HHostingByteSoftware
Ctrl K
ComunidadGuías…

CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
# Changelog

All notable changes to this project are documented here.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.1.10] - 2026-10-12

### Changed

Dependency and CI updates merged since v1.1.9, each with green checks:

- chore(deps): Bump actions/setup-node from 7.0.0 to 7.1.0 (#51)
- chore(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#50)
- chore(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#48)
- chore(deps): Bump rust from `93ce27a` to `114c7a4` (#46)
- chore(deps): Bump node from `662933c` to `86f07bc` (#45)
- chore(deps): bump github/codeql-action init, analyze and upload-sarif together to 4.38.3

---

## [1.1.9] - 2026-10-12

### Changed

Dependency and CI updates merged since v1.1.8, each with green checks:

- chore(rust): raise the minimum supported Rust version from 1.88 to 1.89
- chore(deps): bump uuid to 1.28.0 and let Dependabot propose it again

---

## [1.1.8] - 2026-10-12

### Changed

Dependency and CI updates merged since v1.1.7, each with green checks:

- chore(ci): keep Dependabot from proposing uuid 1.27 or later (needs Rust 1.89)

---

## [1.1.7] - 2026-10-12

### Changed

Dependency and CI updates merged since v1.1.6, each with green checks:

- chore(deps): Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#32)
- chore(deps): Bump docker/build-push-action from 7.3.0 to 7.4.0 (#35)
- chore(deps-dev): Bump the web-dependencies group across 1 directory with 2 updates (#38)
- chore(deps): Bump dtolnay/rust-toolchain (#39)
- chore(deps): Bump the rust-dependencies group across 1 directory with 3 updates (#42)
- chore(deps): Bump debian from `3783cc0` to `7c7b2c9` (#36)

---

## [1.1.6] - 2026-10-11

### Security

- Updated `source-map-js` to 1.2.2 in the frontend lockfile, which fixes GHSA-68fv-2mgg-jv7q reported by `npm audit` (build tooling only).

### Fixed

- The OpenSSF Scorecard badge in the README showed a broken image on GitHub. The live badge is fetched through GitHub's image proxy, which gives up after four seconds, and the Scorecard lookup behind it often takes longer. The badge is now a small image stored in `docs/badges/` with the score of the last release, so it always loads.

---

## [1.1.5] - 2026-09-27

### Changed

Dependency and CI updates merged since v1.1.4, each with green checks:

- chore(deps): Bump debian from `abd67ff` to `3783cc0` (#16)
- chore(deps): Bump rust from `0e2bcae` to `93ce27a` (#17)
- chore(deps): Bump node from `cd56571` to `662933c` (#19)
- github/codeql-action `init` and `analyze` together to 4.38.2 (replaces #21 and #22, which each moved only one of the pair, so CodeQL failed on mismatched versions)

---

## [1.1.4] - 2026-09-27

### Changed

Dependency and CI updates merged since v1.1.3, each with green checks:

- chore(deps): Bump softprops/action-gh-release from 3.0.2 to 3.0.3 (#23)
- chore(deps): Bump github/codeql-action/upload-sarif (#24)
- chore(deps): Bump the web-dependencies group across 1 directory with 6 updates (#27)
- chore(deps): Bump the rust-dependencies group across 1 directory with 5 updates (#28)

---

## [1.1.3] - 2026-09-27

### Security

- `rustls` 0.23.43 to 0.23.45 for RUSTSEC-2026-0285: TLS 1.3 handshake messages were accepted across encryption level boundaries. The dependency audit failed on it, which also held back every Dependabot pull request.
- `chacha20` 0.10.1 to 0.10.2: 0.10.1 was yanked, and the audit runs with `--deny warnings`, so it failed on that as well.

### Changed

Dependency updates merged since v1.1.2:

- chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#15)

---

## [1.1.2] - 2026-08-15

### Added

- `docs/api.md`, a reference for the HTTP API and the WebSocket: every route,
  the error codes, the limits, both frame directions and the orchestrator
  events. Every example in it was run against a live server rather than derived
  from the source.
- The OpenSSF Best Practices badge. The project is registered as 14087.

### Changed

- The three container base images are pinned to their manifest digests instead
  of floating tags, so a build cannot silently pick up a different image.
  Dependabot already watches the Docker ecosystem and will move the pins.

