MiroShark logoMiroShark
Changelog · 15 entries

What shipped

A running log of all MiroShark changes by week: features, bug fixes, i18n, and tooling shipped since launch, with linked commits.

2 PRs

PyTorch + setuptools security patches

Two Dependabot alerts cleared: PyTorch bumped to 2.13.0 to patch a memory corruption CVE (GHSA-rrmf-rvhw-rf47), and setuptools bumped to 83.0.0 to close a second open alert. Both are lockfile-only changes — no manifest edits, no behavior changes.

  • PyTorch 2.12.1 → 2.13.0: patches GHSA-rrmf-rvhw-rf47 (memory corruption, vulnerable ≤ 2.12.1); lockfile-only. (#257)
  • setuptools 81.0.0 → 83.0.0: closes open Dependabot alert (vulnerable range < 83.0.0); lockfile-only. (#258)
#257#258

3 PRs

Two CVE patches + dead code sweep

Two security CVEs patched: shell-quote's quadratic-complexity DoS (CVE-2026-13311, CVSS 7.5) required a scoped package.json override because concurrently pins the dependency exactly, and mcp was bumped to close a WebSocket host/origin validation gap (CVE-2026-59950). A 53-file dead code pass removed 1,325 net lines across 8 audited dimensions with no behavior changes.

  • shell-quote patched for CVE-2026-13311 (CVSS 7.5 DoS); scoped override required — concurrently pins the dep exactly. (#256)
  • mcp bumped 1.27.2 → 1.28.1, closing CVE-2026-59950 (WebSocket host/origin validation gap, not locally exploitable). (#255)
  • Dead code sweep: 53 files, −1,325 net lines removed across 8 independently audited dimensions. (#254)
#256#255#254

6 PRs

Docs badge across all locales + badge copy polish

All four README locales (EN, FR, JA, ZH) now carry a Docs badge linking to miroshark.xyz/docs. Badge copy was tightened in the same pass: the Documentation label shortens to Docs, the X badge drops 'Follow', and Bankr reads '$miroshark on Bankr'.

  • Docs badge added to EN, FR, JA, and ZH READMEs, linking to miroshark.xyz/docs. (#252)
  • Badge copy tightened: Documentation → Docs; X badge drops 'Follow'; Bankr reads '$miroshark on Bankr'. (#253)
  • Maintenance: 4 dependency/CI bumps (mcp 1.24→1.27, setup-node 6→7, setup-python 6→7, Vue/Vite frontend group). (#248, #249, #250, #251)
#252#253

3 PRs

GitHub org migration + frontend security patches

MiroShark's repo transferred to the MiroShark org — all in-repo links, User-Agent strings, and deploy buttons now point to the canonical slug. DOMPurify, marked, and vite received frontend patches in the same window.

  • All GitHub links migrated to MiroShark org: 25 refs across 14 files updated, two stale ecosystem slugs fixed. (#247)
  • Frontend security patch: DOMPurify 3.4.12 (XSS-protection hook fix), marked, and vite bumped. (#245)
  • Maintenance: 1 dependency bump (transformers 5.3.0 → 5.5.0, Python backend). (#246)
#247

1 PRs

Python backend dependency maintenance

Dependabot bumped soupsieve from 2.8 to 2.8.4 in the Python backend, patching an inefficient attribute pattern. No simulation behavior changes.

  • Maintenance: 1 dependency bump (soupsieve 2.8 → 2.8.4, attribute pattern efficiency fix) (#244)

3 PRs

French coverage at 87%, social agent fixes

Zarbel974 pushed French UI coverage from 74% to 86.9% across 20 components, adding ~340 translation pairs including dense panels like EmbedDialog and WhatIfPanel. dan-and addressed empty-response failures in persona handling — the social agent now handles edge cases that caused blank agent outputs mid-simulation.

  • French translations completed to 86.9% (1723/1984 tr() calls), up from 74%; 20 components, ~340 new pairs (#239)
  • Social agent: empty response handling in persona tool messages fixed — reduces silent failures mid-run (#241)
  • RootAI ecosystem profile image updated to current Twitter avatar in ECOSYSTEM.md (#242)
#239#241#242

10 PRs

French i18n, CVE sweep, multi-model compatibility

External contributor Zarbel974 landed French translations for ~1,627 UI strings across all Vue components, the largest single i18n contribution since DE. A CVE sweep closed vulnerabilities in werkzeug, requests, starlette, cryptography, pyjwt, and pytest; the social agent message filter was fixed to preserve tool_calls, restoring compatibility with Gemini, Azure, and GPT-5.4.

