Skip to content

Aura

v1.4.8 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agents deepseek desktop-app developer-tools llm
+4 more
openrouter pair-programming pyside6 python

ReleasePort's take

Light signal
editorial:auto 2h

Release v1.4.8 makes project‑local dependency setup safer by blocking risky global installs and adding smarter detection of missing imports, while also introducing a new ProjectProfile preflight summary.

Why it matters: Blocks potentially harmful global/system package installations during Worker runs; severity 70 indicates high impact for setups that rely on such commands. Tracks multiple missing imports without false failures (severity 50), reducing spurious setup errors.

Summary

AI summary

Project-local dependency setup becomes safer and more intelligent, reducing false failures and improving project context.

Changes in this release

Security High

Blocks global and system-level package installs during Worker runs.

Blocks global and system-level package installs during Worker runs.

Source: llm_adapter@2026-06-05

Confidence: high

Feature Medium

Introduces ProjectProfile / project preflight foundation to summarize context before coding.

Introduces ProjectProfile / project preflight foundation to summarize context before coding.

Source: llm_adapter@2026-06-05

Confidence: high

Feature Low

Moves file viewer into the main workspace/editor area and removes the old left‑pane file tree.

Moves file viewer into the main workspace/editor area and removes the old left‑pane file tree.

Source: llm_adapter@2026-06-05

Confidence: high

Feature Low

Warns and opens Provider Setup when an external CLI provider is missing or unavailable.

Warns and opens Provider Setup when an external CLI provider is missing or unavailable.

Source: llm_adapter@2026-06-05

Confidence: high

Feature Low

Corrects direct provider pricing values.

Corrects direct provider pricing values.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Medium

Correctly recognizes rewritten relative and absolute `.venv` commands during setup.

Correctly recognizes rewritten relative and absolute `.venv` commands during setup.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Medium

Adds Python 3.10 `tomli` fallback support for dependency setup.

Adds Python 3.10 `tomli` fallback support for dependency setup.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Medium

Tracks multiple missing imports without causing false setup failures.

Tracks multiple missing imports without causing false setup failures.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Medium

Requires real project evidence before allowing project manager setup commands.

Requires real project evidence before allowing project manager setup commands.

Source: llm_adapter@2026-06-05

Confidence: high

Bugfix Low

Removes stray root scratch verification file.

Removes stray root scratch verification file.

Source: llm_adapter@2026-06-05

Confidence: high

Full changelog

This release is a major hardening pass for Aura’s coding workflow.

The focus of this update is simple: make Aura feel better on real projects. Less noise, fewer false failures, safer dependency setup, clearer project context, and a smoother path from “the Worker wrote code” to “the project actually validates.”

Highlights

Safer project-local dependency setup

Aura now handles project-local dependency setup more intelligently inside Worker runs.

Workers can use safe setup commands such as:

  • .venv pip installs
  • uv sync
  • poetry install
  • pdm install

Global and system-level installs remain blocked. Aura should not poison your global Python environment or install random packages while an agent is thrashing.

Missing declared dependencies are now treated as project environment setup issues, not bad code. This means Aura can write the source file first, then guide setup and validation afterward.

Undeclared dependencies can also be steered through dependency file updates before setup runs. Placeholder-module workarounds are blocked.

Dependency setup recovery fixes

This release tightens several follow-up setup paths:

  • Rewritten relative and absolute .venv commands are recognized correctly.
  • Explicit validation commands can no longer bypass install safety.
  • Python 3.10 tomli fallback support was added.
  • Multiple missing imports are tracked without false setup failure.
  • Project manager setup commands now require real project evidence before being allowed.

This should make Worker recovery less brittle when a project needs dependencies before tests or validation can run.

Project preflight foundation

Aura now has a ProjectProfile / project preflight foundation.

Before coding starts, Aura can detect and summarize useful project context:

  • Project type
  • Manifests
  • Lockfiles
  • Package manager
  • Existing .venv
  • Declared dependencies
  • Candidate setup commands
  • Candidate validation commands

That profile is now included in workspace snapshots, giving Workers better context before they start editing.

Provider setup polish

External CLI providers now behave more clearly when unavailable.

Instead of silently appearing configured, Aura now warns and opens Provider Setup when an external provider is missing or unavailable.

This release also adds focused provider configuration tests and removes a stray root scratch verification file.

Pricing configuration updates

Direct provider pricing values were corrected.

Workspace and file navigation polish

The file viewer has been moved into the main workspace/editor area.

The old file tree was removed from the left pane. Project navigation now lives beside the editor/log workspace, closer to the surface where actual work happens.

Cleaner user-facing harness behavior

This release begins tightening the boundary between main chat and internal diagnostics.

The direction is:

  • Main chat should show clean, useful summaries.
  • Worker Log should keep raw technical details.
  • Transient failed planner/tool cards should be treated as UI debris and removed when they are no longer useful.

This is part of a broader effort to make Aura’s workflow state visible without making the main chat feel like a crash dump.

Why this matters

Aura’s core loop is:

Planner → Worker → Safe Write → Craft Review → Setup → Validate → Repair → Done

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Aura

Get notified when new releases ship.

Sign up free

Related context

Earlier breaking changes

  • v1.4.0 All file-writing paths now route through a validation pipeline.

Beta — feedback welcome: [email protected]