[anurag629]

The P1 release: the new reply engine, protocol v1 on the wire, shared storage, and endpoint protection. This was planned as two releases (0.6 in December, 0.7 in January). All of it is on dev and ready, so it ships as one.

Versions after the version PR: @chatcops/core 0.4.0 to 0.5.0, @chatcops/server 0.5.0 to 0.6.0, @chatcops/widget 0.5.0 to 0.6.0. The four store packages are still private and don't publish here. Their first publish comes after this release. The version PR will try to bump them to 1.0.0, because they list core as a peer dependency and core moves from 0.4 to 0.5, so I'll set them to 0.1.0 in that PR before it's merged.

What's in it

Core

• runTurn() runs a reply: model steps, tool calls in parallel, abort, and saving the reply as it grows. step() on Claude, OpenAI and Gemini replaces their own tool loops, and chat()/chatSync() are now deprecated wrappers (feat(core): add Claude step() and replay recorded provider streams in tests #260-feat(core): run every reply through runTurn, with tools between model steps #263)
• Tools take a full JSON Schema in inputSchema, and the server checks tool definitions at startup (feat(core): describe tool input with JSON Schema and check tools at startup #250)
• Claude prompt caching on the system prompt and tools (feat(core): cache Claude's system prompt and tools, with per-request context after them #264). An openai-compatible provider and registerProvider() (feat(core): add compatible providers and custom registration #289). Provider SDKs load lazily, so the classes moved to @chatcops/core/providers/* (239-Unloading provider SDKs #288)
• Storage interfaces with memoryStorage() and a conformance suite (feat(core): add storage interfaces, memoryStorage and a conformance suite #243), plus budgets and a rate limiter on CounterStore (245-Added rate limiter #274, feat: add token, reply and dollar budgets checked before each model request #277), and buffered analytics into an event sink (feat(core): buffer analytics events into sinks #314)

Server

• Protocol v1: typed parts, real HTTP statuses, pings, a 256 KB body cap. 0.5 widgets keep getting the old format (feat(server): speak protocol v1 on the wire #285)
• One message per reply with its parts, one reply per conversation at a time, regenerate by id, idempotent retries, and aborted replies kept (feat(server): run every reply through runTurn and save it with its parts #268, feat(server): regenerate a named reply, replay answered retries and keep aborted replies #269)
• storage for shared conversations, limits and locks, with purge() and retention (feat(server): add a storage option, retention and purge() #273). Budgets on by default (feat(server): turn budgets on by default #279)
• allowedOrigins (feat(server): add allowedOrigins and refuse other sites with 403 #281), trusted client IP per adapter (feat(server): read the visitor's IP only from headers the platform sets #280), session tokens with POST /session (feat(server): add POST /session and session tokens on chat requests #301), Turnstile (feat(server): check Cloudflare Turnstile before issuing a session #303), a security log at startup (feat(server): log security settings and mistakes at startup #318)
• Analytics written to the store, and counted across instances (feat(server): write analytics to the storage event sink #316). chatcopsAiSdkHandler for the AI SDK's useChat (feat(server): add chatcopsAiSdkHandler for the AI SDK's useChat #287)

Widget

• Speaks protocol v1, and still reads the old format (feat(widget): read protocol v1 parts and keep the server's reply ids #271). It handles session tokens and Turnstile on its own (feat(widget): get and send session tokens when the server has them on #302, feat(server): check Cloudflare Turnstile before issuing a session #303)
• Says why a reply failed: rate limited with the wait, budget used up, assistant unavailable, reply cut off (feat(widget): say why a reply failed: rate limit, budget, unavailable, cut off #319). The size budget is 14.5 kB for this

Docs: upgrade guide, security page, protocol reference, storage page with scheduled purge, pre-chat form guide, providers page.

Upgrade notes

All of it is on the new "Upgrading from 0.5" page. The parts most likely to need action:

• Budgets are on by default: 200 replies per conversation and 2M tokens per IP per day. Set budgets to change them.
• Per-IP limits need a trusted IP. Vercel, Cloudflare and Express (trust proxy) work as is. Other hosts need clientIp, or per-IP limits are skipped.
• Provider classes moved to @chatcops/core/providers/claude, /openai and /gemini. createProvider() doesn't change.
• cors and conversationStore are deprecated in favor of allowedOrigins and storage.

How it was tested

On dev at 5b31899: build, typecheck, 1152 unit tests and 15 Chromium e2e tests pass. The e2e tests include the published 0.5.0 widget against this server. Live run with real Claude, OpenAI and Gemini keys, all 14 checks passed:

• a text reply through the server handler in protocol v1
• a tool with nested input
• two tools in one step
• abort in under 10 ms on all three providers
• Claude dropping temperature with one warning
• a Claude prompt cache read on the second request (9,116 tokens)