release: yoagent-rutis 0.3.0

CHANGELOG.md

@@ -17,8 +17,14 @@ adheres to [Semantic Versioning](https://semver.org/).
 - **The example's approval gate** (`confirm-dangerous.ts`, used by `coding_agent` and `handoff_agent`) asks before selected operations that delete, discard or overwrite the owner's files. It tokenizes each command (quotes, escapes, redirections, heredoc bodies skipped) and reads it command by command. It follows `cd`, looks past wrappers (`env`, `timeout`, `nice`, `xargs`, …), reads git's subcommand past its global options, and checks `bash -c` scripts the same way. Anything with a path it cannot know (`$VAR`, `~`, globs, an unfollowable `cd`) asks. It covers `rm`, `git reset --hard`, `git clean`, `git checkout` / `restore` of paths, `git branch -D`, a forced push, `find -delete`, and a write, `mv`, `cp`, `tee` or redirection over an existing file. A guardrail, not a sandbox: targeted edits and what a script does inside are not checked. Before, it caught only `rm -r`, `sudo`, `chmod -R`, `git push --force`, `mkfs` and `dd`. Files the agent created this session, and the scratch folder a host names in `YOAGENT_SCRATCH`, are exempt. An ended session now ends its open questions with their default, where they used to be left open. Steering or a follow-up that arrives as a run ends (too late for that run to read) now starts the next run instead of waiting for whatever run comes next.
 - Tool cards: a tool result's `details.view` is drawn as a card in the browser (and titles the tool line: in the browser when no UI plugin draws the tool, always in the terminal UI); questions gain `message` and multiple-choice `select` (options sent once each); the `ui` service gains `frontends()`; the terminal UI asks again on an answer that does not fit.
 
-### yoagent-rutis (unreleased)
+## yoagent-rutis 0.3.0 (2026-10-12)
 
+yoagent-rutis only; yoagent is unchanged (0.25.2). Requires yoagent 0.25, **rutis 0.9** and **Rust 1.88**.
+
+- **rutis 0.9** (breaking: rutis types are in this crate's API, so this is a minor bump): `rutis`, `rutis-bridge` and `rutis-loader` 0.9, and the npm (`@arcships/rutis`, `@arcships/rutis-runtime`) and PyPI (`rutis`) packages at 0.9.1. Move the host and the language runtimes together: a 0.9 host sends call origins that a 0.8 runtime rejects. rutis 0.9 needs Rust 1.88 (yoagent itself stays at 1.86), Node 22 (pi: 22.19) and Python 3.10. A Node plugin that disposes itself is now reported to the host.
+- **Bun** (`bun` feature): the same TypeScript plugins in Bun 1.4+ runtimes, rows `bun:<module>`, no build step. Local only for now (rutis's Bun runtime cannot listen remotely yet).
+- **Go** (`go` feature): plugins built with the rutis Go SDK (Go 1.24+), each binary a runtime started when a `go:<plugin>` row needs it. A handler is a map of Go functions; a hook's `context.Context` is cancelled when the host gives the call up, the same contract as a JavaScript hook's `AbortSignal`. Example: `plugins/go/main.go`.
+- **16 MiB per message.** rutis 0.9 closes a channel on a message over 16 MiB, which ends the runtime and every plugin in it. The bridge keeps every call under 15 MiB: the conversation (`messages`) and events reach the plugin with their images as text when they would exceed it — a call's own `args` never change — and an `after_tool` output or `call_tool` arguments still that large are not sent at all (the output is withheld, the tool call fails). The DSH and pi adapters cap a result's images at 12 MiB of base64.
 - **The run's conversation, on request**: a handler can ask for `messages` (yoagent's LLM messages) on the `Turn`, `ToolCall` (`before_tool`) and `Stop` it sees — `Handler::with_messages()` in Rust, `options.messages: true` for TypeScript / Python plugins. Off by default (it copies the conversation for every call); handlers that did not ask never get it.
 - pi adapter: what does not map (commands, shortcuts, events yoagent never fires) is reported at `info`, not `warn`: it is expected, not a fault (refusals stay warnings).
 - **pi adapter: `message_end` and `context` handlers are checked, not refused.** Each message goes (a copy) to the `message_end` handlers once — the assistant message before any of its tools runs — and each request's messages to the `context` handlers; a handler that only reads works, one that would change what it got stops the adapter (yoagent cannot apply the change), and a check cut short by a timeout or cancel does not pass. The final answer is checked after it was given: a rewrite there fails the run only for a required bridge, and refuses later runs. In the [plugin compatibility](docs/evals/plugin-compatibility.md) matrix this takes pi's top 20 from 9 to 12 usable packages (pi-lens, pi-powerline-footer, context-mode; refused 8 → 5).

integrations/yoagent-rutis/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "yoagent-rutis"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 resolver = "3"
 description = "Extend yoagent agents at runtime with rutis plugins, as one yoagent Extension: tools, tool policy, output filters, turn notes, input checks, verifiers and events"

integrations/yoagent-rutis/README.md

@@ -650,7 +650,7 @@ the others).
 ## Versions
 
 yoagent-rutis 0.1 (crates.io) requires yoagent 0.25 (the first release with
-`Extension`) and rutis 0.6; 0.2 requires rutis 0.8; the next release requires
+`Extension`) and rutis 0.6; 0.2 requires rutis 0.8; 0.3 requires
 rutis 0.9 and Rust 1.88. rutis's release train (`rutis`, `rutis-bridge`,
 `rutis-loader`, the npm and PyPI runtimes) shares one version: move the host
 and the language runtimes together. yoagent and rutis types are in its API, so a minor bump of
@@ -660,7 +660,7 @@ as `yoagent-rutis`: a crates.io `yoagent` next to a git `yoagent-rutis` is two
 
 ```toml
 yoagent = "0.25"
-yoagent-rutis = "0.2"
+yoagent-rutis = "0.3"
 ```
 
 ## License