OpenAgent

Appearance

Changelog ​

Notable changes, newest first.

v1.1.0-beta.45 and connector SDK 0.1.8 ​

  • SDK18 publishes 114 official connectors plus Custom MCP: 90 manual-token profiles with two specific reads each, plus read-only OneDrive/SharePoint. Token setup guidance and 45 verified shared marks are distributed by the SDK; provider permission and real-account acceptance remain separate.
  • Server/CLI45 pins SDK18/Core22/B6. Installed qualification passed 210 tests and 15 React source scenarios. Microsoft resource selection uses fresh authorized account/site/drive discovery and local owner checks; common Google/Microsoft enrollment remains off.
  • App22 is public with six native targets and 36 verified assets. Its actual Linux x64 App22/server45 marketplace passed with 114 official cards and 30 registry results in one grid, 45 shared SVGs, 12 bundled marks and ten visually reviewed screenshots. Blank Postman setup was cancelled and one local Exa cycle completed; no provider/model call or OAuth grant occurred. Google/Microsoft remained off. Mac/Windows GUI and hosted sandbox security remain separate. The normal public installer45 and historical App21/server44 receipt remain independently recorded.

App v1.1.0-beta.20 ​

  • Public desktop release with 36 verified assets/six native targets; all 10 workflow jobs and mandatory Intel ZIP/DMG launches passed. Native receipt.
  • Actual Linux x64 marketplace with server 43: 19 official entries and 30 registry results in one grid, nine marks, five keyless local control cycles and seven reviewed screenshots. Ordinary Join/SRP/device-cert/Iroh; zero provider/model calls. Owned cleanup passed. Hosted --no-sandbox does not qualify sandbox security or Mac/Windows GUI.

v1.1.0-beta.43 and connector SDK 0.1.6 ​

  • Published SDK 0.1.6 adds Parallel Search, Context7 and CoinGecko through their official fixed MCP endpoints: 19 official adapters plus Custom MCP, including five keyless providers. The six actual SDK reads passed after the preserved narrow output-ticker compatibility repair.
  • Server/CLI beta 43 pins SDK 0.1.6/Core beta 22/B6. 157 installed fixtures and source guards, the normal public installer, and three-connection/six-workflow lifecycle passed separately. Workflow reads crossed ordinary certified APIs before/after a real server restart; local disconnect removed sources and retained tombstones.
  • Explicit empty common-provider settings remain opt-outs; defaults create no grant or automatic broker registration. Keyless-only servers do not poll the broker. Native packaging, GUI, provider reads and privacy acceptance remain separate.

App v1.1.0-beta.19 ​

  • Published desktop release with 36 verified assets across six macOS/Windows/Linux native targets. Both macOS architectures are signed and notarized; Intel ZIP and DMG launches passed.
  • The native release receipt preserves the original ARM stapling failure and successful bounded recovery.
  • The Linux x64 marketplace trial passed with server beta 42: 16 official entries and 30 registry results in the same grid, plus Exa/Firecrawl Connect, disable/re-enable and disconnect without credential forms or OAuth controls. No provider call or model was used. Hosted --no-sandbox is not sandbox-security or Mac/Windows GUI acceptance; beta 41 provider reads retain their separate scope.

v1.1.0-beta.42 ​

  • Connector acquisition handles distinct installation/temporary filesystems using a verified destination-side copy and atomic publication. Identical verified wheels are reused; partial or mismatched copies are not promoted.
  • 149 installed fixtures and 15 acquisition cases passed. The fresh normal public installer also passed server-plus-CLI installation across distinct mounts.
  • Core beta 22, SDK 0.1.5 and Host Tools B6 are unchanged. The provider code is identical to beta 41; no new provider calls were made for this repair. Release record.

