Release Notes

​

v2.0.7

Released on 2026-08-24.

​

Added

Console

• Add the agentscope.console module for driving an agent from the terminal. ConsoleRenderer consumes Agent.reply_stream and renders it — live text and thinking deltas, concurrently streamed tool calls buffered and printed as whole blocks so they never interleave, hint blocks, per-call token usage, and the permission rules suggested on a confirmation request — at three verbosity levels (quiet / default / debug), skipping unknown event types so it keeps working as the event protocol evolves. launch_console(agent) wraps it in a zero-code interactive loop with tool-call confirmation (y / N / always) and tiered Ctrl+C handling. rich becomes a core dependency. (#2297)

Workspace

• Isolate MCP client sessions per agent, so several agents can share one workspace without sharing stateful MCP clients. list_mcps() / add_mcp() / remove_mcp() take an agent_id, a workspace’s MCP storage becomes {agent_id: [clients]}, and each agent’s clients are cloned from default_mcps and connected on first access. The directory, skills, and offload storage stay shared, and the old .mcp file format is migrated automatically. (#1951)
• Isolate skills per agent, and select them per session. skills/ gains a directory level per agent, seeded from skill_paths on that agent’s first skill call, so an agent editing its own skill no longer changes anyone else’s behaviour and no longer pays context tokens for skills it does not use. agent_id is keyword-only; a caller that names none gets the default partition. (#2283)
• Add WorkspacePrewarmMixin and PrewarmConfig, which keep a small buffer of workspaces built ahead of demand so a session is handed one that is already running instead of waiting out an image pull and a sandbox bootstrap. A request arriving mid-build waits out the build already in flight rather than starting a second one, and max_creating caps concurrent builds so a burst of sessions queues instead of stampeding the provider. Wired into the Docker and E2B managers; size: 0 (the default) disables it. (#1755)

Agent

• An on_reply middleware can now veto the end of a reply: receiving ReplyEndEvent without yielding it forces another reasoning-acting round inside the same reply — same reply_id, no extra ReplyStartEvent, max_iters still applies — which is what task-constraint enforcement and late-arriving inbox messages need. A busy-loop guard raises when the event is swallowed repeatedly with no reasoning or acting in between. (#2322)
• Add max_image_num to ContextConfig, bounding the number of images kept in the context. compress_context enforces it before token counting; the oldest images over the limit are offloaded through offloader.offload_data_block and replaced by a hint recording the path, or dropped and replaced by the same hint when no offloader is configured. Defaults to None, i.e. no limit. (#2362)

Agent Team

• Add TeamMemberLoopMiddleware, which requires a team member to end its reply by reporting to the leader with TeamSay, and guides it to ask the leader for permission to continue when it runs out of iterations. A member that keeps ending without reporting is nudged at most max_nudges times, after which the reply is released as an error rather than looping under the session lock. (#2379)
• Tell the leader when a member’s turn ends as ERROR or INTERRUPTED without reporting. Such a turn previously left the leader waiting for an answer that was never coming; it now receives a hint block naming the member and the reason, delivered the same way TeamSay delivers a report. (#2386)

Tool

• FunctionTool accepts an input_schema argument — a JSON schema dict, or a pydantic BaseModel subclass converted through model_json_schema() — which takes over the schema instead of extracting it from the function’s annotations and docstring. This covers tool definitions migrated from other frameworks and functions whose signature cannot carry annotations, and aligns FunctionTool with MCPTool, which already passes an external inputSchema through. (#2378)
• The Read tool dispatches by file extension instead of decoding everything as UTF-8: images, audio, and video come back as base64 DataBlocks, and PDFs as extracted text per page selected with a new pages argument. Text files are unchanged. (#2114)

Channel

• Add DingTalkChannel, which puts the agents of the agent service on DingTalk. It takes inbound robot and card callbacks over the official Stream SDK and sends everything outbound over the OpenAPI, so only a Client ID and Client Secret are configured. Direct and group messages are both supported, with optional mention filtering through only_at_reply; the agent is handed ListConversations, ListUsers, SendMessage, SendFile, and SendImage. Streaming replies and tool approval render as interactive cards, both preset to DingTalk’s public templates so neither needs a Card Platform template of your own — set streaming_card_template_id or approval_card_template_id to use your own instead. (#2285, #2409)
• Hold the channels’ long connections in a dedicated worker, enabled with enable_channel_worker. A platform hands one bot’s events to one connection, so every replica connecting meant wasted connections on Feishu, DingTalk, and Slack and duplicated messages on Discord. Connection-bound state is now separated from the rest: ChannelClients builds a channel from its record without calling start_listening, so any process can send a reply, list chats, and attach the channel’s platform tools. Cached instances are rebuilt when the record changes, so a credential rotation takes effect without a restart. (#2390)
• Support channel records on SQL storage, which previously inherited NotImplementedError and left any non-Redis deployment — the desktop build included — without channels at all. Adds the channels table with UNIQUE(platform_bot_id) in place of the Redis bot-index key, and Alembic revision 0003_channels. (#2388)

