1.36.0 — Bedrock text support and access hardening

2026-10-17

Adds bounded Nova 2 Lite text calls through the guarded LLM facade, configurable chat policies, and bulk presence counting. Hardens credential and storage access, fixes CDN delivery, and introduces stricter chat rule updates.

Breaking

• Chat rule updates now validate values: disappearing_ttl accepts 0 or 3,600–31,536,000 seconds, max_message_length accepts 1–4,000, and rate_limit accepts 0–100. Invalid values return 400.
• Enabling disappearing messages or shortening their TTL now requires global manage_chat by default; deployments can customize this through the room-authority hook.

Added

• Optional AWS Bedrock Nova 2 Lite text calls through llm.call() and ask(), with bounded reasoning effort, final-text responses, and guarded usage accounting.
• count_online() counts distinct online users using chunked Redis queries.
• Deployment hooks for chat reachability and room administration.
• Configurable CloudFront response headers policy, defaulting to AWS SimpleCORS.

Changed

• AWS provider failures include scrubbed diagnostic messages in operator logs.

Fixed

• Private CDN links honor the shorter configured URL lifetime without rounding expiry past that lifetime.
• Public file managers at a bucket root retain S3 delivery instead of receiving unusable unsigned CDN links.
• CDN visibility updates report invalid behaviors and missing signing key groups before submitting them.
• Shared test setup files run under tier presets even when they contain no tests.

Security

• Per-user API keys cannot manage credentials, change sign-in details, or use admin actions that issue sign-in or key secrets.
• Group keys and member-acting credentials cannot inherit personal global authority for group security controls.
• admin_compliance and admin_verify join the protected API-key permission floor.
• Group file managers using borrowed credentials must remain within their group's storage folders, including affected descendants and filesystem temporary folders.
• Explicitly requested file managers are authorized before use.
• Chat message edits require active room membership.
• Room administration enforces bans and owner/admin/member role order.
• Chat room ownership remains with the creator.

Upgrade notes

• No database migrations are added. Existing room rules and file-manager locations are not rewritten.
• Re-run CDN enablement once per provisioned bucket to apply the response headers policy.
• Bedrock requires an explicit static policy route, owner policy activation, and server AWS access to the selected inference profile and destination models.