chore(release): agentlens v0.15.0 (#70)

amitpaz1 · web-flow · commit b1455fa72ce8 · 2026-06-25T08:43:12.000+03:00
Consumes the 4 pending changesets: - @agentlensai/server 0.14.0 -> 0.15.0 (minor): agent-identity verify+stamp on ingest (#12 Phase 2), compliance evals on the audit trail (#55), OTLP own-decode + histogram ingest (#52/#64), per-agent spend endpoint for AgentGate budgets (#13). - @agentlensai/core 0.13.0 -> 0.14.0 (minor). - @agentkit/pricing 0.1.0 -> 0.2.0 (minor): first publish — centralized LiteLLM pricing. - @agentlensai/mcp 0.13.1 -> 0.13.2 (patch): bound the startup capability probe so it can't stall the stdio handshake (#69). cli/sdk/auth unchanged (already live, publish skips them). Root bumped to track the v* release tag (precedent: root==tag at v0.14.0).
diff --git a/.changeset/agent-identity-ingest-stamp.md b/.changeset/agent-identity-ingest-stamp.md
diff --git a/.changeset/centralized-pricing.md b/.changeset/centralized-pricing.md
diff --git a/.changeset/compliance-evals.md b/.changeset/compliance-evals.md
diff --git a/.changeset/mcp-boot-probe-timeout.md b/.changeset/mcp-boot-probe-timeout.md
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agentlens",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/agentkitai/agentlens.git"
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @agentlensai/core
 
+## 0.14.0
+
+### Minor Changes
+
+- 6a8c268: Centralize LLM model pricing in a new `@agentkit/pricing` package, sourced from LiteLLM's published prices with an embedded fallback.
+
+  - Consolidates the two server-side cost tables (`@agentlensai/core` `DEFAULT_MODEL_COSTS` and the cloud `batch-writer` table) onto one source of truth — they had drifted in both units (per-1M vs per-1K) and model coverage.
+  - Fixes the cloud-ingest path, which previously returned no cost for modern model ids (e.g. `claude-opus-4-8`) because its hand-maintained table used outdated key formats.
+  - Refreshes prices live from LiteLLM at server startup (fire-and-forget, falls back to the embedded table on failure). Off-switch: `AGENTKIT_PRICING_REFRESH=false`.
+
+  `@agentlensai/core` continues to re-export `DEFAULT_MODEL_COSTS` / `lookupModelCost` and now also exports `costUsd` and `refreshFromLiteLLM` — no breaking change for existing consumers.
+
+- 18428ae: Add compliance evals on the tamper-evident audit trail (#55, Phase 1).
+
+  A deterministic compliance scorer evaluates a completed session's events against policy rules — denied tools (`tool_denylist`, supports `delete_*` wildcards), `tool_allowlist`, `max_cost`, and a `no_severity_above` ceiling — with no LLM dependency, so the result is provable and reproducible.
+
+  - New `eval_result` event type + `EvalResultPayload`. The scoring outcome is emitted server-side as a SHA-256 hash-chained event in the session's audit trail, so eval results are themselves tamper-evident evidence ("we ran the eval, here's the cryptographic proof"). It is deliberately excluded from the public ingest schema so clients cannot forge eval results.
+  - New endpoint `POST /api/eval/sessions/:sessionId/compliance` — scores a completed session against inline `rules` and records the chained `eval_result`. Strict pass/fail by default; an optional `passThreshold` switches to score-based.
+  - `compliance` scorer type registered in the default scorer registry; `ScorerConfig.rules` carries the policy rules.
+
+### Patch Changes
+
+- Updated dependencies [6a8c268]
+  - @agentkit/pricing@0.2.0
+
 ## 0.2.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentlensai/core",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Core types, schemas, and utilities for AgentLens — AI agent observability platform",
   "type": "module",
   "license": "MIT",
diff --git a/packages/dashboard/CHANGELOG.md b/packages/dashboard/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @agentlensai/dashboard
 