RAG

• Add VectorStoreBase.list_chunks(), returning one document’s chunks ordered by chunk_index, implemented across all four vector stores. On top of it the agent service gains chunk browsing, a raw-document preview served from the blob store the upload already wrote, and a knowledge-base listing carrying the full configuration, together with the web UI for all three. (#2372)
• Chunkers declare their tunable parameters through a pydantic Parameters inner class, the same way model cards and RAG middleware already do, replacing the hand-written JSON schema dicts; the web UI renders them through the shared SchemaForm. (#2083)

WebUI

• Show an alert on the chat page when a reply ends by exceeding the maximum number of iterations. (#2381)

​

Changed

Channel

• A reply is delivered by the node that produced it, instead of being queued for the node holding the inbound connection to drain, claim, re-subscribe to, and forward. Sending is plain REST against the stored credentials, so the round-trip #2390 made unnecessary — enqueue_channel_output, the channel:outbound queue and its wake signal, the forward lease, and the dispatcher’s drain and forward paths — is removed. Two defects go with it: a 60-second timeout that truncated any reply whose run took longer than a minute, and a drained job silently dropped when the draining node did not host that channel. (#2395)

Agent

• Deprecate ExceedMaxItersEvent. It is still emitted for backward compatibility but carries no semantics; the exit reason lives in ReplyEndEvent.finished_reason == EXCEED_MAX_ITERS. (#2322)

RAG

• Choosing a chunker is mandatory when creating a knowledge base, mirroring embedding-model selection, and the implicit default_chunker fallback chain is removed. (#2083)

Model

• Anthropic, DeepSeek, DashScope, and Moonshot disable thinking for structured-output calls, since those providers reject a forced tool_choice while thinking is active — which was making generate_structured_output and compress_context fail intermittently. _compress_context_impl also gains a truncation fallback: if summary generation still fails after every retry, older messages are discarded instead of raising, so the agent keeps running with a reduced context. (#2140)

​

Fixed

Agent Service

• Bind a real workspace to a scheduled session. The session was persisted with workspace_id="", which every workspace manager treated as a literal cache key rather than “unbound”, so every scheduled session in a deployment — across all users and all agents — resolved to the same workspace: the same sandbox, files, .mcp config, and installed skills. (#2410)
• Stop stranding session inbox payloads until the next user turn. A scheduled prompt, a team message, a new worker’s first task, or a background tool result could sit unconsumed because producers inferred from the run lock whether a live run would drain it, and a run holding the lock while it unwinds has already drained for the last time. A run now registers as its inbox’s consumer, and the hand-off is made explicit under a short lock, so a wake-up is produced exactly when nobody is registered — never dropping a payload, never spawning an empty turn. (#2295)
• Load the session state, assemble the agent, and check the parked state inside the distributed session lock, so a waiting run no longer reads and re-persists state left over from the run before it. (#2232)

Tool

• Bash picks the shell from the backend’s OS instead of the host’s, so a Windows host driving a Linux sandbox no longer sends cmd /c into the container. (#2366)
• Resolve PEP 563 lazy annotations when extracting a tool schema, so a module using from __future__ import annotations no longer yields string-typed parameters. (#2371)

MCP

• A stateful client can reconnect: close() clears the exhausted single-use transport and the next connect() builds a new one, instead of reusing the spent one and failing. (#2308)

RAG

• Qdrant and Milvus write chunks under deterministic ids, so an index-worker retry after a mid-pipeline crash overwrites the partial ingest instead of leaving two copies of every chunk. (#2372)

Agent

• Keep prompt-cache tokens in the reported usage. (#2318)

​

v2.0.6

Released on 2026-08-07.

