Release Release v0.15.0 · aliyun/iac-code

Highlights

Added a new solution-first selling pipeline for architecture planning, candidate selection, template generation, and deployment.
Introduced a dedicated DashScope Qwen provider with improved streaming, tool-call handling, thinking controls, and usage attribution.
Enabled active AG-UI guidance without interrupting the running Pipeline.
Strengthened permission recovery across A2A, AG-UI, sandboxes, staged backups, and temporary STS credentials.
Made the solution-first flow the default Pipeline mode for the external iac-code Skill.
Updated website dependencies with security and reliability fixes.

Added the three-stage selling_solution_first Pipeline with architecture planning, candidate comparison, selection, template materialization, and deployment.
Added permission confirmation, interruption, recovery, and normal-chat handoff support throughout the flow.
Made selling_solution_first the default for the external iac-code Skill while preserving explicit use of the previous selling Pipeline.
Avoid duplicate confirmation prompts when handing a completed Pipeline back to normal chat.
Added local full-chain tooling, regression coverage, documentation, and translations in all supported languages.

Added a dedicated Qwen provider for DashScope-family models.
Added request-scoped provider leases and safeguards for streaming and native tool calls.
Improved thinking-mode adaptation, explicit caching behavior, fallback handling, and terminal usage attribution.
Preserved existing CLI, Web, A2A, and ACP output contracts.

Allow guidance messages to be sent while an AG-UI Pipeline is active without replacing its execution identity.
Preserve active guidance behavior across adapter restarts.
Preserve safe image filenames from AG-UI metadata so multimodal prompts can distinguish attachments.
Keep interrupts resumable without an artificial expiry window.

Bind permission checkpoints to stable STS caller identity fields instead of rotating temporary AccessKey IDs.
Restore persisted sessions before looking up and resuming permission checkpoints.
Preserve normal-mode permission recovery across different sandboxes.
Fence permission resume operations against staged-backup generations and return retryable errors while synchronization is incomplete.
Reapply request-scoped Alibaba Cloud credentials when rebuilding cloud tools.
Localize permission identity errors according to the caller's preferred language.
Fail closed when permission state or caller identity cannot be safely verified.

Refresh allowlisted remote Alibaba Cloud CLI environment values for each foreground request.
Prevent long-lived Skill managers from reusing stale routing configuration.
Keep transient environment values out of persisted job state.
Split the ROS Agent bridge into smaller source shards to satisfy Skill package size limits.
Improve durable runtime validation and staged-backup retry handling.

Enforce the correct ECS public-IP settings when an instance is associated with an EIP.
Improve validation coverage for ROS templates and EIP-bound ECS configurations.

Run Windows A2A lifecycle tests serially to avoid known worker termination instability while keeping the remaining suite parallel.
Improve session restoration ordering and staged-backup consistency.
Synchronize Python, Desktop, Tauri, Cargo, and translation catalog versions to 0.15.0.

Updated postcss-selector-parser with selector serialization and security fixes.
Updated browserslist from 4.28.2 to 4.28.8.
Updated fast-uri from 3.1.5 to 3.1.7, including multiple high-severity URI parsing and validation fixes.

Full Changelog: v0.14.0...v0.15.0