-ups (#1351)
• oabctl: add scale command with EventBridge Scheduler support (#1321); --with-schedule moved to an independent schedule create subcommand (#1336)
• oabctl: support per-service taskRoleArn in manifest (#1316)
• telegram: auto-disable table code-block wrapping for native table rendering (#1313)
• cron: support Telegram platform for cronjobs (#1315)

🐛 Bug Fixes

• acp: use integer protocolVersion per latest ACP spec (#1323)
• agy-acp: surface swallowed backend errors (e.g. quota 429) instead of "(no response)" (#1320)
• oabctl: always enable execute command on ECS services (#1314)
• oabctl: resolve cluster from bootstrap state instead of hardcoding (#1324)
• oabctl: restrict scale to oabctl-managed services only (#1327)
• oabctl: get-config --cluster support and help-text alignment (#1312)
• slack: bound reconnect-path and socket-write network calls with timeouts (#1334)

📖 Documentation

• Reference architecture: running Telegram/LINE bots on AWS (#1274)
• Reference architecture: GitHub App token vending machine (#1341)
• AWS Secrets Manager path for GitHub token setup (#1333)
• AWESOME.md with openab-control-plane (#1342)
• Traditional Chinese README (#1347)

🏗️ Infrastructure

• ci: mention PR/issue author when adding closing-soon label (#1325)
• ci: fix closing-soon comment wording — say "add a new comment", not "push a commit" (#1326)
• ci: accept discordapp.com URLs in PR discussion check (#1345)

Full Changelog: openab-0.9.0-beta.8...openab-0.9.0-beta.9

Version Info

• Chart Version: 0.9.0-beta.9
• App Version: 0.9.0-beta.9

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.9

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.9

openab-0.9.0-beta.8

What's Changed (since 0.9.0-beta.7)

Features

• feat(pool): add default_config_options for auto-setting mode/model after session creation (#1307)
  • New [pool] default_config_options = { mode = "bypass", model = "swe-1-6" } config
  • Sends session/set_config_option after each session/new
  • Enables headless Devin deployments to auto-switch to bypass mode
• feat(telegram): add allow_all_users/allowed_users to [telegram] config (#1297)
• feat(oabctl): add architecture field for ARM64/X86_64 task scheduling (#1308)
• feat(operator): support oabctl delete -f <manifest> (#1296)

Fixes

• fix(pool): force-evict hung sessions so zombie slots cannot exhaust the pool (#1300)
• fix(oabctl): wait for service drain on delete, retry on create (#1305)
• fix(line): don't post duplicate messages when streaming to LINE (#1292)
• fix(ci): pr-preview agent variants use unified Dockerfile with correct tag (#1309)
• fix(operator): resolve_string mishandled ECS-native :jsonKey:: suffix (#1288)

Docs & CI

• docs(devin): recommend default_config_options for mode and model (#1310)
• docs(devin): add recommended permission config for headless deployments (#1298)
• docs(tailscale): add integration guide (#1299)
• docs(adr): identity trust-none default & trust pyramid (#1264)
• docs: move oabctl usage guide to docs/oabctl.md (#1289)
• ci(line): add LINE PR review check workflow (#1304)
• ci: add kiro and unified variants to PR Preview Build (#1301, #1302)
• ci: comment when stale-contributor.yml applies closing-soon (#1290)

---

Version Info

• Chart Version: 0.9.0-beta.8
• App Version: 0.9.0-beta.8

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.8

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.8

openab-0.9.0-beta.7

What's Changed (since 0.9.0-beta.6)

⚠️ Breaking Changes

• feat(chart)!: remove Helm-rendered config path, require configToml or configUrl (#1277)

Features

• feat(telegram): first-class [telegram] config section (#1265)
• feat(trust): Phase 0 — shared TrustConfig + PlatformTrustConfigs (#1266)
• feat(trust): Phase 1 (gateway) — route gateway ingress through the shared gate (#1267)
• feat(trust): Phase 1 (discord) — L3 identity via shared gate (#1270)
• feat(trust): gateway echo-on-deny (Phase 2) + trust-none default (Phase 3) (#1273)
• feat(chart): add configToml pass-through as alternative to Helm rendering (#1276)
• feat(operator): oabctl ingress for Telegram/LINE (API Gateway + VPC Link + Cloud Map) (#1275)
• feat(operator): auto-register Telegram webhook, aws-sm:// secret refs (#1285)

Fixes

• fix: symlink gh to ghp instead of bundling separate binary (#1268)
• fix(operator): apply_ecs missing taskRoleArn/executionRoleArn/logConfiguration (#1280)
• fix(operator): strip stage prefix on private API GW integrations (#1283)

Docs & CI

• Docs(opencode): add API key provider config example (#1209)
• docs(adr): configUrl (primary) and configToml (inline/--set-file) over Helm rendering (#1271)
• ci(oabctl): build and release alongside every openab release (#1284)

---

Version Info

• Chart Version: 0.9.0-beta.7
• App Version: 0.9.0-beta.7

Installation

Helm Repository (GitHub Pages)

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab --version 0.9.0-beta.7

OCI Registry

helm install openab oci://ghcr.io/openabdev/charts/openab --version 0.9.0-beta.7

pre_seed utils (AWS CLI 2.35.13 + ghp 0.3.2)

Bundled pre_seed utilities for OAB fleet.

Contents:

• AWS CLI v2.35.13
• ghp v0.3.2 (ghpool shim)
• gh → ghp symlink

Usage: Add to [hooks.pre_seed].sources as S3 URI after uploading.