​

Added

Channel

• Add the channel module, which connects the agents in the agent service to IM platforms. ChannelBase abstracts a platform, with FeishuChannel and DiscordChannel as the built-in implementations; ChannelGateway orchestrates each inbound event, ChannelTypeRegistry publishes every platform’s credential schema, and ChannelLifecycleDispatcher reconciles the live instances of a node with storage. The new /channels/* endpoints cover creation, enabling and disabling, status, chat ids, and routing rules. (#1997)

Workspace

• Add AppleContainerWorkspace, AppleContainerBackend, and AppleContainerWorkspaceManager classes, supporting Apple’s container CLI as a workspace backend (macOS 26+ on Apple silicon). (#2068)
• Add WorkspaceBase.add_skill_archive() method, which unpacks an uploaded skill archive into the workspace and registers the skill inside it. (#2197)

Middleware

• Add the on_check_permission hook to MiddlewareBase, which intercepts the permission check of a single tool call after its input has been parsed and validated. The middleware can delegate with next_handler(**input_kwargs), replace the returned PermissionDecision, or decide without delegating at all. (#2001)

Message

• Content blocks carry created_at and finished_at timestamps, so consumers can tell when each block started and finished streaming. (#2171)

Tool

• Add scandir(), stat(), read_stream(), and write_stream() methods and the DirEntry data class to the workspace backend classes, so a workspace file system can be listed and streamed through a uniform interface. (#2187)

Agent Service

• Support installing MCP servers and skills from hubs: the MCPHubBase / GitHubMCPHub and SkillHubBase / ClawSkillHub classes browse external registries through the /hub/mcp/* and /hub/skill/* endpoints, installing a card writes it into the user’s library (/mcp, /skill), and a session then loads it via /workspace/mcp/from-library or /workspace/skill/from-library. (#2197)
• Add GET /workspace/directories and GET /workspace/files endpoints for browsing the session workspace, with POST /workspace/files/download-token issuing a short-lived token for the download. (#2187)
• Add GET /workspace/status endpoint, which returns the session working directory together with its git status. (#2257)
• Add GET /health endpoint, which reports per-component readiness by inspecting the application state only, so probing it never touches the storage or a workspace backend. (#2237)
• Add GET /embedding-model/ endpoint, which lists every embedding model available under a credential type. (#2234)

Model

• Refresh the model cards of every API: add cards for Claude Opus 5 / Sonnet 5 / Fable 5, GPT-5.6 (luna, sol, terra), Gemini 3.5 / 3.6 Flash and the Flash-Lite line, Kimi K2.7 Code, Qwen3.8-Max and the Qwen Flash line, and Grok 4.5 / 4.20 / Build 0.1, and update the pricing and context windows of the existing cards. (#2240)

WebUI

• Show the session working directory and its git status on the chat page. (#2257)

​

Changed

Agent Service

• The extra_agent_middlewares factory of create_app() receives a fourth argument, the session’s resolved workspace, so filesystem-backed middleware such as AgenticMemoryMiddleware can be attached per session. Factories written against the previous three-argument signature keep working. (#2263)

Model

• The OpenAI-compatible chat models reuse one openai.AsyncClient across calls instead of creating a new client for each call. (#2063)
• Stream accumulation joins the collected fragments in a single pass, replacing the O(n²) string concatenation. (#2158)

WebUI

• Rebuild the chat pages on shadcn/ui components. (#2171)
• Unify the styling of the sidebar, the panels, and the form controls. (#2234)

Docs

• Revamp the README with SDK and agent-service feature tables. (#2262)
• Update README_zh.md. (#2182)

​

Fixed

Agent

• Count a reasoning-acting round only once: a round whose tool calls are parked on a user confirmation or an external execution no longer consumes an iteration before its results arrive. (#2217)
• Do not emit a second ToolResultStartEvent for an external tool call that is already awaiting its result. (#2167)

Tool

• ToolResponse keeps the ERROR state while accumulating chunks, instead of downgrading it to INTERRUPTED or DENIED. (#2178)
• An MCP server whose tool listing fails is skipped with a warning, so one unreachable server withdraws its own tools instead of ending the reply. (#2197)

Model

• ChatResponse.finished_reason preserves the reason it was constructed with, so an interrupted response no longer reports COMPLETED. (#2209)

Tracing

• Avoid the OpenTelemetry context detach error when a streaming span is closed from a different task. (#2077)

Agent Service

• Scope the Claw skill hub card ids by owner, so skills sharing a name across owners no longer collide. (#2214)

WebUI

• Reset the confirmation state between pending tool calls. (#2243)
• Fix the localization of the channel form fields. (#2261)

​

v2.0.5

Released on 2026-07-23.