+## 0.13.1
+
+### Patch Changes
+
+- Updated dependencies [6a8c268]
+- Updated dependencies [18428ae]
+  - @agentlensai/core@0.14.0
+
 ## 0.1.1
 
 ### Patch Changes
diff --git a/packages/dashboard/package.json b/packages/dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentlensai/dashboard",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Web dashboard for AgentLens — visualize agent sessions, events, analytics, and alerts",
   "type": "module",
   "license": "MIT",
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @agentlensai/mcp
 
+## 0.13.2
+
+### Patch Changes
+
+- d05c270: MCP server: bound the startup capability probe to a tight 1.5s timeout (configurable via `AGENTLENS_MCP_PROBE_TIMEOUT_MS`) so an unreachable or slow `AGENTLENS_URL` can't delay the stdio `initialize` handshake. An MCP stdio server must respond promptly, but boot awaited the probe (a network call) before connecting the transport — fine for `localhost` (refuses instantly) but a remote host that drops packets would stall startup up to 5s. The probe stays fail-open (a timeout registers all tools), so this only changes timing, not behavior.
+- Updated dependencies [6a8c268]
+- Updated dependencies [18428ae]
+  - @agentlensai/core@0.14.0
+
 ## 0.2.0
 
 ### Minor Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentlensai/mcp",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "mcpName": "io.github.agentkitai/agentlens",
   "description": "MCP server for AgentLens — instrument AI agents with zero code changes",
   "type": "module",
diff --git a/packages/pricing/CHANGELOG.md b/packages/pricing/CHANGELOG.md
@@ -0,0 +1,13 @@
+# @agentkit/pricing
+
+## 0.2.0
+
+### Minor Changes
+
+- 6a8c268: Centralize LLM model pricing in a new `@agentkit/pricing` package, sourced from LiteLLM's published prices with an embedded fallback.
+
+  - Consolidates the two server-side cost tables (`@agentlensai/core` `DEFAULT_MODEL_COSTS` and the cloud `batch-writer` table) onto one source of truth — they had drifted in both units (per-1M vs per-1K) and model coverage.
+  - Fixes the cloud-ingest path, which previously returned no cost for modern model ids (e.g. `claude-opus-4-8`) because its hand-maintained table used outdated key formats.
+  - Refreshes prices live from LiteLLM at server startup (fire-and-forget, falls back to the embedded table on failure). Off-switch: `AGENTKIT_PRICING_REFRESH=false`.
+
+  `@agentlensai/core` continues to re-export `DEFAULT_MODEL_COSTS` / `lookupModelCost` and now also exports `costUsd` and `refreshFromLiteLLM` — no breaking change for existing consumers.
diff --git a/packages/pricing/package.json b/packages/pricing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentkit/pricing",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Centralized LLM model pricing for the AgentKit suite, sourced from LiteLLM's published prices with an embedded fallback.",
   "type": "module",
   "license": "MIT",
diff --git a/packages/server/CHANGELOG.md b/packages/server/CHANGELOG.md
@@ -1,5 +1,42 @@
 # @agentlensai/server
 