v1.1.0-beta.41 ​

  • Published SDK 0.1.5 adds Exa and Firecrawl to the same marketplace/CLI catalog: sixteen official entries plus Custom MCP. The reviewed read tools require no provider key or OAuth; local owner, tenant and tool permissions still apply.
  • ClickUp, GitHub and Notion become eligible by default only when both operator settings are absent. Explicit empty lists/environment opt-outs remain; defaults create no connection, grant or automatic broker registration.
  • The limited real product lifecycle passed two keyless connections, four public reads across an actual restart, local tombstones/source removal and runtime cleanup. Initial installer EXDEV and same-prefix TMPDIR recovery remain recorded, distinct from beta 42's fresh installation proof. Private harness errors are separately preserved.
  • Release record. At this server release checkpoint, App beta 18 was the published desktop release and beta 19 native/GUI qualification was pending. The later App beta 19 publication is recorded above. These server releases alone do not establish native App or provider-wide acceptance.

v1.1.0-beta.34 ​

  • Memory authorization failures may only be reported when the same turn has a matching tool-error receipt; an ungrounded claim is replaced with a truthful correction instead of being presented as a real server denial.
  • Recovery projection now uses a detached SQLite transaction after the journal commit, preventing active statements from deferring session continuity with cannot open savepoint - SQL statements in progress.
  • Product beta 34 pairs with Core beta 19 and Tools beta 4. The signed desktop App remains beta 15 because the repair is server-side.

v1.1.0-beta.33 ​

  • Authorized scheduled tasks and workflows can compose with another exact, independently authorized automation owned by the same principal and audience.
  • Internal federated search keeps results from healthy domains when another domain is unauthorized or unavailable, and no longer presents itself as public web search.
  • Product beta 33 pairs with Core beta 18 and Tools beta 4. The signed desktop App remains beta 15 because the repair is server-side.

v1.1.0-beta.32 ​

  • Explicit scheduled-task and event execution timeouts now extend the outer durable Runtime deadline instead of being cancelled by its 960-second default first.
  • A bounded finalization window lets the inner policy record the correct terminal state without making the automation unbounded.
  • Product beta 32 pairs with Core beta 17 and Tools beta 4. The signed desktop App remains beta 15 because the repair is server-side.

v1.1.0-beta.31 ​

  • Model fallback references now resolve through the live provider catalog, including custom OpenAI-compatible providers, their credentials, base URLs, and model sampling metadata.
  • Catalog reloads and credential rotation rebuild the fallback chain without a server restart, while legacy built-in references remain compatible.
  • This release includes the bounded, durable scheduled-task retries introduced in beta 30 and pairs Product beta 31 with Core beta 17 and Tools beta 4. The signed desktop App remains beta 15 because the repair is server-side.

v1.1.0-beta.30 ​

  • Recurring scheduled tasks now retry transient model rate limits, overloads, unavailable capacity, and timeouts through the durable request queue.
  • Retries are delayed and bounded, retain the original provider error, and are suppressed after any tool activity to avoid duplicate email, social, or mutation side effects.
  • Product beta 30 pairs with Core beta 16 and Tools beta 4. The signed desktop App remains beta 15 because this repair changes only the server runtime.

v1.1.0-beta.29 ​

  • The standalone Gateway now resolves the Agent's canonical default Vault path when memory.vault_path is omitted from configuration.
  • This repairs App Vault requests that returned 503 while the real Markdown notes and runtime Vault remained healthy.
  • Product beta 29 pairs with Core beta 15 and Tools beta 4. The signed desktop App remains beta 15 because this repair changes the server runtime only.

v1.1.0-beta.28 ​

  • Terminal Agent and Team streaming errors now close the current turn instead of being mistaken for an empty successful stream and re-running the prompt.
  • This prevents a provider failure from issuing a duplicate model call and leaving a scheduled-task run in running while the fallback retries.
  • Product beta 28 pairs with Core beta 15 and Tools beta 4. The signed desktop App remains beta 15 because this repair changes the server runtime only.

v1.1.0-beta.27 ​

  • Workflow mcp-tool blocks now validate and dispatch through the authorized Runtime capability catalog used by the gateway and interactive turns.
  • This fixes tools that were visible and callable in chat, including the independent web-search MCP, but appeared unloaded inside workflows.
  • Missing capabilities remain denied by the catalog and cannot fall through to the legacy Agent pool. Product beta 27 pairs with Core beta 14 and Tools beta 4; the signed desktop App remains beta 15.