  • French frontend translations from Zarbel974 — ~1,627 tr() calls across all Vue components (~74% coverage) (#222)
  • Social agent now preserves tool_calls when filtering empty LLM messages; fixes Gemini, Azure, and GPT-5.4 compatibility (#232)
  • Nemotron datasets now persist across container recreates; bind-mount added to all three compose files (#238)
  • CVE sweep (patch/minor): werkzeug CVE-2026-21860/-27199, requests CVE-2026-25645, and 8 other packages (#229)
  • Major CVE fixes behind camel-ai MCP: starlette 1.x, cryptography 49.x, pyjwt 2.13 (#230)
  • pytest bumped to 9.1.1 + pytest-asyncio 1.4.0, closing CVE-2025-71176 (#231)
  • SECURITY.md + CONTRIBUTING.md added; community health files consolidated under .github/ (#235)
  • FUNDING.yml added: Sponsor button wired to miroshark.xyz, Bankr, DexScreener, BaseScan (#237)
  • LICENSE moved back to repo root so GitHub license detection works (#236)
  • Maintenance: 1 dependency bump (uv group, 6 packages) (#233)
#222#229#230#231#232#235#236#237

2 PRs

New default models across all agent slots

The default model lineup is replaced: base agent work moves to inception/mercury-2:nitro, smart reasoning and NER to google/gemini-3-flash-preview, Wonderwall to deepseek/deepseek-v4-flash:nitro, and web search to deepseek/deepseek-v4-flash:online. Fresh installs pick these up automatically; existing deployments can override per-slot via env.

  • Default models rotated across all slots: base → mercury-2:nitro, smart/NER → gemini-3-flash-preview, Wonderwall → deepseek-v4-flash:nitro, web search → deepseek-v4-flash:online (#223)
  • Maintenance: 1 dependency bump (vite 8.1.3) (#225)
#223

4 PRs

Docker, Actions, and frontend dependency bumps

Four maintenance bumps cleared the queue: the frontend locked in axios 1.18.1 (HTTP adapter fixes), vue, and vite; GitHub Actions moved to actions/checkout v7 and Node 24-based docker/login-action v4 and docker/setup-buildx-action v4.

  • Maintenance: 4 dependency/CI bumps (axios 1.18.1, vue, vite, actions/checkout 7, docker/login-action 4, docker/setup-buildx-action 4) (#218–#221)

5 PRs

Stop subcommand, interview hang fixes, locale hardening

The CLI now has a stop subcommand to cancel running simulations, completing the cost/wait/stop scriptable pipeline. dan-and contributed three engine fixes in the same batch: persona interviews no longer hang silently on slow or thinking models, non-English locale no longer drifts mid-run, and local LLM config tuning prevents JSON truncation and timeout failures.

  • stop subcommand added: cancels a running simulation, exits 0 on success or 1 on error (#216)
  • Non-English locale now held across per-round agent actions and report sections, not just at session start (#213)
  • Persona and batch interviews no longer hang on slow/thinking models; errors surface with a message instead of dying silently (#214)
  • Local LLM tuning: AGENTS_PER_BATCH halved to 7, summary lengths raised to 500 for richer context, name-based agent matching added (#212)
  • --json flag placement clarified in stop CLI docs: must precede the subcommand, not trail it (#217)
#217#216#214#213#212

1 PRs

Wait subcommand: block until simulation finishes

The CLI can now block on a running simulation and exit with a machine-readable code: 0 for completed, 1 for failed/stopped, 2 for timeout. Progress lines print to stderr so stdout stays clean for --json piping, making wait → cost → report pipelines scriptable without polling.

  • wait subcommand added to CLI: polls run-status until terminal state, exits 0/1/2, progress to stderr (#215)
#215

4 PRs

Thinking model robustness, JSON repair, and cost CLI

The LLM pipeline got a hardening pass from external contributor dan-and: thinking-model budget, <think> block stripping, and JSON repair so truncated or malformed reasoning output no longer silently breaks runs. The cost CLI subcommand also shipped, letting scripts read per-run spend with `python cli.py cost <id>` without touching the API.