​

Added

Agent Core (SDK)

• Support structured output via the structured_schema argument of Agent.reply() and Agent.reply_stream(). The agent generates the result through a built-in structured-output tool, and the validated dict is carried on the final message’s structured_output attribute. (#2150)
• Support runtime state injection: the current time, plan task counts, and context usage are injected into the context as a HintBlock before each reasoning step, configured by the new injection_config argument and InjectionConfig class. (#2134)

Workspace

• Add OpenSandboxWorkspace, OpenSandboxBackend, and OpenSandboxWorkspaceManager classes, supporting OpenSandbox as a workspace backend. (#1953)
• Add DaytonaWorkspace, DaytonaBackend, and DaytonaWorkspaceManager classes, supporting Daytona sandboxes. (#1943)
• Add K8sWorkspace, K8sBackend, and K8sWorkspaceManager classes, supporting Kubernetes Pod/PVC lifecycle management, a tar-stream file backend, and the MCP gateway. (#1933)
• Add BubblewrapWorkspace, BubblewrapBackend, and BubblewrapWorkspaceManager classes, supporting lightweight local sandboxing on Linux via bubblewrap. (#2051)

Tool

• Add the built-in PowerShell tool, so agents can execute shell commands in Windows workspaces. (#2132)

RAG

• Add MongoDBStore class, supporting MongoDB Atlas Vector Search as a vector store. (#2008)
• Add ElasticsearchStore class, supporting Elasticsearch as a vector store. (#2129)
• Add WordParser and ExcelParser classes, supporting Word and Excel documents as knowledge sources. (#2025, #2026)

Agent Service

• Add AsyncSQLAlchemyStorage class, supporting any SQLAlchemy-compatible database as the storage backend, with Alembic migrations included. (#2029)
• Support sharing credentials, agents, and knowledge bases across users at the group or organization level, backed by a new resource access policy layer. (#1998)
• Surface reply errors to the frontend instead of failing silently. (#2133)

Model

• Support the Kimi K3 model in the MoonshotChatModel class. (#2141)
• Add qwen3.7-plus, deepseek-v4-pro, and glm-5.2 model cards for the DashScopeChatModel class. (#2073)

TTS

• Add GeminiTTSModel class, supporting the Gemini TTS API. (#1879)

WebUI

• Add a scroll-to-bottom button to the chat page. (#2106)

​

Changed

Prompt

• Refine the built-in instructions for the workspace, context compression, and the TaskCreate tool. The workspace prompt assembly is extracted into shared helpers so every workspace backend produces a consistent description. (#2111)

WebUI

• Refactor the text input component. (#2102)
• Refactor tool call rendering. (#2072)

Dependencies

• Reorganize the optional dependency groups in pyproject.toml, so each feature (RAG backends, workspaces, TTS, long-term memory) can be installed on its own. (#2157)
• Restrict the mcp dependency to versions below 2.0.0. (#2091)

​

Fixed

Agent

• Continue the reasoning-acting loop when the model returns a thinking-only response, instead of ending the reply. (#2120)
• Preserve paired tool calls and tool results during context compression when a single reasoning step issues multiple tool calls. (#2093)

Permission

• Unify the per-mode evaluation logic in the permission engine, and propagate batch confirmation exemptions to the subsequent tool calls. (#2117)

Model

• The OpenAI chat model sends max_completion_tokens instead of the deprecated max_tokens. (#2065)
• Preserve the reasoning history when replaying a conversation through the OpenAI Responses API. (#2071)

Formatter

• Preserve redacted_thinking blocks in the Anthropic message round-trip. (#2139)
• Drop empty text blocks for Anthropic, which rejects them. (#2007)
• Include tool_name in Ollama tool result messages. (#2006)
• Strip null types from Gemini tool schemas. (#2020)

Tool

• Built-in Bash no longer classifies mutating find commands (e.g. -delete, -exec) as read-only. (#2004)

Skill

• Expand user-home (~) paths when loading skill directories. (#2053)

Workspace

• Fix the OpenSandbox bootstrap process and its state filtering. (#2046)
• Restore the default path of the glob helper. (#2056)

RAG

• Adapt MilvusLiteStore to the COSINE distance semantics of milvus-lite 3.1.0. (#2089)

Agent Service

• Use cursor-based pagination in list_messages, so concurrent writes no longer shift the page boundaries. (#2081)

WebUI

• Fix rendering errors in the Read / Write / Edit tool calls caused by incomplete JSON during streaming or interruption. (#2075)
• Scroll newly loaded sessions to the bottom. (#2100)

Docs

• Fix docstring formatting errors in the tool module. (#2127)
• Use a separate LLM instance in the mem0 example. (#2078)

​

v2.0.4

Released on 2026-07-07.