v1.1.0-beta.26 ​

  • Legacy managed web-search catalog rows now resolve to the independently installed openagent-web-search-mcp package instead of naming a retired Core built-in and silently disappearing from tool discovery.
  • Fresh installations still require explicit package installation and registration, and user-owned custom rows remain untouched. Only safe browser runtime settings are forwarded to the MCP subprocess.
  • Server deployments pair Product beta 26 with Core beta 13 and Tools beta 4. The signed desktop App remains beta 15 because its payload did not change.

v1.1.0-beta.25 ​

  • An approved one-shot scheduled task now retains its exact durable authority while its real child chat and any nested sub-agents finish. Runtime ancestry is verified from persisted parent-run records; unrelated disabled revisions remain blocked.
  • A production canary exposed the gap left by the earlier stubbed test. The new regression drives the real child Runtime boundary and proves the one-shot executes once, reaches success, revokes its grant, and stays disabled.
  • Server deployments pair Product beta 25 with Core beta 13. The signed desktop App remains beta 15 because its native and renderer payloads did not change.

v1.1.0-beta.24 ​

  • Large operational-search index integrity scans no longer block the asyncio event loop, so gateway requests, chat, channels, and scheduled work remain responsive while a mature SQLite/FTS index is checked.
  • Redeeming the exact first-user auto-bootstrap invitation atomically assigns the local agent to that authenticated owner. Later ordinary invitations cannot transfer ownership.
  • Server deployments pair Product beta 24 with Core beta 13. The signed desktop App remains beta 15 because its payload did not change.

v1.1.0-beta.23 ​

  • Historical scheduled tasks, workflows, and events now expose an explicit exact-revision review and approval path instead of being silently skipped by the standalone authorization gate.
  • Recurring schedules resume at their next future occurrence after approval, avoiding a burst of every missed run. One-shot tasks consume and revoke their approval after exactly one completed occurrence.
  • The App identifies definitions that need review, shows their SHA-256 digest, and disables manual Run or Test until the owner approves that exact revision.

v1.1.0-beta.21 ​

  • The Python CLI now requires Host Tools b5, matching the server package. A full server plus CLI installation passes the package dependency check.
  • Signed desktop bundles retain their previously qualified Host Tools b4 payload; beta 21 ships Python wheels for server deployments.

v1.1.0-beta.20 ​

  • Standalone servers can opt in to their own Agent in Chrome and computer control sidecars. Telegram and scheduled runs can use that server computer through exact host-bound tool references, while App/CLI device tools remain tied to their originating client.
  • An independently supervised browser remains running when its MCP disconnects. Host operators can keep a persistent profile and a graphical display for browser and desktop tool calls.
  • Installation A used both tools from Telegram for read-only screenshots. Chrono24 still required interactive verification at login.

v1.1.0-beta.18 ​

  • Core beta 9 recognizes Claude image input behind custom provider names while preserving explicit model capability settings. This repairs Telegram image handling for verified Claude subscription proxy models.
  • Two standalone installations were upgraded and each answered an image question through Telegram after release. Installation A's audio transcription path also completed a post-upgrade Telegram check. See the release receipt for the exact evidence.

v1.1.0-beta.16 ​

  • Telegram voice notes and audio files are transcribed before the shared stream; the original audio remains in the session while a text-only chat model receives the transcript.
  • Core beta 8 applies the same STT handoff to every channel. The server pins PyAV below 19 until faster-whisper supports the removed PyAV argument.
  • This release updates Python server and CLI wheels; the desktop App remains at beta 14.

v1.1.0-beta.12 ​

  • The Apple Silicon desktop App is signed and notarized with the image model settings and generated-image attachment path. The server and CLI wheels are rebuilt from the same source commit.
  • macOS signing retries transient Apple timestamp-service failures without removing the Developer ID or notarization gates.

v1.1.0-beta.11 ​

  • Image models can be configured in App, CLI and server settings; the agent can generate an image and send it as a typed attachment through the current channel. Core beta 6 supplies the shared image transport and session API.
  • The standalone session commands now use the same public Core controls as embedders.

