This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
ReleasePort's take
Light signalThe `# OnError:` directive is now deprecated and has no effect at runtime.
Why it matters: If your code uses `# OnError:`, error handling will stop working; migrate to alternative mechanisms before deploying v0.27.2.
Summary
AI summaryDeprecated the inert # OnError: directive and corrected recursion help documentation.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
`--host 0.0.0.0` remains default for container-native environments with added usage caption. `--host 0.0.0.0` remains default for container-native environments with added usage caption. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Deprecation | Low |
`# OnError:` is now deprecated and inert; runtime no longer wires it. `# OnError:` is now deprecated and inert; runtime no longer wires it. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Deprecation | Low |
`# OnError:` is deprecated, parsed but not wired in the runtime. `# OnError:` is deprecated, parsed but not wired in the runtime. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Recursion help strings corrected to default 10 across all sections. Recursion help strings corrected to default 10 across all sections. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Added EACCES install note to README and getting‑started docs. Added EACCES install note to README and getting‑started docs. Source: llm_adapter@2026-07-16 Confidence: high |
— |
Full changelog
Upgrade impact: none (additive). Docs, help-content, one error message, and CLI onboarding copy; no runtime behavior change.
Final pre-launch pass — make every surface tell the truth and steer safely.
# OnError:is now presented as inert/deprecated everywhere it appears, instead of contradicting itself. It parses but is not wired in the runtime (the named fallback never fires), so a skill relying on it has no error handling. Fixed: thehelp({topic:"frontmatter"})entry (was "error-handler skill invoked when an op fails"), the${ERROR_CONTEXT}ambient table (was "Insideelse:and# OnError:"), the$ json_parseline, and — the sharpest one — theMissingSkillReferenceErrorruntime remediation message, which previously told users to wire# OnError:as the fix. All now point at a target-levelelse:block or an op-level(fallback: ...).language-reference.mdre-rendered from atoms with a "Deprecated: parsed but not wired — removal planned for v0.28" section. The grammar removal itself is deferred to v0.28 (a parser/compile/runtime change kept off the launch path).- Recursion help correction completed. 0.27.1 fixed one of two "default 5" strings in the composition topic; the
execute_skillsection still contradicted the Limits section. Both now readdefault 10(matchingDEFAULT_MAX_RECURSION_DEPTH). - Onboarding:
--host 0.0.0.0kept as the deliberate default (container-native:127.0.0.1is unreachable across a container namespace, so a client like NanoClaw needs all-interfaces) — now with a caption on the init hint, getting-started, and CLI help examples: binds all interfaces so a containerized client can reach it; on a shared/untrusted host use--host 127.0.0.1or setSKILLSCRIPT_EVENT_INGRESS_AUTH_TOKEN. (Requiring the token when binding off-localhost is tracked as a v0.28 behavioral hardening.) - EACCES install note added to the README + docs getting-started:
npm install -gmay fail withEACCESon a root-owned global prefix — re-run withsudoor use an nvm-style prefix. Standard npm behavior, not a Skillscript issue.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Skillscript
All releases →Related context
Related tools
Earlier breaking changes
- v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).
Beta — feedback welcome: [email protected]