This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+4 more
ReleasePort's take
Light signalRelease v1.4.8 makes project‑local dependency setup safer by blocking risky global installs and adding smarter detection of missing imports, while also introducing a new ProjectProfile preflight summary.
Why it matters: Blocks potentially harmful global/system package installations during Worker runs; severity 70 indicates high impact for setups that rely on such commands. Tracks multiple missing imports without false failures (severity 50), reducing spurious setup errors.
Summary
AI summaryProject-local dependency setup becomes safer and more intelligent, reducing false failures and improving project context.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Blocks global and system-level package installs during Worker runs. Blocks global and system-level package installs during Worker runs. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Medium |
Introduces ProjectProfile / project preflight foundation to summarize context before coding. Introduces ProjectProfile / project preflight foundation to summarize context before coding. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Low |
Moves file viewer into the main workspace/editor area and removes the old left‑pane file tree. Moves file viewer into the main workspace/editor area and removes the old left‑pane file tree. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Low |
Warns and opens Provider Setup when an external CLI provider is missing or unavailable. Warns and opens Provider Setup when an external CLI provider is missing or unavailable. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Low |
Corrects direct provider pricing values. Corrects direct provider pricing values. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Correctly recognizes rewritten relative and absolute `.venv` commands during setup. Correctly recognizes rewritten relative and absolute `.venv` commands during setup. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Adds Python 3.10 `tomli` fallback support for dependency setup. Adds Python 3.10 `tomli` fallback support for dependency setup. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Tracks multiple missing imports without causing false setup failures. Tracks multiple missing imports without causing false setup failures. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Requires real project evidence before allowing project manager setup commands. Requires real project evidence before allowing project manager setup commands. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Low |
Removes stray root scratch verification file. Removes stray root scratch verification file. Source: llm_adapter@2026-06-05 Confidence: high |
— |
Full changelog
This release is a major hardening pass for Aura’s coding workflow.
The focus of this update is simple: make Aura feel better on real projects. Less noise, fewer false failures, safer dependency setup, clearer project context, and a smoother path from “the Worker wrote code” to “the project actually validates.”
Highlights
Safer project-local dependency setup
Aura now handles project-local dependency setup more intelligently inside Worker runs.
Workers can use safe setup commands such as:
.venvpip installsuv syncpoetry installpdm install
Global and system-level installs remain blocked. Aura should not poison your global Python environment or install random packages while an agent is thrashing.
Missing declared dependencies are now treated as project environment setup issues, not bad code. This means Aura can write the source file first, then guide setup and validation afterward.
Undeclared dependencies can also be steered through dependency file updates before setup runs. Placeholder-module workarounds are blocked.
Dependency setup recovery fixes
This release tightens several follow-up setup paths:
- Rewritten relative and absolute
.venvcommands are recognized correctly. - Explicit validation commands can no longer bypass install safety.
- Python 3.10
tomlifallback support was added. - Multiple missing imports are tracked without false setup failure.
- Project manager setup commands now require real project evidence before being allowed.
This should make Worker recovery less brittle when a project needs dependencies before tests or validation can run.
Project preflight foundation
Aura now has a ProjectProfile / project preflight foundation.
Before coding starts, Aura can detect and summarize useful project context:
- Project type
- Manifests
- Lockfiles
- Package manager
- Existing
.venv - Declared dependencies
- Candidate setup commands
- Candidate validation commands
That profile is now included in workspace snapshots, giving Workers better context before they start editing.
Provider setup polish
External CLI providers now behave more clearly when unavailable.
Instead of silently appearing configured, Aura now warns and opens Provider Setup when an external provider is missing or unavailable.
This release also adds focused provider configuration tests and removes a stray root scratch verification file.
Pricing configuration updates
Direct provider pricing values were corrected.
Workspace and file navigation polish
The file viewer has been moved into the main workspace/editor area.
The old file tree was removed from the left pane. Project navigation now lives beside the editor/log workspace, closer to the surface where actual work happens.
Cleaner user-facing harness behavior
This release begins tightening the boundary between main chat and internal diagnostics.
The direction is:
- Main chat should show clean, useful summaries.
- Worker Log should keep raw technical details.
- Transient failed planner/tool cards should be treated as UI debris and removed when they are no longer useful.
This is part of a broader effort to make Aura’s workflow state visible without making the main chat feel like a crash dump.
Why this matters
Aura’s core loop is:
Planner → Worker → Safe Write → Craft Review → Setup → Validate → Repair → Done
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Aura
All releases →Related context
Related tools
Earlier breaking changes
- v1.4.0 All file-writing paths now route through a validation pipeline.
Beta — feedback welcome: [email protected]