v0.8.0

Published: 2026-10-26

Downloads for v0.8.0

filename	sha512 hash	size
mur-0.8.0-darwin-aarch64	`e881b9406ab941eba3931535185c71f0ef1e1b4f1fa7dd9e817d62a8d0a22c8712bdfd0bb1d207da527d63a5879ad25ad5008a913a3857c80b99aac52058b9a8`	12MB
mur-0.8.0-darwin-x86_64	`a6513e38a27aaf0cb0e241310f1165096152911c1334ef56ee18961078c2a712019c2a73f1e342da0683e8a072edd3d432bad405c877936c054c8222633893a1`	16MB
mur-0.8.0-linux-x86_64	`9a5f5ccb2f5eaf990d83f50921567c1ea18a1923f9310ffd28a55a439087fc653efa38b7343b910dbdce18cf0bdb4eee460349687fdfed8fc9572d0b88f29bfc`	19MB
mur-roost-0.8.0-darwin-aarch64	`71a537b53ed390d7467090952bad9723b5655e682ead6fd49296e6e6b84eb47bb7d7d14a6bfea9f4e3526bd4ed9312026535f3cf9ae6efa2cf38f73440e8cd4f`	1.3MB
mur-roost-0.8.0-darwin-x86_64	`ce6b1a37b7633b1cd566312969f8989b999e60ab39e5f419723268517147473480febfce248d22f8e91c20ca07db6f7b0e8a7c2ea067781c166e318c06e060f8`	1.4MB
mur-roost-0.8.0-linux-x86_64	`c0231e8b985269cece662f6e0d00d4cb99d3fb903e12e3a491d08b8df26c4648d6290bbc705941b2c83be65ce2c2bc1620d2dcfb73518384c2a1ae6871f5287e`	1.7MB

Changes since v0.7.0

Security

Updates tokio to 1.54.1, fixing RUSTSEC-2026-0386 (AsyncFd constructors violating I/O safety). (#342)

Features

Allowlisted shell commands in a capsule with capabilities.network.allow can verify HTTPS certificates under scoped, so curl and git no longer need a capabilities.shell.interpreter_runtime entry for /etc/ssl. mur run --explain-scope lists the trust store. (#354)
lifecycle.done_check runs a command each time the agent stops and reopens the task while it fails, up to limit reopens. The trace records whether it was met. (#353)
lifecycle.keep_working answers each turn end with your message until its limit, inference.max_turns, the spend ceiling or the deadline. Continuations show in the trace and in session-status. (#352)
mur eval run can score each case with a check command run in the work folder after the session. With --variant and --repeat, mur eval diff --run compares two manifests per case on turns, tokens and time. (#351)
Under transport: http, each inference trace line records max_output_tokens and driver_config, with credentials redacted. mur trace show lists them under Call settings. (#339)
mur run --roster --deadline <SECONDS> ends a whole formation at one moment. Sub-capsules end no later than their parent's deadline. (#337)
mur ps --json lists each formation's missing members in a top-level formations array, and says whether each ended or was gone without ending. (#335)
inference.compaction.max_tokens and inference.compaction.driver_config give compaction calls their own output cap and driver settings. A cap above the driver's ceiling is refused with E-RUN-054. A hook's capabilities.limits.deadline_seconds sets its own call deadline. (#333)
mur ps --json, mur conversation show <context-id> --json and mur trace rm <session> let tools list running capsules, read one conversation and remove an ended session's records. (#324)

Bug Fixes

A warm mur run with python3 or perl in capabilities.shell.allow no longer starts the interpreter or reads every allowlisted binary in full. What it learns is kept in ~/.murmur/host_facts/, which is safe to delete. (#359)
capabilities.containment: sealed and the /tmp mapping work on hosts where kernel.apparmor_restrict_unprivileged_userns reads 1 but user namespaces can still be created. mur doctor reports which namespaces a launch can create. (#345)
Cancelling a task no longer waits for a running shell command. mur watch prints [completed] on its own line, and a failing driver no longer leaks the gateway key into the task's status, trace or errors. (#344)
MURMUR.md states which programs a capsule's commands can start. Tools for capabilities.shell.allow binaries describe their command field accurately. (#340)
Native tools such as murmur/tool-git, and shell commands, start in capsules with a low capabilities.resources.max_open_files. A tool_call trace record carries the error when a tool could not start. (#329)
A shell command that runs past capabilities.resources.cpu_seconds is reported as such instead of a bare exit 137, and the model is told which limit stopped it. (#328)
mur run and mur doctor check for network namespaces by creating one, so capsules in Docker on AppArmor-restricted Ubuntu hosts are no longer refused with E-CAP-005. A genuine refusal names the failing call and its errno. (#323)
Under transport: http, compaction keeps the message that opened the task at the head of the context. MURMUR.md names the runtime directory in forms the capsule's tools can open. (#322)

