Releases

Low-level FFI bindings to an owned libwebrtc build. Not for direct use — see the safe `reactor-webrtc` crate.

Source management and structured diagnostics for the Deed compiler

Procedural macros for GPUI Box

Typed, GPUI-independent design tokens for GPUI Box Kit

HTTP client abstractions for GPUI Box

Per-run observability trace primitive for Ryu: the ordered-span store (`Span` v1 contract + SQLite-backed `TraceStore`) that records tool-call/model-call spans keyed by `conversation_id` (the run id) — open/close spans, args-hash privacy fingerprinting, and newest-first per-run span reads that back the desktop per-run trace viewer (M4). Placement rationale (Core, not Gateway): span ordering and tool-call sequencing are *what ran* (orchestration); token counts and cost are *what is measured/paid* and stay Gateway-side — this store deliberately holds NO tokens/cost fields. An extracted Core capability crate; in-process by default and consumed as a NON-optional path dependency (the store opens at boot and backs a `ServerState` field). `TraceStore::open` takes an explicit db path, so the crate has ZERO dependency on apps/core — the default-path choice (`~/.ryu/traces.db`) stays Core-side wiring.

Speech-to-text (STT) modality primitive for Ryu: `transcribe(audio) -> text` with a swappable engine seam (in-process parakeet ONNX by default; whisper.cpp and Gateway-routed cloud Whisper as HTTP proxies). An extracted Core capability crate — in-process by default and consumed as a NON-optional path dependency (the voice/meetings/hardware data paths reach it unconditionally). The parakeet ONNX inference is the genuinely in-process hot path (feature `voice-parakeet`); whisper + gateway engines are thin HTTP proxies. Host couplings the crate cannot own (whisper base-url, Gateway url/bearer, the parakeet model dir) are injected via the narrow `SttHost` trait, so the crate has ZERO dependency on apps/core.

Unified tool-catalog primitive for Ryu (#474): the Contract-1 descriptor types (`ToolKind`/`ToolDescriptor`/`DescribedTool`/`DescribedArg`), the swappable `ToolRanker` (BM25 default + an embedder-backed Semantic seam), argument-schema parsing, and the pure search/describe bodies over `ToolDescriptor`. An extracted Core capability crate: in-process by default, consumed as a NON-optional path dependency (the `/api/tools/{search,describe}` endpoints and the mcp_bridge tool-search meta-tool reach it in every build, including lean). The semantic embedder injects via the narrow `ToolEmbedder` trait, so the crate has ZERO dependency on apps/core — the `RegistryTool`→`ToolDescriptor` ingest adapter, the built-in server inventory classification, the Composio live fetch, and the registry-driven embedder choice stay Core-side (`apps/core/src/sidecar/mcp/catalog.rs` + `apps/core/src/tool_registry_host.rs`).

Shared wire types for Ryu agent teams: the `TeamRecord` / `CreateTeam` payloads and the `Coordination` strategy enum exchanged over `/api/teams/*` between Core's `@team` chat orchestration and the out-of-process `ryu-teams` sidecar that owns `teams.db`. Dep-light (serde only) and with ZERO dependency on apps/core, so both sides can link it without either linking the other.

Shared wire contract for the Ryu self-healing loop: the `HealVerdict` action enum the out-of-process `ryu-healing` sidecar returns to Core, plus the two constants both sides must agree on out-of-band (the `healrun_` never-heal-a-heal prefix and the context-truncation policy). Dep-light (serde only) and with ZERO dependency on apps/core, so Core and the sidecar can both link it without either linking the other.

Plugin-owned key/value storage primitive for Ryu: an isolated, `(plugin_id, namespace, key)`-namespaced SQLite KV store (the plugin-host `storage:kv` capability's backing state). An extracted Core capability crate; in-process by default and consumed as a NON-optional path dependency (the plugin turn-hook runtime reaches it unconditionally). `PluginStorage::open` takes an explicit db path, so the crate has ZERO dependency on apps/core — the default-path choice and the process-global handle stay Core-side as wiring.

Agent Skills: the SKILL.md registry, dual-root (~/.claude + ~/.agents) scan, progressive-disclosure injection block, authoring + version history, and the `/api/skills/*` CRUD surface — an extracted Core capability crate. Kernel-required (the registry is injected into every chat turn), in-process only. Core consumes it as a path dependency and injects the ryu data dir + implements `Runnable` for `SkillRecord` host-side, so this crate has ZERO dependency on apps/core.

Conversation search primitive for Ryu: a sqlite-vec (`vec0`) semantic KNN index plus a contentless FTS5 lexical index over past chat messages, storing vectors/inverted-index + metadata only (never message text — the caller re-reads and decrypts snippets from `conversations.db`). An extracted Core capability crate; in-process by default and consumed as a NON-optional path dependency (the ConversationStore reaches it unconditionally). The embedder is injected via the narrow `SearchEmbedder` trait, so the crate has ZERO dependency on apps/core — the registry-driven embedder choice and the default db paths stay Core-side (`apps/core/src/search_host.rs`).

Predict: the system-wide predictive-typing brain for Ryu — an extracted Core capability crate owning the completion engine (config, per-app allowlist, secure-field denylist, prompt assembly, reply cleanup) and the `/api/predict/*` HTTP surface. In-process default; Core consumes it as a NON-optional path dependency. Every cross-cutting call it needs (preferences, the agent's bound model, the default model id, the Gateway side-model call, and the plugin-owned enabled flag) is inverted through the `PredictHost` trait so this crate has ZERO dependency on apps/core. The process-global on/off flag (`predict::set_enabled` / boot seeding) stays in the kernel — it is the built-in Predict plugin's switch.

