1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents klaus v0.0.319

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.318...v0.0.319

  • AI Agents klaus v0.0.318

    Changed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.317...v0.0.318

  • AI Agents muster v5.7.14

    Fixed

    • (deps) Update module github.com/giantswarm/apptest-framework/v5 to v5.2.6 in #1130 by @renovate[bot]

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.13...v5.7.14

  • AI Agents muster v5.7.13

    Fixed

    • The workflow executor’s debug logging no longer prints workflow arguments, resolved step arguments, step results, template results or the final result. Those are user data – a token passed as a workflow input, a credential returned by a step – and were dumped verbatim with %+v at debug level. The lines now carry the workflow name, step id, argument and result key names, value shapes and sizes only. A behavioral scenario (workflow-args-never-logged) runs a secret through a workflow and asserts it never reaches muster serve’s output.
  • AI Agents muster v5.7.12

    Fixed

    • (testing) Guard reserved instance ports through the exec window in #1131 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.11...v5.7.12

  • AI Agents muster v5.7.11

    Fixed

    • core_auth_login accepts an optional reset_client_registration: true. It discards muster’s stored RFC 7591 dynamic client registration with the server’s authorization server and registers again before issuing the sign-in link — the escape hatch for an authorization server whose refusal of the stored client_id the automatic checks below cannot see. Other users’ tokens from that authorization server may need a fresh sign-in afterwards, since their refresh tokens are bound to the old client_id.
    • Stored RFC 7591 dynamic client registrations now heal themselves when the authorization server forgets them. Registrations without an expiry lived forever in muster’s credential store, so an authorization server that lost its client registry (pro keeps registered clients in memory; its pod was evicted during a node roll) answered every sign-in in the user’s browser with 400 invalid_client — a failure muster never saw — until an operator deleted the Valkey entry by hand. Before a sign-in link is issued with stored DCR credentials muster now verifies them: via the RFC 7592 client read when the registration response provided registration_client_uri, otherwise by asking the authorization endpoint with a client_id/redirect_uri-only request whose RFC 6749 §4.1.2.1 failure shape reveals whether the client is still known (a redirect to muster’s own redirect_uri: alive; a direct invalid_client: gone; anything else: inconclusive, credentials kept). A registration found dead is dropped and re-created within the same core_auth_login, logged at INFO. invalid_client from the token endpoint during the code exchange, or error=invalid_client on the callback, drops the stored registration too, so the user’s retry registers again.
  • AI Agents muster v5.7.10

    Fixed

    • (aggregator) Redact caller tokens from SSO log lines in #1129 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.9...v5.7.10

  • AI Agents muster v5.7.9

    Changed

    • (lint) Silence six gosec false positives with inline nolint in #1120 by @The127

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.8...v5.7.9

  • AI Agents muster v5.7.8

    Fixed

    • muster agent --mcp-server now honors MUSTER_OAUTH_CALLBACK_PORT. The agent’s OAuth flow hardcoded port 3000 for its AuthManager, while the environment variable was read in exactly one place that this path never consulted — so with 3000 occupied, setting the variable made muster auth login work while the agent still bound 3000 and failed, and the port-in-use message interpolated the env-derived port, naming a port the failing code never used. cli.GetCallbackPort is now the single resolver for every OAuth entry point, and the cmd package’s duplicate DefaultOAuthCallbackPort constant is removed. docs/reference/cli/agent.md lists the variable now, instead of leaving it documented as belonging to muster auth login alone. The re-auth failure message the MCP server returns no longer names port 3000 either: the number was written into its text, so it stated the default even when the flow had been configured onto another port – and when the cause really is a bind failure, the wrapped error printed above it already reports the port that was tried. (#1111)
    • The CLI auth handler registry no longer serves a closed adapter, and get-or-create no longer orphans one. Get-or-create was a check-then-act – GetAuthHandler, construct, Register, GetAuthHandler again: handlerMutex makes the individual registry calls atomic but leaves the composite racy, so concurrent callers each built and published their own adapter and every loser was orphaned without Close(). Both sites that spelled it that way – the auth commands and the ToolExecutor behind muster list/get/call – now go through the new primitive. (noSilentRefresh still lives on the shared adapter, so the caller that registers it fixes the value for the process; that is unchanged here, and no muster command runs a second registrant.) Separately, AuthAdapter.Close() tore down its managers but never unpublished, so api.GetAuthHandler() kept returning a closed adapter that — carrying no closed flag — silently re-created managers on itself instead of failing. New api.GetOrRegisterAuthHandler runs the check, the construction and the publish under one write lock so the factory runs exactly once, and Close() now clears the registration through api.UnregisterAuthHandler (a no-op when the adapter is not the registered one). (#1111)
  • AI Agents muster v5.7.7

    Fixed

    • (filesystem) Reject unsafe entity names to close a path-traversal hole in #1119 by @The127

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.6...v5.7.7