Odoshi

Odoshi (威し)

ODOSHI

Intimidation

LunarWing v2.0.4.0 follows that theme: it strengthens the boundaries around coordinated agents, external processes, extension runtimes, inbound files, and tenant operations — and makes those protections visible and recoverable for operators. LunarWing v2.0.4.0 is a security, runtime-lifecycle, multi-agent coordination, and operations release built on v2.0.3.0. Its largest changes are an opt-in coordination pipeline for designated XMPP/IRC rooms, managed MCP stdio crash recovery, a sandboxed GitLab tool, and the first public-only stage of DarkIRC’s secure key-exchange workflow. It also retires the Nanocode worker without deleting tenant data, hardens XMPP attachment downloads against SSRF and credential leakage, and puts agent-spawned process trees under bounded lifecycle control.

Highlights

Added an opt-in multi-agent coordination pipeline for designated XMPP/IRC rooms: canonical room scoping, secret and tag policy, engagement and first-responder controls, rate limiting, three-strike disablement, authenticated loopback administration, and outbound coalescing. Inactive under the default empty configuration.
MCP stdio runtimes now recover from crashes as a whole: fresh owner-scoped secrets, a new process and client, atomic all-or-none tool replacement, bounded retries, and a circuit-open state that’s visible in the browser and API.
Added a sandboxed self-hosted GitLab REST API v4 WASM tool. PAT material is injected only at the host boundary and never reaches the WASM guest; merges and file mutations require current SHA guards, and the new V25 migration persists per-tool approval policy.
DarkIRC staged key exchange begins: public-only Stage A artifacts, full-fingerprint authorization (nicknames are never authorization), bounded pending state, and deterministic crash recovery. Activation, peer verification, and rotation are deliberately not enabled yet.
XMPP and LunarVision file handling is hardened against SSRF, DNS rebinding, proxy inheritance, and credential leakage, with constant-time bearer comparison and bounded attachment workers.
Engine V2 stop signals now actually stop things: parallel siblings abort and drain promptly across structured, CodeAct, and orchestrator paths, and AlwaysAllow is persisted only after an action truly succeeds.
Retired Nanocode as a supported worker — deliberately non-destructive, so workspaces, images, containers, and rollback copies remain for manual downgrade or cleanup. The roster is now Pebble, OpenCode, and Kimi Code.
Updated the vendored Pebble worker to v0.5.0, and hardened the Kimi Code worker: OAuth-backed sessions can omit KIMI_API_KEY, while bridge bearer authentication stays mandatory.
Agent-spawned processes now run in their own bounded process trees, with dedicated systemd workload and build slices on supported hosts — and the measured idle daemon baseline dropped from roughly 461 MiB to 92 MiB RSS.
Completed and live-tested a staged Hermes-to-LunarWing PostgreSQL migration through Kawarimi, including encrypted secrets.
Per-tenant WeeChat enable/disable state, so health checks and self-heal no longer restart services you intentionally turned off.
The web gateway now persists work-log summaries and decision records separately from final answers, so you can inspect how an answer was produced.
Moved Wasmtime to 36.0.13, resolving RUSTSEC-2026-0222.

Upgrading

A few things deserve attention before you restart. Existing WASM tools inherit the conservative never approval policy — reinstall or update tools that need a looser one. Re-render tenant units to pick up per-tenant WeeChat state, coordination configuration, and the new resource slices. Private XMPP attachment hosts now require an explicit ALLOW_PRIVATE_IPS=1

Do not try to activate DarkIRC key exchange beyond Stage A — pending exchange state intentionally blocks managed migration until the health-gated activation path lands.

Additional Information

The pinned Rust toolchain remains 1.96.1.
For full release notes, check the repository as always.