  • Thinking model robustness: budget param, <think> stripping, JSON/control-char repair, None guards on empty content (#209)
  • Cost subcommand added to CLI: `python cli.py cost <id>` prints per-run USD estimate by phase (#208)
  • Config guard: blank LLM_MODEL_NAME= now falls back to mimo-v2.5 instead of sending an empty model string (#210)
  • Graph search fan-out restored: semantic default queries re-added after #209 narrowed the fallback to one query (#211)
#211#210#209#208

7 PRs

Model fix, rebrand, and code audit

The default model (mimo-v2-flash) was delisted by OpenRouter and is replaced with mimo-v2.5 across config, deploy templates, presets, and docs - fresh installs no longer 404. The project adopted a new tagline and a targeted 8-agent code audit removed dead classes and unused health-check stubs from the backend and frontend.

  • Default model swapped from mimo-v2-flash to mimo-v2.5 across config, presets, docs, and deploy templates (#207)
  • New tagline: "Simulate anything, for $1 & less than 10 min." + OpenRouter attribution updated to miroshark.xyz (#206)
  • Targeted 8-agent code audit removed dead classes and health-check stubs; backend and frontend trimmed (#205)
  • Maintenance: 4 dependency/CI bumps (actions/setup-node 6, docker/metadata-action 6, docker/setup-qemu-action 4, dompurify 3.4.11)
#207#206#205

28 PRs

Full DE/FR locales + engine hardening

MiroShark now runs fully in German and French - all agent prompts, persona grounding, and reports, not just UI chrome. The $1 cost claim lands as a visible pill on every public embed, a camel-ai 0.2.90 break was caught and patched the same day it merged, and a locale-threading bug in the fallback interview path is closed.

  • Locale state threaded through ThreadPoolExecutor in graph_tools fallback interview (#198)
  • CLAUDE.md added - agent-readable codebase map for Claude Code contributors (#197)
  • Camel smoke test now asserts non-empty message content, not just a non-None response (#196)
  • Report agent wired to locale registry so reports generate in the session language (#194)
  • suggest_scenarios JSON salvaged from truncated LLM responses via json_repair; no more zero-result returns (#192)
  • Cost pill (~$X) rendered on public embed view, making the $1-per-sim claim visible to visitors (#190)
  • German added to frontend UI and all agent-communication locales; locale reinforcement across DE/FR/ZH/EN (#189)
  • suggest_scenarios timeout raised 20s→40s, max_tokens 700→1500 for verbose languages and slow local LLMs (#188)
  • French prompt locale fully translated - all 7 modules filled (was empty stubs after #184) + CI coverage gate (#186)
  • French README and language-switcher entry added; FR now fully discoverable (#185)
  • Locale helpers generalized to EN/ZH/DE/FR; 199 existing call sites unchanged (#184)
  • total_actions corrected from hardcoded 0 on every successful run; first camel agent smoke test added (#183)
  • uv.lock synced to camel-ai 0.2.90, unblocking Docker builds that refused to proceed (#182)
  • camel-ai 0.2.90 agent loop break patched the same day the bump merged (#181)
  • Frontend now builds on every PR - was tag-triggered only, so breaks reached release undetected (#180)
  • Per-sim cost.json endpoint: queryable USD cost breakdown by model and phase, flagged is_estimate (#179)
  • SearXNG + Firecrawl support: self-hosted web search and scraping for local-LLM deployments (#178)
  • Maintenance: 11 dependency/CI bumps (Dependabot wave - vite, vue-router, camel-ai, python, Actions)
#198#197#196#194#192#190#189#188

6 PRs

Contributor on-ramp + same-origin API

Earlier in the same window: the contributor guide grew from a test-only stub into a full guide, two rounds of code-quality cleanup landed, same-origin API calls plus a Neo4j 5.26 bump went in, and flaky demographic-grounding tests were fixed.

  • Same-origin API calls now supported; Neo4j bumped to 5.26 for better indexing. (#159)
  • Expanded CONTRIBUTING from a test-only stub to a full contributor guide. (#162)
  • Round-2 code-quality cleanup: DRY helpers, type fixes, dead-import removal, error handling. (#163)
  • Deduped shared helpers (utc_iso8601, avg_position, public-base-url) and fixed a transcript bool bug. (#164)
  • Fixed two demographic-grounding tests that failed without an LLM_API_KEY. (#165)
  • Maintenance: concurrently bumped 9.2.1 → 10.0.3. (#167)
#159#162#163#164#165
Run one.

Everything here came from one sim at a time.

Drop your scenario in - $1, under ten minutes, hundreds of agents.

Run your first simRead the docs