Core transcript, content, usage, and cancellation primitives for agentkit.

Room-keyed realtime fan-out primitive for Ryu: a transport-agnostic RoomRegistry mapping room_id -> a per-room tokio actor that owns isolated ephemeral state (presence map + idle clock) behind a command channel, with a bounded broadcast sender for fan-out. Rooms are keyed by id, hibernate when idle, and rehydrate on next join; membership is an RAII guard whose Drop reaps presence. Exposes a typed event contract (the Frame enum over Events/Presence/DocSync channels, broadcast via publish_event, subscribe returning a droppable receiver = unsubscribe handle). An extracted Core capability crate consumed as a NON-optional in-process path dependency (the chat fan-out path drives it directly, never over IPC). ZERO dependency on apps/core.

Shared notification-delivery wire types + send primitives for Ryu: the swappable channel targets (webhook / Telegram / Expo push / BYO SMTP email recipient) and the dep-light HTTP send functions behind monitor alerts, policy alerts, workflow channel-send, and user-scoped notifications. The kernel notification STORE + fan-out orchestration stay Core-side (`apps/core/src/notify`); this crate holds only what Core and the out-of-process monitors engine BOTH need, so it has ZERO dependency on apps/core.

Mesh read/shape primitive for Ryu (#478 P5–P7): the read side of the optional Tailscale/Headscale plane. Owns `RYU_MESH_ENABLED` gating, the `GET /api/mesh/status` (Contract 6) shaping from `tailscale status --json`, the fail-closed shared-mesh-token bearer resolution for `GET /api/mesh/peers` (the node-admittance security model this crate anchors — `enforce_remote_auth` stays in Core and consults `is_insecure_auth_token_placeholder` here), and the Funnel helpers P6 consumes for public webhook ingress. An extracted Core capability crate; in-process by default and consumed as a NON-optional path dependency (the fail-closed startup gate reads `is_enabled()`/`is_insecure_auth_token_placeholder` unconditionally). The one kernel coupling — the `tailscale`/`tailscaled` process shell-outs (the 'what runs' half of the mesh, a Sidecar in Core) — inverts through the narrow `MeshHost` trait so this crate has ZERO dependency on apps/core.

A host library: where a connector's CredentialRef resolves to a value. Deliberately outside this workspace's compile path.

MCP server catalog primitive for Ryu: browse and install MCP servers from the official Model Context Protocol registry (and sibling Smithery / Ryu-hosted sources). Owns the tolerant `server.json` wire parser, catalog card/detail shaping, the SSRF-safe pagination fetch, and the security-hardened install-plan builder (package-identifier / version / remote-URL validation, no shell-metacharacter or path-traversal smuggling). An extracted Core capability crate with ZERO dependency on apps/core — its one cross-cutting kernel coupling, the SSRF-guarded registry fetch (`server::guarded_get_bytes`), inverts through the narrow `McpCatalogHost` trait, which Core installs at boot.

Derives a connector's HTTP request plan from the canonical catalog document — no engine, no transport, no socket.

Pure-Rust port of the reference Argon2 implementation (phc-winner-argon2), with runtime-dispatched SIMD backends

Every generated connector operation, embedded at compile time and queryable by key.

Ryu Hardware Protocol (RHP v1) node backend — an extracted Core capability crate: the paired-device registry (SQLite store + revocable per-device tokens), pairing nonce verification, the Opus/WAV codec edge, the per-connection realtime session state machine (audio buffering + ambient meeting bridge), the live device-sender registry, the display-nudge loop, and the device-registry + TRMNL display HTTP surface. In-process default; Core consumes it as a NON-optional path dependency (the codec is also used by the voice module, the store backs ServerState in every build). The public ws/pair ingress route + the chat-turn orchestration (welded to Core's run_text_turn/voice/TTS session loop) stay Core-side as consumers of this crate's types.

Dependency-free reader for the flux-connectors catalog pack: every connector's canonical document in one embedded, versioned, digest-checked file.

camera library for helixr

Image-generation modality primitive for Ryu: `generate(prompt) -> image` with a swappable engine seam (local stable-diffusion.cpp by default; OpenRouter/Replicate/fal cloud providers routed through the Gateway). An extracted Core capability crate — in-process by default and consumed as a NON-optional path dependency (the `POST /api/images/generate` data path reaches it unconditionally). Owns the image-gen abstraction + routing: prompt validation, default-count, the local-vs-cloud dispatch, and the media proxy/gateway-forward mechanics. Host couplings the crate cannot own (the local sd-server base-url, the Gateway url/token, and lazy-starting the sd.cpp sidecar) are injected via the narrow `ImageHost` trait, so the crate has ZERO dependency on apps/core.

BYOK SMTP email sink for Ryu self-host: a swappable outbound-email transport (the SES agent-inbox path in `packages/mail` is the other) delivering policy/monitor alerts and, later, agent-inbox send. A rich multi-recipient / cc-bcc / text+html multipart / threaded / attachment builder plus a one-line alert helper, over a BYO relay resolved prefs-first then `RYU_SMTP_*` env — no default provider, no-op when unconfigured. An extracted Core capability crate; secret custody stays kernel-side via an injected password resolver, so this crate has ZERO dependency on apps/core.

How a connector, its services, its operations and a tenant's credentials are named: a small, validated address vocabulary.

Framework-agnostic Rust tool definitions for LLM agents