​

Added

Agent Core (SDK)

• Support realtime agent interruption and resumption. (#1995)

Agent Service

• Add POST /sessions/{session_id}/interrupt endpoint. (#1995)
• Support to interrupt the generation in WebUI. (#1995)
• Support team leader to invite existing agents via a new AgentInvite tool. (#1977)
• Add a session status endpoint for polling session lifecycle. (#1984)

Middleware — Long-term Memory

• Add AgenticMemoryMiddleware class, supporting Markdown-based long-term memory. (#1927)
• Add ReMeMiddleware class, supporting the AgentScope ReMe toolkit as an in-process long-term memory backend. (#1972)

RAG

• Add MilvusLiteStore class, supporting Milvus Lite as a local persistent vector store. (#1969)

TTS

• Add DashScopeCosyVoiceTTSModel class, supporting DashScope CosyVoice V3 speech synthesis in both streaming and non-streaming modes. (#1866)
• Add OpenAITTSModel class, supporting the OpenAI TTS API in both streaming and non-streaming modes. (#1878)

​

Changed

Workspace

• Add a new SandboxWorkspaceBase class, which extracts the common logic of the cloud-based workspaces and serves as a new base class for DockerWorkspace and E2BWorkspace. (#1971)

Model

• The _call_api method of ChatModel subclasses no longer needs to yield a final aggregated ChatResponse at the end. The accumulation logic is now handled automatically inside ChatModelBase.__call__. (#1995)

​

Fixed

Agent

• Agent middleware chain: kwargs omitted in next_handler() now inherit the current middleware state instead of resetting to the original chain input. (#1966)
• Fix the yielding order of the ThinkingBlockEndEvent and TextBlockStartEvent events. (#1887)

Model

• Fix the OpenAI Response API model and its formatter. (#1950)
• _sanitize_schema_for_gemini converts const: value to enum: [value], so tools with fixed-value parameters no longer fail Gemini schema validation. (#2016)
• ChatModelBase.count_tokens uses a conservative flat estimate for multimodal DataBlock inputs, avoiding huge overestimates from base64 payload length. (#1899)

Formatter

• Anthropic, Gemini, and Ollama formatters now use _json_loads_with_repair on ToolCallBlock.input, so truncated tool-call JSON degrades to {} instead of raising JSONDecodeError. (#2012)
• Gemini formatter drops empty thinking blocks before sending. (#2013)

Tool

• Built-in Grep rejects negative head_limit / tail_limit values. (#1954)

Credential

• CredentialFactory.register_credential is now idempotent, avoiding duplicate registrations under uvicorn --reload. (#1964)

Docs

• Fix mismatched docstrings in the agent, state, and tool modules. (#1989)

​

v2.0.3

Released on 2026-06-19.

​

Added

Agent Core (SDK)

• Agent.compress_context accepts an optional instructions: HintBlock argument, letting callers inject compression-specific hints without mutating the agent’s persistent context. (#1942)

Agent Service

• Expose HITL events in the team leader’s session. (#1918)
• Add an in-memory message bus for single-node deployment. (#1925)

Middleware

• Add Mem0Middleware class, supporting mem0-backed long-term memory. (#1775)
• Add BudgetControlMiddleware class, supporting token-budget enforcement in ReAct loops. (#1738)

RAG

• Add new rag module, supporting distributed, multi-tenant, and multi-session RAG service. (#1926)

Tool

• Support tool-level onion middleware in ToolBase via a new call() entry point, wrapped by __call__. (#1754)

Workspace

• Support built-in tools (Bash, Read, Write, Edit, Glob, Grep) for the e2b and docker workspaces. (#1903)

TTS

• Add DashScope CosyVoice realtime TTS model. (#1855)

Model

• Add model cards for gpt-4o, gpt-4o-mini, and gpt-4.1-nano under the OpenAI Response API. (#1750)

Embedding

• Support pass_dimensions option for OpenAI embedding models. (#1897)

Utils

• Support configurable ID factory via set_id_factory(), letting users override the default uuid4 strategy. (#1839)

WebUI

• Render Write and Edit tool diffs. (#1856)
• Add a right panel to display verbose task / permission context, MCPs, and skills. (#1945)

​

Changed

Message Bus

• Refactor and decouple the message bus from service logic. (#1923)