Other

Breaking: delegate-task outcomes carry the sub-capsule's answer under result:, cut at 64 KiB, instead of naming its result file. Drop capsule instructions that tell the agent to open that file. (#358)
Breaking: Under transport: http, rate limits, provider 5xx errors and dropped connections are retried up to 6 times with backoff that honours Retry-After. Tune it in inference.retry, or set max_retries: 0 for the old behaviour. (#350)
Breaking: mur run --explain-scope and session_start report the containment a capsule's commands actually run under, not the host's strongest. The host's ceiling moves to host_containment. Declare capabilities.containment: sealed to keep sealed behaviour. (#347)
Breaking: Drivers can declare max_input_tokens per model, and compaction now measures against it and the context window less the output cap, so it fires earlier. A capsule whose inference.max_tokens or inference.compaction.max_tokens reaches its context window is refused with E-RUN-055. (#348)
Breaking: A capsule's --task runs as a task on its A2A door, so ListTasks, GetTask, SubscribeToTask and CancelTask reach it. mur run --roster without --task keeps the formation up until mur stop <frm_id>. (#346)
Breaking: mur new --roster and mur new <task> pin the newest default-artifacts versions that fit the running mur, read from the latest release index or --index <PATH|URL>. Without network access or --index they refuse. (#343)
Breaking: On Linux, a capsule whose only native-code route is capabilities.install.tool needs a delegated cgroup or is refused with E-RUN-012. Allowlisted python3 and perl read their own standard library without a capabilities.shell.interpreter_runtime entry. (#341)
Breaking: A run no longer creates anything in its work folder. Results, compaction summaries, the shell $HOME and delegated children's work folders live in the session's records directory (records_dir in mur run --json, $MURMUR_RECORDS_DIR to commands). Under --workdir, capabilities.resources.workdir_max_bytes counts the whole folder. (#338)
Breaking: mur version prints a commit line second, so scripts should read mur version --json, which gives each machine-readable command a schema number. A mur built from main reports a -dev version. (#336)
Breaking: A shell command that outruns lifecycle.shell_grace_secs returns a work id for the new background-command tool, which reports on it, waits for it or stops it. W-SEC-022 is retired. Rename any artifact of your own called background-command. (#334)
Breaking: A task's final A2A status message reads task completed or task failed (<cause>): <reason> instead of session ended. Clients should read status.state instead of the text. (#332)
Breaking: A shell tool call returns about a second after its command exits and kills background processes still holding its output. Redirect the output of a process meant to keep running (server >server.log 2>&1 &). Shell commands get /dev/null as stdin. (#331)
Breaking: Shell output cut at 16 KiB, or from a command finished in the background, is kept in the session's records directory instead of logs/ in the work folder. The tool result and the trace's output_path give its absolute path. (#325)
Breaking: Every agent capsule has a runtime-provided session-status tool reporting time, turns, context and token spend against their limits. Rename any artifact of your own called session-status. mur run --deadline <seconds> ends a session at a hard deadline, warning the agent lifecycle.deadline_notice_secs before. (#321)
Breaking: Under transport: http, compaction, inference.max_session_tokens and spend.machine_tokens_per_day use the provider's token counts, cache reads and writes included. Ceilings sized against the old counts may need raising. (#320)
Breaking: The system text and MURMUR.md state only what holds for the session. capabilities.plan.submit no longer adds planning advice, and a skill from a local source: appears in the tool list. A system prompt that relied on the removed text must say it itself. (#319)
Breaking: Shell commands, plan shell steps and native tools get a private per-session temporary folder named by TMPDIR, TMP and TEMP. On Linux, a literal /tmp reaches it where the host allows a mount namespace. Share files with the host through the work folder, not /tmp. (#318)
Breaking: inference.max_turns no longer defaults to 10, so an absent value means no turn cap. inference.max_tokens and context.max_tokens default to the limits the driver declares for the model. Set inference.max_tokens when the driver declares none. (#317)
The call-member tool's description no longer tells the model how to wait for the answer. (#349)
mur reads YAML with a maintained parser in place of a deprecated one. What parses and every error message stay the same. (#327)