Release Notes

​

v2.0.4

Released on 2026-07-07.

​

Added

Agent Core (SDK)

• Support realtime agent interruption and resumption. (#1995)

Agent Service

• Add POST /sessions/{session_id}/interrupt endpoint. (#1995)
• Support to interrupt the generation in WebUI. (#1995)
• Support team leader to invite existing agents via a new AgentInvite tool. (#1977)
• Add a session status endpoint for polling session lifecycle. (#1984)

Middleware — Long-term Memory

• Add AgenticMemoryMiddleware class, supporting Markdown-based long-term memory. (#1927)
• Add ReMeMiddleware class, supporting the AgentScope ReMe toolkit as an in-process long-term memory backend. (#1972)

RAG

• Add MilvusLiteStore class, supporting Milvus Lite as a local persistent vector store. (#1969)

TTS

• Add DashScopeCosyVoiceTTSModel class, supporting DashScope CosyVoice V3 speech synthesis in both streaming and non-streaming modes. (#1866)
• Add OpenAITTSModel class, supporting the OpenAI TTS API in both streaming and non-streaming modes. (#1878)

​

Changed

Workspace

• Add a new SandboxWorkspaceBase class, which extracts the common logic of the cloud-based workspaces and serves as a new base class for DockerWorkspace and E2BWorkspace. (#1971)

Model

• The _call_api method of ChatModel subclasses no longer needs to yield a final aggregated ChatResponse at the end. The accumulation logic is now handled automatically inside ChatModelBase.__call__. (#1995)

​

Fixed

Agent

• Agent middleware chain: kwargs omitted in next_handler() now inherit the current middleware state instead of resetting to the original chain input. (#1966)
• Fix the yielding order of the ThinkingBlockEndEvent and TextBlockStartEvent events. (#1887)

Model

• Fix the OpenAI Response API model and its formatter. (#1950)
• _sanitize_schema_for_gemini converts const: value to enum: [value], so tools with fixed-value parameters no longer fail Gemini schema validation. (#2016)
• ChatModelBase.count_tokens uses a conservative flat estimate for multimodal DataBlock inputs, avoiding huge overestimates from base64 payload length. (#1899)

Formatter

• Anthropic, Gemini, and Ollama formatters now use _json_loads_with_repair on ToolCallBlock.input, so truncated tool-call JSON degrades to {} instead of raising JSONDecodeError. (#2012)
• Gemini formatter drops empty thinking blocks before sending. (#2013)

Tool

• Built-in Grep rejects negative head_limit / tail_limit values. (#1954)

Credential

• CredentialFactory.register_credential is now idempotent, avoiding duplicate registrations under uvicorn --reload. (#1964)

Docs

• Fix mismatched docstrings in the agent, state, and tool modules. (#1989)

​

v2.0.3

Released on 2026-06-19.

​

Added

Agent Core (SDK)

• Agent.compress_context accepts an optional instructions: HintBlock argument, letting callers inject compression-specific hints without mutating the agent’s persistent context. (#1942)

Agent Service

• Expose HITL events in the team leader’s session. (#1918)
• Add an in-memory message bus for single-node deployment. (#1925)

Middleware

• Add Mem0Middleware class, supporting mem0-backed long-term memory. (#1775)
• Add BudgetControlMiddleware class, supporting token-budget enforcement in ReAct loops. (#1738)

RAG

• Add new rag module, supporting distributed, multi-tenant, and multi-session RAG service. (#1926)

Tool

• Support tool-level onion middleware in ToolBase via a new call() entry point, wrapped by __call__. (#1754)

Workspace

• Support built-in tools (Bash, Read, Write, Edit, Glob, Grep) for the e2b and docker workspaces. (#1903)

TTS

• Add DashScope CosyVoice realtime TTS model. (#1855)

Model

• Add model cards for gpt-4o, gpt-4o-mini, and gpt-4.1-nano under the OpenAI Response API. (#1750)

Embedding

• Support pass_dimensions option for OpenAI embedding models. (#1897)

Utils

• Support configurable ID factory via set_id_factory(), letting users override the default uuid4 strategy. (#1839)

WebUI

• Render Write and Edit tool diffs. (#1856)
• Add a right panel to display verbose task / permission context, MCPs, and skills. (#1945)

​

Changed

Message Bus

• Refactor and decouple the message bus from service logic. (#1923)

​

Fixed

Model

• Correct the qwen max 3.7 model id in DashScope. (#1876)
• Handle Gemini function calls without an id. (#1883)
• Add _sanitize_schema_for_gemini to strip Gemini-incompatible JSON Schema constructs from tool parameters. (#1886)