​

Fixed

Model

• Correct the qwen max 3.7 model id in DashScope. (#1876)
• Handle Gemini function calls without an id. (#1883)
• Add _sanitize_schema_for_gemini to strip Gemini-incompatible JSON Schema constructs from tool parameters. (#1886)

Formatter

• AnthropicChatFormatter merges parallel tool_results into a single user message. (#1894)

Agent

• Avoid shared default configs across Agent instances. (#1906)

Tool

• Merge base64 tool-response chunks by bytes instead of string concatenation. (#1901)

Middleware

• Use the configured id factory for TTS audio blocks. (#1930)

App

• Correctly convert AG-UI SSE stream events. (#1917)

Schema

• Remove max_length constraints from SummarySchema fields and raise the tool-result size limit. (#1891)

​

v2.0.2

Released on 2026-06-16.

​

Added

Agent Service & Team

• Custom subagent templates can now be registered in the agent service, so a team leader can spawn workers from user-defined templates instead of being limited to the built-in ones. (#1833)
• Custom agent classes are now accepted by the agent service, allowing users to plug their own Agent subclasses into the FastAPI runtime. (#1838)

Tool

• Bash tool now accepts a cwd argument, letting agents scope shell execution to a specific working directory instead of always running from the workspace root. (#1822)

Model & Multimodality

• Streaming audio + live captions for DashScope/OpenAI omni-modal models — audio chunks and caption events are now emitted incrementally during a single reply. (#1701)

TTS

• New tts module with a DashScope backend and a streaming middleware that turns the agent’s textual replies into spoken audio as tokens arrive. (#1832)

WebUI

• Credential sidebar is now grouped by provider, making it easier to find and manage keys across many vendors. (#1829)
• CI for WebUI: added format and build checks so frontend regressions are caught at PR time. (#1821)

​

Changed

Agent Service Infrastructure

• Embedding model layer refactored for the agent service: the legacy single-file _dashscope_embedding.py / _dashscope_multimodal_embedding.py were replaced by a new embedding/_dashscope/ package with per-model YAML cards (text-embedding-v3/v4, qwen2.5-vl-embedding, qwen3-vl-embedding, multimodal-embedding-v1, tongyi-embedding-vision-flash/plus), a new EmbeddingModelCard type, and a service-level _embedding.py endpoint. (#1852)
• Background task manager refactored to support multi-process and distributed deployment. The single-process scheduler was replaced by a message-bus based architecture (message_bus/_base.py + _redis_message_bus.py), and the cancel/wake-up dispatchers were rewritten to coordinate over the bus. (#1849)

​

Fixed

Model

• Tool-choice fallback in thinking mode: when an OpenAI-compatible structured output call rejects a forced tool_choice because thinking mode is on, the call now transparently falls back to auto instead of erroring out. (#1830)
• Qwen thinking toggle is now forwarded correctly to DashScope. (#1774)
• Ollama embedding client is created per call instead of being cached, avoiding “event loop is closed” errors when the embedding client outlives its original loop. (#1836)

Permission & Team

• Workspace MCP loader now skips invalid MCP config entries with a warning instead of aborting initialization. (#1819)
• Workspace root is included in the permission context, so path-rule evaluation correctly resolves relative paths. (#1823)
• Worker agents inherit leader permission rules: AgentCreate is now state-injected, and a worker session is constructed by deep-copying the leader’s working directories and allow/deny/ask rules. Previously workers received a blank PermissionContext, losing every user-confirmed directory and rule. (#1815)

Tool

• Glob patterns now accept Windows-style separators. (#1809)

Storage & Message Bus

• Redis session IDs: explicit session IDs are preserved instead of being overwritten with auto-generated ones. (#1786)
• Redis message bus timeout bug fixed so long-running tasks no longer drop their result messages. (#1853)

WebUI

• Fixed nested <button> HTML inside the sidebar group action. (#1769)
• Non-previewable file attachments now render properly, and media size is constrained to avoid blowing out the chat layout. (#1768)
• The chat session sidebar is now a mobile overlay drawer instead of taking up screen real estate on small viewports. (#1772)
• Added a route-level error boundary with a friendly error page. (#1828)
• Fixed a rendering bug on the chat page. (#1867)
• Corrected a typo in the Chinese setup hint copy. (#1766)

​

v2.0.1

Released on 2026-06-05.

