Skip to content

Release Notes - v0.20.0

Release Date: 2026-10-26

v0.20.0 teaches OmniAgent to call APIs as an AAuth agent. A new aauthagent package enrolls the agent at an agent provider and gives an OpenAPI skill an HTTP client that signs every request with the agent's own identity and asks the person to approve what needs approval. The release also adds a /readyz readiness endpoint, fixes how OpenAPI skills build requests and load their specs, and moves to omnivault v0.6.0, whose secret handling is stricter. User guides and design documents now live in docs/guides and docs/design.

Highlights

  • AAuth for OpenAPI Skills - aauthagent.NewClient enrolls a key at an agent provider and returns an HTTP client that signs requests as that agent, obtains person and auth tokens, and waits while the person approves. Give it to an OpenAPI skill and the API decides what each operation needs.
  • Petstore Demo - examples/aauth-petstore is a terminal chat with the Petstore as an AAuth resource, with a container image. Browsing needs only the agent's identity; placing an order asks the person to approve.
  • Readiness Endpoint - GET /readyz reports whether the instance can serve right now, separately from /health liveness.
  • OpenAPI Skill Fixes - Array parameters and body fields are sent as the spec describes, a spec URL loads with the skill's own HTTP client, and a fetched spec cannot redirect the client or exceed a size limit.
  • Stricter Secrets - omnivault v0.6.0 redacts secrets when they are formatted or logged, and its file provider refuses secret files other users can read.
  • Docs Layout - The getting-started guide moved to docs/guides and the architecture overview to docs/design/architecture.

What's New

AAuth Agent

AAuth gives an agent its own identity. The agent signs each request, the resource says what the call needs, and the person approves it at their person server.

client, err := aauthagent.NewClient(ctx, aauthagent.Config{
    AgentProvider: "https://ap.aauth.test",
    EnrollPath:    "/enroll",
    OnInteraction: func(i aauthagent.Interaction) {
        fmt.Println("Approve at", i.Link())
    },
})
if err != nil {
    return err
}
a, err := agent.New(cfg, agent.WithOpenAPISkill(openapi.Config{
    Name:       "petstore",
    SpecURL:    "https://petstore.aauth.test/openapi.json",
    HTTPClient: client.HTTPClient(),
}))

OnInteraction runs while the request waits and receives the approval URL and code. A key you supply is reused across runs; without one a new Ed25519 key is generated, so the agent is new each run. See the AAuth guide.

The Petstore demo shows the whole flow. It runs next to the AAuth sandbox and the Petstore from the aauth-postman Compose file:

cd aauth-postman
docker compose --profile petstore up -d --build --wait   # sandbox and Petstore
ANTHROPIC_API_KEY=... docker compose --profile petstore run --rm omniagent

See the example's README for running it without Docker.

Readiness

/health stays a liveness probe: it returns 200 while the gateway runs. /readyz returns 200 only when the instance can serve:

curl http://127.0.0.1:18789/readyz
# {"status":"ok","checks":[{"name":"storage","status":"ok"},{"name":"agent_configured","status":"ok"}]}
  • storage runs a real write, read and delete against the configured backend.
  • agent_configured checks that an agent was built with an API key. It does not call the LLM on each probe.

Use /health for restart decisions and /readyz to gate traffic to a new deployment. The healthcheck subcommand behaves as before. See the deployment guide.

OpenAPI Skills

  • Array parameters and body fields are serialized as the spec describes.
  • A skill loads a spec URL, and the documents it references, with its own HTTP client, so a client that signs requests also fetches the spec.
  • A fetched spec may reference only http and https URLs, never local files.
  • The spec fetch follows no redirect, so the client's credentials never reach another host, and a document over 10 MiB is refused with an error instead of being cut off.
  • Tools that a remote skill discovers while it initializes are offered to the agent.

Upgrading

Secret files

omnivault v0.6.0 changes the file provider:

  • A secret file that group or other users can read is refused. Run chmod 600 on it, or set defaultMode: 0600 on a mounted volume. Windows does not enforce file modes.
  • Team-mode file secrets (team.secrets.provider: file) follow the same rule, so a dir restored from a backup needs its file modes fixed.
  • An absolute file:///path/to/secret credential still works. OmniAgent reads it through a file vault rooted at the file's directory.

Go API

omnivault's Secret.String is replaced by Secret.Reveal. Code that embeds OmniAgent's packages and calls String() on a secret must switch to Reveal(); formatting a secret now prints [REDACTED].

Dependencies

aauth-go v0.3.0 is required, with yaronf/httpsign held at v0.5.2. The go directive stays at 1.26.8. livekit/server-sdk-go v2.19.0 pairs with livekit/protocol v1.53, so the earlier exclude of protocol v1.51.0 is gone.

Documentation

Full Changelog

See CHANGELOG.md for the complete list of changes.