August 15, 2026 Release notes 4 min read

What shipped — Aug 1–8, 2026

The weekly changelog from a studio running on its own agent fleet. 172 merged PRs across 35 repos — the busiest week we’ve logged. Some of it’s routine dependency hygiene. Some of it is us catching our own CI lying to us and fixing it same-day. Here’s the real list, grouped by what it actually does.

By Thomas Sprayberry · Sprayberry Labs

The one worth reading closely: dario’s health check finally proves something

For a while, dario’s health check proved dario was configured, not that it could actually serve. #922 closes that gap — the watcher now dogfoods a serving probe against itself (#929), so a green check means requests actually go through, not just that the process is up. Two real bugs fell out of building it:

  • #925 — an unkeyed proxy was leaking OAuth internals to tunnel callers on health responses. Fixed.
  • #910 — a request-queue slot leak when a client connects but never reads. Fixed.

Also this week: bulk re-auth for admins (#916, start-needed + batch complete), and a CI sparse-checkout bug where our own pin pointed at a shell script instead of a directory (#932) — broke, caught, fixed, re-pinned (#935) same day.

Security patches, not just version bumps

  • fast-uri override to 3.1.5 across agent-security-stack, browser-bridge, cordon, strongroom, truecopy — GHSA-7p8r-x3mc-p8w7.
  • hono bumped to a patched line in strongroom and agent-security-stack — GHSA-8j4g-w8fx-2239.
  • strongroom#73 — an MCP gate was running a poison detector with a known bypass. Fixed, not just documented.

Tool releases

  • truecopy 0.10.3 — ships the redstamp 0.7.5 PowerShell array-form bypass fix.
  • redstamp 0.7.5 — closes an -ArgumentList black-gate obfuscation-detection gap on Windows.
  • hands / redstamp / deepdive / fieldpass / agent-security-stack — all five onboarded to the Glama registry this week with README badges live.
  • deepdive now publishes a public authority-compare board on every release — that’s a transparency commitment, not a marketing page.

The maintenance tax

Most of this week was dependency bumps, CodeQL version syncs, and SDK-drift template refreshes across the fleet — the maintenance tax of running 35 repos in public. Not exciting. Also not optional.

One archival note

bring-your-own-model is now archived, read-only. If you’re using it, it still works; it’s just not getting new commits.

If you run any of this

Full repo-by-repo breakdown and PR links are on GitHub — every repo above is public. If you’re running any of these tools (truecopy, redstamp, strongroom, dario, hands) and hit something we should have caught — file an issue, we read them.

← All writing