Formatter

• AnthropicChatFormatter merges parallel tool_results into a single user message. (#1894)

Agent

• Avoid shared default configs across Agent instances. (#1906)

Tool

• Merge base64 tool-response chunks by bytes instead of string concatenation. (#1901)

Middleware

• Use the configured id factory for TTS audio blocks. (#1930)

App

• Correctly convert AG-UI SSE stream events. (#1917)

Schema

• Remove max_length constraints from SummarySchema fields and raise the tool-result size limit. (#1891)

​

v2.0.2

Released on 2026-06-16.

​

Added

Agent Service & Team

• Custom subagent templates can now be registered in the agent service, so a team leader can spawn workers from user-defined templates instead of being limited to the built-in ones. (#1833)
• Custom agent classes are now accepted by the agent service, allowing users to plug their own Agent subclasses into the FastAPI runtime. (#1838)

Tool

• Bash tool now accepts a cwd argument, letting agents scope shell execution to a specific working directory instead of always running from the workspace root. (#1822)

Model & Multimodality

• Streaming audio + live captions for DashScope/OpenAI omni-modal models — audio chunks and caption events are now emitted incrementally during a single reply. (#1701)

TTS

• New tts module with a DashScope backend and a streaming middleware that turns the agent’s textual replies into spoken audio as tokens arrive. (#1832)

WebUI

• Credential sidebar is now grouped by provider, making it easier to find and manage keys across many vendors. (#1829)
• CI for WebUI: added format and build checks so frontend regressions are caught at PR time. (#1821)

​

Changed

Agent Service Infrastructure

• Embedding model layer refactored for the agent service: the legacy single-file _dashscope_embedding.py / _dashscope_multimodal_embedding.py were replaced by a new embedding/_dashscope/ package with per-model YAML cards (text-embedding-v3/v4, qwen2.5-vl-embedding, qwen3-vl-embedding, multimodal-embedding-v1, tongyi-embedding-vision-flash/plus), a new EmbeddingModelCard type, and a service-level _embedding.py endpoint. (#1852)
• Background task manager refactored to support multi-process and distributed deployment. The single-process scheduler was replaced by a message-bus based architecture (message_bus/_base.py + _redis_message_bus.py), and the cancel/wake-up dispatchers were rewritten to coordinate over the bus. (#1849)

​

Fixed

Model

• Tool-choice fallback in thinking mode: when an OpenAI-compatible structured output call rejects a forced tool_choice because thinking mode is on, the call now transparently falls back to auto instead of erroring out. (#1830)
• Qwen thinking toggle is now forwarded correctly to DashScope. (#1774)
• Ollama embedding client is created per call instead of being cached, avoiding “event loop is closed” errors when the embedding client outlives its original loop. (#1836)

Permission & Team

• Workspace MCP loader now skips invalid MCP config entries with a warning instead of aborting initialization. (#1819)
• Workspace root is included in the permission context, so path-rule evaluation correctly resolves relative paths. (#1823)
• Worker agents inherit leader permission rules: AgentCreate is now state-injected, and a worker session is constructed by deep-copying the leader’s working directories and allow/deny/ask rules. Previously workers received a blank PermissionContext, losing every user-confirmed directory and rule. (#1815)

Tool

• Glob patterns now accept Windows-style separators. (#1809)

Storage & Message Bus

• Redis session IDs: explicit session IDs are preserved instead of being overwritten with auto-generated ones. (#1786)
• Redis message bus timeout bug fixed so long-running tasks no longer drop their result messages. (#1853)

WebUI

• Fixed nested <button> HTML inside the sidebar group action. (#1769)
• Non-previewable file attachments now render properly, and media size is constrained to avoid blowing out the chat layout. (#1768)
• The chat session sidebar is now a mobile overlay drawer instead of taking up screen real estate on small viewports. (#1772)
• Added a route-level error boundary with a friendly error page. (#1828)
• Fixed a rendering bug on the chat page. (#1867)
• Corrected a typo in the Chinese setup hint copy. (#1766)

​

v2.0.1

Released on 2026-06-05.