​

Added

Agent Service & Team

• Agent Team is built into the agent service: the service is refactored so multiple subagents can be created and coordinated by a leader agent. (#1776)
• Pluggable tools and middlewares can now be passed into the service at startup via dependency injection, instead of being baked into the default toolkit. (#1709)

Permission

• Permission system overhaul: the per-tool _check_permission hooks in Edit and Write were collapsed into the shared _engine.py, and _decision.py / _types.py were expanded with a richer rule model. The change is covered by a new 895-line permission_mode_test.py exercising the default, explore, accept_edits, and ask modes end-to-end. (#1767)

Model

• Per-call client_kwargs can now be forwarded to the underlying provider client, useful for proxies, custom transports, or per-call tracing. (#1659)
• 15 new YAML model cards for mainstream providers: Anthropic (claude-opus-4-5, claude-opus-4-6, claude-sonnet-4-5), DashScope (qwen-max, qwen-max-2025-01-25, qwen-turbo, qwen-long), OpenAI Chat (gpt-4o, gpt-4o-mini, gpt-4.1-mini, gpt-4.1-nano), OpenAI Response (gpt-4.1, gpt-4.1-mini), and xAI (grok-3, grok-3-fast). (#1731)

RAG

• Basic rag module skeleton introduced — base classes only; concrete retrievers will land in later releases. (#1746)

Event

• metadata field on EventBase, allowing producers to attach arbitrary structured data that downstream consumers (tracing, hooks, middlewares) can read. (#1788)

WebUI

• Fallback model can now be configured from the Web UI, so a session automatically rolls over when the primary model is unavailable. (#1699)

Dependencies

• ripgrep is now an optional dependency so deployments that don’t need the built-in grep tool can stay leaner. (#1740)

​

Changed

Docs

• README updated to cover the new agent service feature. (#1789)

​

Fixed

Formatter & Model

• Anthropic formatter now drops thinking blocks that have no signature, preventing API rejections. (#1668)
• Retry logic unified across providers: a shared retry helper was added to anthropic / dashscope / deepseek / gemini / moonshot / ollama / openai_chat / openai_response / xai, so transient failures are now retried consistently everywhere. (#1730)
• Ollama and Gemini now honour an explicit thinking_enable=False instead of silently re-enabling thinking when the model supports it. (#1784)

Tool

• FunctionTool now accepts plain (non-ToolResponse) return values and wraps them automatically. (#1703)
• Built-in Read tool now invalidates its file cache when the underlying file is modified. (#1735)
• Bash subprocess windows are now hidden on Windows. (#1717)
• Tool-group skills are now correctly included when resolving the active toolset. (#1732)

MCP

• MCPTool names are now sanitized so providers (notably OpenAI) that reject characters like : or / accept them as tool names. (#1787)

Workspace & Storage

• LocalWorkspace adds locks around MCP and skill operations to prevent races during concurrent registration/teardown. (#1710)
• Redis message lists now have an expiry so per-session message logs are no longer kept forever. (#1734)

WebUI

• Frontend now builds cleanly with the current dependency set. (#1708)
• Button tooltip trigger uses asChild to avoid nested <button> elements. (#1770)
• Dialogs now ship with descriptions for screen reader accessibility. (#1771)
• Added missing files in the Web UI example. (#1661)

Docs

• DingTalk group QR code refreshed. (#1662)

​

v2.0.0

Released on 2026-05-25.

​

Added

Agent Core

• Permission checking inside the Agent class: large rewrite of _agent.py (+1534/-388) integrating the new permission engine, event types, exception hierarchy, and message blocks. The agent now consults the permission system on every tool call. (#1518)
• Context compression in the Agent class: a new AgentConfig exposes compression knobs, model providers gain compression entry points, and the new offload/ and storage/ base modules persist compressed history. Covered by a 564-line context_compression_test.py. (#1544)
• Tool-result compaction in the Agent class so large tool outputs are summarized before being re-fed to the model. (#1585)

Permission System

• New tool/_permission/ package providing the basic permission classes, including a 1026-LOC _engine.py, a 589-LOC _bash_parser.py that statically analyses shell pipelines, plus _context.py, _decision.py, _rule.py, and _types.py. Backed by ~1.6k LOC of unit tests. (#1486)

Tool

• Built-in tools rebuilt on ToolBase: brand-new _bash, _edit, _glob, _grep, _read, and _write implementations, plus _meta and _constants, all sharing the new tool base class. (#1502)
• Task tools added: TaskCreate, TaskGet, TaskList, and TaskUpdate (see the Plan page). (#1549)
• Tool + Workspace integration: the toolkit and the workspace module are now wired into the Agent class so file/shell tools execute inside the agent’s workspace. (#1642)