+## 0.15.0
+
+### Minor Changes
+
+- 52182fb: Verify and stamp agent identity on ingest (#12 Phase 2 — the cross-repo wedge).
+
+  `POST /api/events` now accepts an AgentGate-minted agent token via the `X-Agent-Token` header. When present and valid, every event in the batch gets a **server-authoritative** `verifiedAgentId` (plus `verifiedAgentMethod: "agentgate_token"`) stamped into its metadata — turning the self-reported `agentId` into a cryptographically attributable one on the tamper-evident audit trail.
+
+  - The verified id lives in event **metadata**, which is already part of the hashed payload, so the stamp is itself tamper-evident **without** changing the hashed field set (existing hash chains stay valid — no `HASH_VERSION` bump).
+  - It is **forgery-proof**: the reserved `verifiedAgentId`/`verifiedAgentMethod` metadata keys are always stripped from client input and only re-set after the server verifies the token, so a client can never inject them. The webhook ingest path (`POST /api/events/ingest`) also strips these reserved keys from caller-supplied context (it never stamps — HMAC there proves the source, not the agent identity); the OTLP path builds metadata server-side and is unaffected.
+  - Verification mirrors AgentGate (shared `agentkit-auth`): HS256 signature over the shared secret **plus** the load-bearing `typ:"agent"` claim. A user token, an expired token, or a wrong-key token is ignored (no stamp).
+  - New env var **`AGENTGATE_JWT_SECRET`** — AgentGate's signing secret, shared with AgentLens to verify agent tokens. When unset, the feature is off and ingest is unchanged. Verification is cryptographic only (no callback to AgentGate); agent tokens are short-lived, which bounds staleness.
+
+  See AgentGate's `docs/agent-identity.md` for the full identity model and trust boundary.
+
+- 6a8c268: Centralize LLM model pricing in a new `@agentkit/pricing` package, sourced from LiteLLM's published prices with an embedded fallback.
+
+  - Consolidates the two server-side cost tables (`@agentlensai/core` `DEFAULT_MODEL_COSTS` and the cloud `batch-writer` table) onto one source of truth — they had drifted in both units (per-1M vs per-1K) and model coverage.
+  - Fixes the cloud-ingest path, which previously returned no cost for modern model ids (e.g. `claude-opus-4-8`) because its hand-maintained table used outdated key formats.
+  - Refreshes prices live from LiteLLM at server startup (fire-and-forget, falls back to the embedded table on failure). Off-switch: `AGENTKIT_PRICING_REFRESH=false`.
+
+  `@agentlensai/core` continues to re-export `DEFAULT_MODEL_COSTS` / `lookupModelCost` and now also exports `costUsd` and `refreshFromLiteLLM` — no breaking change for existing consumers.
+
+- 18428ae: Add compliance evals on the tamper-evident audit trail (#55, Phase 1).
+
+  A deterministic compliance scorer evaluates a completed session's events against policy rules — denied tools (`tool_denylist`, supports `delete_*` wildcards), `tool_allowlist`, `max_cost`, and a `no_severity_above` ceiling — with no LLM dependency, so the result is provable and reproducible.
+
+  - New `eval_result` event type + `EvalResultPayload`. The scoring outcome is emitted server-side as a SHA-256 hash-chained event in the session's audit trail, so eval results are themselves tamper-evident evidence ("we ran the eval, here's the cryptographic proof"). It is deliberately excluded from the public ingest schema so clients cannot forge eval results.
+  - New endpoint `POST /api/eval/sessions/:sessionId/compliance` — scores a completed session against inline `rules` and records the chained `eval_result`. Strict pass/fail by default; an optional `passThreshold` switches to score-based.
+  - `compliance` scorer type registered in the default scorer registry; `ScorerConfig.rules` carries the policy rules.
+
+### Patch Changes
+
+- Updated dependencies [6a8c268]
+- Updated dependencies [18428ae]
+  - @agentlensai/core@0.14.0
+
 ## 0.14.0
 
 ### Minor Changes
diff --git a/packages/server/package.json b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agentlensai/server",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "AgentLens API server — event ingestion, querying, dashboard, and alerting for AI agents",
   "type": "module",
   "license": "MIT",

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "agentlens",`
`3`		`- "version": "0.14.0",`
	`3`	`+ "version": "0.15.0",`
`4`	`4`	`"repository": {`
`5`	`5`	`"type": "git",`
`6`	`6`	`"url": "https://github.com/agentkitai/agentlens.git"`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@agentlensai/core",`
`3`		`- "version": "0.13.0",`
	`3`	`+ "version": "0.14.0",`
`4`	`4`	`"description": "Core types, schemas, and utilities for AgentLens — AI agent observability platform",`
`5`	`5`	`"type": "module",`
`6`	`6`	`"license": "MIT",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@agentlensai/dashboard",`
`3`		`- "version": "0.13.0",`
	`3`	`+ "version": "0.13.1",`
`4`	`4`	`"description": "Web dashboard for AgentLens — visualize agent sessions, events, analytics, and alerts",`
`5`	`5`	`"type": "module",`
`6`	`6`	`"license": "MIT",`