​

Added

Agent Service & Team

• Agent Team is built into the agent service: the service is refactored so multiple subagents can be created and coordinated by a leader agent. (#1776)
• Pluggable tools and middlewares can now be passed into the service at startup via dependency injection, instead of being baked into the default toolkit. (#1709)

Permission

• Permission system overhaul: the per-tool _check_permission hooks in Edit and Write were collapsed into the shared _engine.py, and _decision.py / _types.py were expanded with a richer rule model. The change is covered by a new 895-line permission_mode_test.py exercising the default, explore, accept_edits, and ask modes end-to-end. (#1767)

Model

• Per-call client_kwargs can now be forwarded to the underlying provider client, useful for proxies, custom transports, or per-call tracing. (#1659)
• 15 new YAML model cards for mainstream providers: Anthropic (claude-opus-4-5, claude-opus-4-6, claude-sonnet-4-5), DashScope (qwen-max, qwen-max-2025-01-25, qwen-turbo, qwen-long), OpenAI Chat (gpt-4o, gpt-4o-mini, gpt-4.1-mini, gpt-4.1-nano), OpenAI Response (gpt-4.1, gpt-4.1-mini), and xAI (grok-3, grok-3-fast). (#1731)

RAG

• Basic rag module skeleton introduced — base classes only; concrete retrievers will land in later releases. (#1746)

Event

• metadata field on EventBase, allowing producers to attach arbitrary structured data that downstream consumers (tracing, hooks, middlewares) can read. (#1788)

WebUI

• Fallback model can now be configured from the Web UI, so a session automatically rolls over when the primary model is unavailable. (#1699)

Dependencies

• ripgrep is now an optional dependency so deployments that don’t need the built-in grep tool can stay leaner. (#1740)

​

Changed

Docs

• README updated to cover the new agent service feature. (#1789)

​

Fixed

Formatter & Model

• Anthropic formatter now drops thinking blocks that have no signature, preventing API rejections. (#1668)
• Retry logic unified across providers: a shared retry helper was added to anthropic / dashscope / deepseek / gemini / moonshot / ollama / openai_chat / openai_response / xai, so transient failures are now retried consistently everywhere. (#1730)
• Ollama and Gemini now honour an explicit thinking_enable=False instead of silently re-enabling thinking when the model supports it. (#1784)

Tool

• FunctionTool now accepts plain (non-ToolResponse) return values and wraps them automatically. (#1703)
• Built-in Read tool now invalidates its file cache when the underlying file is modified. (#1735)
• Bash subprocess windows are now hidden on Windows. (#1717)
• Tool-group skills are now correctly included when resolving the active toolset. (#1732)

MCP

• MCPTool names are now sanitized so providers (notably OpenAI) that reject characters like : or / accept them as tool names. (#1787)

Workspace & Storage

• LocalWorkspace adds locks around MCP and skill operations to prevent races during concurrent registration/teardown. (#1710)
• Redis message lists now have an expiry so per-session message logs are no longer kept forever. (#1734)

WebUI

• Frontend now builds cleanly with the current dependency set. (#1708)
• Button tooltip trigger uses asChild to avoid nested <button> elements. (#1770)
• Dialogs now ship with descriptions for screen reader accessibility. (#1771)
• Added missing files in the Web UI example. (#1661)

Docs

• DingTalk group QR code refreshed. (#1662)

​

v2.0.0

Released on 2026-05-25.

​

Added

Agent Core

• Permission checking inside the Agent class: large rewrite of _agent.py (+1534/-388) integrating the new permission engine, event types, exception hierarchy, and message blocks. The agent now consults the permission system on every tool call. (#1518)
• Context compression in the Agent class: a new AgentConfig exposes compression knobs, model providers gain compression entry points, and the new offload/ and storage/ base modules persist compressed history. Covered by a 564-line context_compression_test.py. (#1544)
• Tool-result compaction in the Agent class so large tool outputs are summarized before being re-fed to the model. (#1585)

Permission System

• New tool/_permission/ package providing the basic permission classes, including a 1026-LOC _engine.py, a 589-LOC _bash_parser.py that statically analyses shell pipelines, plus _context.py, _decision.py, _rule.py, and _types.py. Backed by ~1.6k LOC of unit tests. (#1486)

Tool

• Built-in tools rebuilt on ToolBase: brand-new _bash, _edit, _glob, _grep, _read, and _write implementations, plus _meta and _constants, all sharing the new tool base class. (#1502)
• Task tools added: TaskCreate, TaskGet, TaskList, and TaskUpdate (see the Plan page). (#1549)
• Tool + Workspace integration: the toolkit and the workspace module are now wired into the Agent class so file/shell tools execute inside the agent’s workspace. (#1642)