## [1.1.1] - 2026-08-15

### Added

- The security checklist for v1.1.0, covering everything shipped since v1.0.0.
  Both checklists now carry a maintainer sign-off and are linked from
  SECURITY.md, so the security claims made there can be held against a record of
  what was actually verified.

### Fixed

- SECURITY.md described the provider error body as going "to the trace log at
  debug level", which contradicts itself. It goes to the debug log, as the code
  always did.

## [1.1.0] - 2026-08-14

### Added

- A per-room context limit. Each agent is shown only the most recent messages
  rather than the whole transcript, because the transcript keeps growing while a
  model's context window does not. The default is 40 messages; 0 keeps the old
  behaviour of sending everything. Existing databases are migrated in place.

### Fixed

- Reading a database created by an earlier version no longer fails when the
  schema has gained a column since.

## [1.0.2] - 2026-08-14

### Fixed

- The speaker label a model added to its own answer was only stripped from the
  stored message, so a client rendering the live stream still showed it until
  the finished message replaced it. The opening of an answer is now held back
  just long enough to decide, and the label never reaches the stream.

### Changed

- Dependency updates: rusqlite 0.37 to 0.40, tower-http 0.6 to 0.7, toml 0.9 to
  1.1, vite 7 to 8, TypeScript 5 to 7, the React plugin 5 to 6, and the
  container build image from Node 22 to Node 26.

## [1.0.1] - 2026-08-14

### Fixed

- An agent that put its own name in front of its answer produced a doubled
  speaker label in the transcript. Peers appear as `Name: text` in the prompt,
  so smaller models copy that shape for themselves despite the house rule
  against it. The label is now stripped when it matches the speaker, while a
  quoted peer label and text that merely starts with the name are left alone.

## [1.0.0] - 2026-08-14

First release.

### Added

- Orchestration core (`hive-core`) with rooms, agents and five turn policies:
  parallel, round robin, debate, moderated and consensus.
- Provider layer covering Ollama, the Anthropic Messages API and any
  OpenAI-compatible endpoint, behind one streaming trait. `ProviderRegistry`
  accepts external implementations, so an embedder can add a dialect the crate
  does not ship.
- Credential handling by environment variable reference: a provider entry
  stores the variable name, never the key.
- HTTP and WebSocket server (`hive-server`) serving the JSON API and the web UI
  from one port, with an optional shared access token, per-room turn locking
  and a concurrency cap.
- Terminal client (`hive`) for rooms, agents, live turns and Markdown export,
  working against the same database without a running server.
- Web UI in React and TypeScript with live token streaming, per-agent colours,
  vote results, transcript search, and English and German interface language
  chosen from the browser rather than hard-coded.
- Side-by-side comparison view for the parallel policy, where independent
  answers to the same prompt are laid out in columns.
- Room duplication, which copies a line-up onto a new question without its
  transcript.
- SQLite persistence with WAL, and transcript export as Markdown.
- Container image and a compose file with a read-only root filesystem, dropped
  capabilities and an unprivileged user.
- CI with formatting, Clippy, tests on Linux and macOS, a web build, dependency
  audits for both ecosystems, a container smoke test, CodeQL and OpenSSF
  Scorecard. All actions pinned to commit SHAs.
- 120 tests, including end-to-end coverage of every turn policy against
  scripted providers.

### Notes

- The Anthropic provider deliberately omits `temperature`: current models
  reject the sampling parameters. An agent's temperature is honoured by the
  providers that still accept it.
- Reasoning is off unless an agent opts in, because reasoning tokens are drawn
  from the same `max_tokens` budget as the answer.

[1.1.2]: https://github.com/9t29zhmwdh-coder/HiveMind_Chat/releases/tag/v1.1.2
[1.1.1]: https://github.com/9t29zhmwdh-coder/HiveMind_Chat/releases/tag/v1.1.1
[1.1.0]: https://github.com/9t29zhmwdh-coder/HiveMind_Chat/releases/tag/v1.1.0
[1.0.2]: https://github.com/9t29zhmwdh-coder/HiveMind_Chat/releases/tag/v1.0.2
[1.0.1]: https://github.com/9t29zhmwdh-coder/HiveMind_Chat/releases/tag/v1.0.1
[1.0.0]: https://github.com/9t29zhmwdh-coder/HiveMind_Chat/releases/tag/v1.0.0