v1.1.0-beta.10 ​

  • The desktop App and CLI now pin the independently published host-tools v1.0.0b4 release. Tool references still resolve through the uniform catalog and client-local computer capabilities remain bound to the verified device.
  • The Python server, CLI and MCP bridge were rebuilt from the same product source. The signed and notarized Apple Silicon App includes the new local computer-control bundle.
  • The published release receipt records exact digests and remaining updater and platform qualification gates.

v1.1.0-beta.9 ​

  • Core beta 5 adds optional session inspection, child navigation, waiting and cancellation. Tools beta 3 and host-tools beta 4 add contextual editing, process and window discovery, window capture and exact display targeting.
  • The Python wheelhouse was qualified before the platform-specific host bundle and App installers were built.

v1.1.0-beta.8 ​

Telegram session recreation after clear ​

  • A new message on a stable bridge session id now waits for the recreated session generation to be persisted before the run is admitted.
  • Core v1.1.0-beta.4 replaces a deleted compatibility generation in full, clearing its tombstone without restoring the transcript that /clear removed.
  • This prevents the accepted run from failing its next run.read, run.execute or run.publish authorization check.

OpenAgent Tools v1.0.0-beta.2 ​

Meta Ads video upload ​

  • The optional Meta Ads MCP package adds meta_ads_upload_ad_video while preserving the existing 54-tool catalog.
  • Google Drive share links are normalized to direct downloads before Meta is asked to ingest the video. The tool returns the resulting video_id and directs callers to poll processing status before creating the creative.
  • The write surface remains gated by META_ADS_ENABLE_WRITE_TOOLS=true. Release assets are reproducible, checksummed and intended for immutable installation.

v1.1.0-beta.7 ​

Large capability-source discovery ​

  • Tool discovery now returns compact, ranked pages instead of every full JSON schema at once. Sources such as Meta Ads can expose 54 tools without the provider truncating later write-tool references.
  • tool_search_list_tools accepts a capability query, page size and offset; tool_search_describe_tool remains the authoritative full-schema lookup.
  • The framework prompt tells agents to search, describe and call the selected opaque reference in the same run. Revocation and destination binding remain enforced at every call.

v1.1.0-beta.6 ​

Uniform native and MCP capability visibility ​

  • Standalone authorization now verifies source presence through the runtime's uniform catalog snapshot. Native module capabilities such as Vault and Sessions, external MCP servers and product sources therefore use the same trusted registration boundary.
  • Audience, delegation, Vault ownership, temporary-device leases and immediate revocation remain independently enforced after registration is verified.
  • The release adds regressions for native source discovery and unregistered or revoked sources, plus live Telegram qualification on the installed standalone server fleet.

v1.1.0-beta.5 ​

Modular capability authorization ​

  • Standalone runtime authorization now resolves concrete filesystem, editor and shell sources from the active MCP module pool. The compatibility Agent pool remains limited to the discovery broker without hiding module-owned tools from authenticated CLI, Telegram or other durable turns.
  • A regression test keeps the two pools deliberately different and verifies that a server workspace tool remains discoverable through the public runtime policy.

v1.1.0-beta.4 ​

Standalone host tools and visual input recovery ​

  • Standalone servers now expose filesystem, editor and shell capabilities for their own agent workspace. Telegram and other durable channels can use these product-owned destinations without borrowing a connected desktop's temporary computer access.
  • Operators can restrict or disable the server tool set with server_host_tools; subprocesses receive sandbox policy and ordinary process settings while channel and model credentials stay out of their environment.
  • The qualified Claude subscription proxy path preserves OpenAI-compatible image parts, allowing configured Claude models to receive Telegram images instead of silently dropping them.

v1.1.0-beta.3 ​

Standalone installation and channel recovery ​

  • The standard server wheel now installs the federation bridge it exposes in its catalog; users no longer need the optional all extra to avoid a missing openagent_mcp import.
  • Telegram, Discord and WhatsApp messaging capabilities are supplied directly by the standalone product from its verified channel configuration. They no longer depend on a Node sidecar that was absent from Python wheel installs.
  • The public installer constrains the third-party dependency set qualified by the release, so installing a first-party beta does not select unrelated Pydantic, SQLAlchemy, LiteLLM or Hugging Face prereleases.

