v3.11.0 — new service piston + whole-package security pass
Minor release. Adds engineer-man/piston as a new aigate service
(sandboxed multi-language code execution; nsjail-based per-execution
isolation; pre-bake architecture for runtime no-outbound), plus the
fallout from a full brutal-review pass across every line of code,
every doc, every config.
PISTON
- 50+ languages available; default pre-bake is python + node only.
- Pre-baked at image build time -> runtime container lives on
aigate-internal ONLY (no outbound).
- privileged:true is what piston needs to set up nsjail; the
sandbox is the nsjail subprocess (own user ns, chroot, seccomp,
cgroups). For aigate's threat model (trusted operator +
bearer-auth-gated endpoint + sandboxed code from LLM agents)
this is acceptable.
- /piston/ nginx gate with `Bearer ${AIGATE_TOKEN}`; client
Authorization header stripped before proxy hop.
- MCP tool `mcp_tools-execute_code` exposed via the existing /mcp/
aggregator.
SECURITY HARDENING
- SSRF guard on llamacpp image_url fetches (both default path +
Surya PDF path). Blocks RFC1918 / loopback / link-local /
multicast / reserved hosts. Live-verified.
- no-new-privileges:true added to claudebox, pibox-zai, ollama,
ollama-cuda. README claim qualified for the two genuine
carve-outs (piston needs privileged for nsjail; tailscale needs
NET_ADMIN).
- resource_manager: try/except BaseException wrapping the unload
phase releases the semaphore on cancel; talkies CPU+CUDA unload
lists synced to provider YAML (CPU 4->6, CUDA 8->14) so previously
un-evicted models actually free memory under contention.
BUG FIXES
- litellm/config/fallbacks.json: 20+ dead local-speaches-* / 4 dead
local-qwen3-cuda-tts entries rewritten to live talkies slugs.
- mcp/server.py: search_web num_results capped at 100;
execute_code description no longer lies about installed
runtimes.
DOCS
- README Piper/Speaches drift cleaned (5 places).
- new docs/services/piston.md.
- 7 broken relative links in docs/services/* repaired.
- docs/services-reference.md + docs/usage.md deleted (stale
redirect stubs from v3.10.0).
- docs/services/resource-management.md moved out of services/
(it's cross-cutting LiteLLM callback logic, not a service).
TESTS
- tests/test_piston.sh: 8 cases including
test_piston_e2e_groq_drives_execute_code which exercises the
full agentic loop (Groq llama-3.3-70b -> tool_call -> MCP ->
piston nsjail -> SHA-256 verified byte-for-byte). All green.
Full per-file breakdown in CHANGELOG.md.