Workspace

• New workspace/ module built for 2.0, with a _base.py interface and a 789-LOC _local_workspace.py implementation. The old offload/_base.py was removed in the process. (#1586)

Service

• FastAPI-based agent service introduced as the canonical way to expose agents over HTTP. (#1568)

Middleware & Tracing

• 2.0 middleware system added to the Agent class: a 179-LOC middleware/_base.py, a new AgentConfig slot for middleware registration, and a 752-LOC test suite. (#1565)
• Tracing as a middleware: the previously bolt-on tracing logic is now packaged as a middleware under middleware/_tracing/ (extractor + converter + setup + 846-LOC test suite). (#1633)

Model

• cache_creation_input_tokens and cache_input_tokens added to ChatUsage for prompt-cache aware billing/telemetry. (#1602)
• Uniform thinking tag: standardized handling of <thinking> tags across DeepSeek, Moonshot, OpenAI Chat, OpenAI Response and xAI so downstream code no longer needs per-provider branching. (#1622)
• Audio output for OpenAI models is now handled end-to-end. (#1623)
• DashScope structured output fixed and accompanied by usage examples. (#1651)

Message & Event

• Msg type rules and constraints formalized, with a comprehensive test suite that pins down what content blocks are allowed where. (#1454)
• usage field on Msg exposes token usage at the message level. (#1639)

Scripts

• Model-call helper scripts added under scripts/model_examples/ for quick provider sanity checks. (#1604)

​

Changed

Message & Event

• Core building blocks simplified and the Msg class restructured. The legacy a2a/ package (a2a_base, file_resolver, nacos_resolver, well_known_resolver) and formatter/_a2a_formatter.py were removed; a unified event/ package (_event.py, 421 LOC) was introduced. (#1440)

Tool

• Tool module refactored with a new base class and toolkit logic; the legacy MCP client_base was dropped and tutorials updated to match. (#1493)
• Skill loader refactor: a new tool/_skill/ package (_base.py + 171-LOC _local_loader.py) replaces the inline skill logic in the toolkit, and a built-in _skill.py tool exposes skills to agents. (#1513)
• tool_choice argument refactored to expose modes (auto, none, required, etc.) as typed objects in tool/_types.py, enabling advanced prompt cache in the OpenAI Response API. Updated across every provider model. (#1524)

Model & Formatter

• Chat model implementation refactored: a new credential/ package (_base, _anthropic, _dashscope, _deepseek, _gemini, _kimi, _ollama, _openai, _xai) decouples API keys/auth from the chat model classes, and every provider’s formatter was rewritten on top of it. (#1564)
• DashScope made OpenAI-compatible: the DashScope model now reuses the OpenAI chat client path instead of carrying its own response parser. (#1617)
• kimi renamed to moonshot to match the provider’s branding. (#1609)

MCP

• Unified MCPClient class (_mcp_client.py, 347 LOC) replaces the previous family of stateful, stateless, stdio, SSE, and streamable-HTTP clients. A small _config.py holds connection configs. (#1572)
• MCP tools are renamed when registered into the toolkit, ensuring no collisions across servers. (#1552)
• MCP unit tests refactored for the new version. (#1505)

Tracing

• Tracing module moved under middleware/_tracing/: the single 360-line _extractor.py was split into _trace.py, _converter.py, and a slimmer _extractor.py, and registration was simplified. (#1579)

Workspace

• e2b and Docker workspaces added alongside the local workspace, each with its own manager. The release also ships a full WebUI scaffold under examples/web_ui/. (#1650)

Project

• Temporary deprecations: evaluate, module, rag, tts, and realtime modules are removed pending refactor; the corresponding examples (a2a/a2ui agents, etc.) are deleted from the tree. (#1438)

Docs

• README and tutorials updated for the 2.0 release. (#1657)

​

Fixed

Model

• DashScope KeyError when the response payload omits an expected field. (#1615)
• _format_tools refined for the OpenAI response model. (#1635)

Formatter

• Formatters and unit tests refined across providers. (#1621)
• Moonshot: remote image URLs are now downloaded and re-uploaded as base64 since the API does not accept URL references. (#1653)

MCP

• $defs preserved in MCPTool input schemas and title keys stripped recursively, fixing schema validation with strict LLM providers. (#1595)

Tool

• .env bypass closed: Write, Edit, and Bash no longer let agents read or modify .env (or other dangerous paths) through canonical-path tricks; the dangerous-path API was refined accordingly. (#1656)

Scripts

• Helper scripts now assign a list of TextBlock to content instead of a raw string. (#1629)