Workspace

• New workspace/ module built for 2.0, with a _base.py interface and a 789-LOC _local_workspace.py implementation. The old offload/_base.py was removed in the process. (#1586)

Service

• FastAPI-based agent service introduced as the canonical way to expose agents over HTTP. (#1568)

Middleware & Tracing

• 2.0 middleware system added to the Agent class: a 179-LOC middleware/_base.py, a new AgentConfig slot for middleware registration, and a 752-LOC test suite. (#1565)
• Tracing as a middleware: the previously bolt-on tracing logic is now packaged as a middleware under middleware/_tracing/ (extractor + converter + setup + 846-LOC test suite). (#1633)

Model

• cache_creation_input_tokens and cache_input_tokens added to ChatUsage for prompt-cache aware billing/telemetry. (#1602)
• Uniform thinking tag: standardized handling of <thinking> tags across DeepSeek, Moonshot, OpenAI Chat, OpenAI Response and xAI so downstream code no longer needs per-provider branching. (#1622)
• Audio output for OpenAI models is now handled end-to-end. (#1623)
• DashScope structured output fixed and accompanied by usage examples. (#1651)

Message & Event

• Msg type rules and constraints formalized, with a comprehensive test suite that pins down what content blocks are allowed where. (#1454)
• usage field on Msg exposes token usage at the message level. (#1639)

Scripts

• Model-call helper scripts added under scripts/model_examples/ for quick provider sanity checks. (#1604)

​

Changed

Message & Event

• Core building blocks simplified and the Msg class restructured. The legacy a2a/ package (a2a_base, file_resolver, nacos_resolver, well_known_resolver) and formatter/_a2a_formatter.py were removed; a unified event/ package (_event.py, 421 LOC) was introduced. (#1440)

Tool

• Tool module refactored with a new base class and toolkit logic; the legacy MCP client_base was dropped and tutorials updated to match. (#1493)
• Skill loader refactor: a new tool/_skill/ package (_base.py + 171-LOC _local_loader.py) replaces the inline skill logic in the toolkit, and a built-in _skill.py tool exposes skills to agents. (#1513)
• tool_choice argument refactored to expose modes (auto, none, required, etc.) as typed objects in tool/_types.py, enabling advanced prompt cache in the OpenAI Response API. Updated across every provider model. (#1524)

Model & Formatter

• Chat model implementation refactored: a new credential/ package (_base, _anthropic, _dashscope, _deepseek, _gemini, _kimi, _ollama, _openai, _xai) decouples API keys/auth from the chat model classes, and every provider’s formatter was rewritten on top of it. (#1564)
• DashScope made OpenAI-compatible: the DashScope model now reuses the OpenAI chat client path instead of carrying its own response parser. (#1617)
• kimi renamed to moonshot to match the provider’s branding. (#1609)

MCP

• Unified MCPClient class (_mcp_client.py, 347 LOC) replaces the previous family of stateful, stateless, stdio, SSE, and streamable-HTTP clients. A small _config.py holds connection configs. (#1572)
• MCP tools are renamed when registered into the toolkit, ensuring no collisions across servers. (#1552)
• MCP unit tests refactored for the new version. (#1505)

Tracing

• Tracing module moved under middleware/_tracing/: the single 360-line _extractor.py was split into _trace.py, _converter.py, and a slimmer _extractor.py, and registration was simplified. (#1579)

Workspace

• e2b and Docker workspaces added alongside the local workspace, each with its own manager. The release also ships a full WebUI scaffold under examples/web_ui/. (#1650)

Project

• Temporary deprecations: evaluate, module, rag, tts, and realtime modules are removed pending refactor; the corresponding examples (a2a/a2ui agents, etc.) are deleted from the tree. (#1438)

Docs

• README and tutorials updated for the 2.0 release. (#1657)

​

Fixed

Model

• DashScope KeyError when the response payload omits an expected field. (#1615)
• _format_tools refined for the OpenAI response model. (#1635)

Formatter

• Formatters and unit tests refined across providers. (#1621)
• Moonshot: remote image URLs are now downloaded and re-uploaded as base64 since the API does not accept URL references. (#1653)

MCP

• $defs preserved in MCPTool input schemas and title keys stripped recursively, fixing schema validation with strict LLM providers. (#1595)

Tool

• .env bypass closed: Write, Edit, and Bash no longer let agents read or modify .env (or other dangerous paths) through canonical-path tricks; the dangerous-path API was refined accordingly. (#1656)

Scripts

• Helper scripts now assign a list of TextBlock to content instead of a raw string. (#1629)