v1.1.0-beta.2 ​

Modular runtime and canonical product repository ​

  • OpenAgent Core now exposes a small kernel plus independently installable Sessions, Search, Vault, MCP, Workflows, Scheduler, Events, Delegation, Skills, Models, Budget, Attachments, Logs, PTC and Tool Discovery modules.
  • Every module uses the same descriptor, lifecycle, service registry and surface contract. Manager tools are an optional agent_tools surface rather than a privileged architecture layer.
  • Native, MCP, product and authenticated-device capabilities share one catalog and opaque references. App dashboard and computer tools remain scoped to the connected client context.
  • App, CLI, server and MCP bridge are now released together from openagent. Core and Tools keep independent versions.
  • Framework tool rules and Vault recall/save/quality rules are contributed by their active modules and cannot be replaced by the host system prompt.
  • The published beta includes Python product wheels and a signed, notarized, stapled Apple Silicon desktop build. The manifest remains development-unqualified pending a complete cross-platform updater chain.

See Architecture and Downloads.

v0.14.18 ​

The write gate now covers the app and CLI too ​

v0.14.16 made the agent's writes pass the quality gate. Now every write does — the REST path (PUT /api/vault/notes) that the desktop app and CLI use runs the same gate:

  • Mechanical issues are auto-fixed (frontmatter scaffolded, dates normalized, [[ ]] spacing, em dashes).
  • A structurally-broken note (invalid YAML frontmatter, a brand-new note past the atomic size limit) is rejected with 422 and a list of errors — nothing is written. The app shows the errors inline and keeps your text; the CLI prints them and asks you to fix and re-save.

The agent hears what the gate did ​

After a write, the vault MCP now tells the agent what it auto-fixed and what still needs its judgement (e.g. "missing summary"), so it can improve the note rather than assume it's done.

Migration for existing installs ​

Agents created before v0.14.16 had their vault MCP pinned to the old npx package and never picked up the validated built-in. A boot migration converts that row in place (preserving whether it was enabled), so the gate activates on every existing install — not just fresh ones.

Set OPENAGENT_VAULT_VALIDATE_WRITES=0 to fall back to the old warn-only behavior. Scheduled dream-mode (config dream_mode.enabled) handles the graph-level rules write-time can't.

v0.14.16 ​

The agent can no longer write a messy note ​

The memory vault is now driven by a vendored, validated fork of the markdown-vault MCP (@bitbonsai/mcpvault v0.12.1, pinned and shipped in-tree instead of fetched at runtime). Every write the agent makes — write_note, patch_note, update_frontmatter, manage_tags — runs through the vault quality gate before it touches disk:

  • Auto-fixed (silently): missing frontmatter is scaffolded (title/tags/status/created/updated), dates are normalized to YYYY-MM-DD, spaces inside [[ wikilinks ]] are stripped, em dashes are replaced. The note lands clean.
  • Blocked (the agent must fix and retry): frontmatter that isn't valid YAML, and a brand-new note past the atomic size limit.

Graph-level rules (broken links, orphans, duplicates) are intentionally left to the gate / dream-mode — a note legitimately links forward to notes that don't exist yet. The behavior is identical to upstream mcpvault when OPENAGENT_VAULT_VALIDATE_WRITES is unset; OpenAgent enables it automatically.

v0.14.15 ​

Vault history: diffs, restore, and reset ​

The vault's git history is now inspectable and reversible from the app and CLI.

  • Commit diffs — every commit shows the files it touched and a coloured unified diff. GET /api/vault/commit?hash=.
  • Restore a state (non-destructive) — roll the whole vault back to any past commit as a new commit; later history is preserved and the restore is itself undoable. POST /api/vault/restore {hash}.
  • Reset to a commit (destructive) — make a commit the latest state, deleting every commit after it. Ancestor-only, requires an explicit confirm flag, and is gated behind a confirmation prompt in the app and CLI. Not exposed as an agent tool. POST /api/vault/reset {hash, confirm}.
  • Clients — the app's Memory history expands each commit inline with its diff and Restore / Reset buttons; the CLI vault → history lets you pick a commit to view, restore, or reset.

Dream mode in the agent (v0.14.14) ​

The agent now knows what dream mode is and can run it on request: a new vault_dream tool runs a full maintenance pass (gate → auto-fix → regenerate derived → commit) and returns the harder issues for the agent to resolve, with a matching system-prompt playbook.

v0.14.12 ​

Vault quality system ​

A code-enforced quality system now wraps the memory vault. It is pure-Python and runs fully offline.

  • Quality gate — every note is graded against a fixed rule set: complete frontmatter (title, summary, tags, status, created/updated as YYYY-MM-DD), atomic size (≤300 lines), ≥3 real outgoing [[wikilinks]], no broken links, no orphans, a single connected graph, duplicate detection, journal anchoring, absolute dates, and em-dash hygiene. Each violation carries an error / warn / info severity; the gate passes on zero errors.
  • Incremental index — a SQLite + FTS5 index with (mtime, size) invalidation that re-parses only changed files and scales to 100k+ notes. Graph facts (orphans, components, backlinks, broken links) are computed from the index.
  • Doctor — mechanically fixes what code can do safely (collapse multi-line related:, strip spaces in [[ ]], normalize dates, scaffold missing frontmatter, em-dash) and hands the judgement calls (orphans, duplicates, over-long, broken links) to the AI as suggestions.
  • Derived artifacts — llms.txt (a per-folder index AIs read) and _showcase/showcase.md are regenerated from the index.
  • Folder taxonomy + canon — vault init scaffolds the 11-folder Company-Brain taxonomy (self, areas, projects, sources, concepts, docs, entities, data, code, outputs, workspace), the journal tree, and a workspace/_canon/ workflow (raw sources/ → canon → atomic notes).
  • Move/rename that rewrites links — renaming a note or folder rewrites every inbound [[wikilink]], preserving path/stem style, alias, and anchor — no broken links.
  • Git-backed vault — the vault is a git repo and the system auto-commits every change with provenance trailers (Origin / Session / Workflow / Task / Tool). A background sweep captures external/Obsidian edits; git is bootstrapped at setup if missing and degrades gracefully when absent.
  • Dream-mode maintenance — an optional periodic pass: sync → gate → auto-fix → regenerate derived → write a dream-log → commit.

New surfaces:

  • Native MCP tools (vault-gate server): vault_gate, vault_doctor, vault_validate_note, vault_rename_note, vault_init, vault_stats, vault_search, vault_backlinks, vault_regenerate_derived.
  • REST: GET /api/vault/gate, GET /api/vault/stats, GET /api/vault/history, POST /api/vault/doctor, POST /api/vault/derived, POST /api/vault/move, POST /api/vault/init, POST /api/vault/index/sync; and PUT /api/vault/notes/{path} now validates + commits and returns {ok, path, warnings, commit}.
  • CLI: openagent vault gate|doctor|sync|derive|stats|search|mv|init, and openagent doctor --fix installs git for the vault.

See the full Vault Quality System guide.

Auto-updater hardening ​

The self-update path is now fail-safe end to end.

  • Fail-closed checksums — SHA-256 verification is mandatory by default. The updater refuses a download unless it can verify it against the GitHub asset digest or a sibling .sha256 file.
  • Atomic swaps — the new binary replaces the running one via a same-directory atomic rename (current → .old, new → current); Windows swaps a .pending binary at next startup.
  • Boot-guard rollback — an update is provisional until the new binary boots healthy. A journal next to the binary counts boot attempts; after repeated failures it automatically restores the previous .old binary and remembers the bad version so the poller won't re-install it. A bad release self-heals with no remote access.

v0.14.11 ​

  • Groundwork for the vault quality system: the incremental index, gate engine, and git-backed vault land here ahead of the full surface in v0.14.12.
  • Save reminder — on by default: a memory checkpoint ("ALWAYS save relevant things") is injected on the first prompt of a session and then every 3 turns, so the agent reliably persists what matters. Tune it under memory.vault_reminder.{enabled, every_n_turns}.