Agent Zero Release Notes

Connector & Transport Hardening

• Enforced negotiated WebSocket payload ceilings with a symmetric checksummed transfer protocol for large operations, including bounded transfer state, disk spooling, and automatic cancellation on pause, reset, delete, or disconnect
• Made workspace HTTP file transfers atomic with streaming uploads into partial files, size verification, fsync, and SHA-256 download receipts
• Bounded remote connector tool payloads with explicit continuation metadata for large content, rejecting oversized inline artifacts before base64 expansion and routing bulk files to authenticated HTTP transfers
• Documented connector payload contracts including WebSocket ceilings, transfer state machine, cancellation lifecycle, and remote text limits

File Browser & Editor

• Added independent, lazily loaded directory trees to Files and Editor in canvas and modal modes with unified styling, lighter panel backgrounds, and flat toolbar controls
• Unified text and code editing in the shared Editor with ACE syntax highlighting, line numbers, native source search, and Markdown preview — removing the legacy file-editor modal
• Added File Browser preferences for sorting, view mode, initial tree visibility, and independent editing and transfer limits
• Exposed connected CLI and Launcher folders in Files with host permissions, authenticated HTTP transfers, size/SHA-256 checks, and atomic publication
• Centralized streamed file transfers and hardened archive operations with expansion and entry budgets, unsafe member rejection, and owned temporary-file cleanup
• Moved File Browser controls into a dedicated Settings category with appearance defaults, remote connections, file limits, and archive limits
• Added configurable editing (10 MiB default) and transfer (100 MiB default) limits shared across Files and Editor
• Fixed file links in chat messages to recognize file URLs and download API paths in the shared path-link renderer
• Polished Files selection toolbar, removed tree tooltips, matched folder icon tint to standard file icons, and hid file sizes in icon view

Responses API & Native Tool Calls

• Preserved native tool calls through Context Doctor, leaving canonical function calls untouched by text repair
• Stored canonical function-call content through assistant history and masking, with proper repeated-response detection
• Streamed native tool arguments through the existing live display with alias normalization and masking
• Described bundled tool arguments in Responses schemas for 15 tool implementations with non-strict definitions
• Preserved policy-filtered guidance in native Responses function descriptions with A0 envelope-to-argument conversion
• Projected native system instructions only for Responses requests, reducing Codex input from ~16.4K to ~11.3K tokens
• Preserved native Responses history within prepared prompts, retaining original IDs and encrypted reasoning
• Consolidated Responses prompt bookkeeping outside Agent, reducing agent.py additions from 61 to 24 lines
• Made llm_result required in hist_add_ai_response with LLMResult.non_llm sentinel for non-LLM turns
• Kept Responses stream reconstruction inside the parser with one authoritative output-item store
• Skipped unused Chat replay preparation and shared input conversion for Chat Completions

Context Doctor & Response Handling

• Added split-thoughts repair strategy extracting value selection into a helper with configurable settings
• Handled reasoning-only and plain-text fallback responses with dedicated retry warnings and user notices
• Tightened usable-response detection requiring at least one A0 key with a non-empty value
• Fixed raw-text fallback classification by moving raw thoughts wrapping after repair selection
• Counted thoughts_fallback warning toward the unusable-response limit
• Let Responses text reach the core response dispatcher while continuing to repair recognizable tool intent

Prompt & Profile Improvements

• Hid disabled capabilities from system prompts so policy-filtered tool prompts remain the source of truth
• Moved MCP guidance into prompt templates with policy-filtered qualified names and schemas
• Compacted developer and researcher profile prompts, reducing token counts from ~2,600 to ~750 each
• Strengthened shared problem-solving prompts with observable success criteria, evidence-driven replanning, bug reproduction, and source-preserving synthesis
• Reinforced response tool usage in prompts, explicitly stating plain-text output without a tool call is invalid
• Stripped trailing newlines in read_prompt and parse_prompt for consistent template handling
• Added initial user turn to preserve AI greeting turn order when no project is selected
• Rendered scoped profile routing catalog as one line per profile ID with delegation context

Canvas & UI

• Made the canvas rail movable and customizable with a vertical drag handle, keyboard support, viewport bounds, and remembered position
• Added a "Show verbose tool calls" preference gating tool name and args display in the message stream
• Added text_editor custom message handler with dynamic action+path headings
• Themed dark checkboxes with light checkmarks and centered Memory Dashboard selection controls
• Polished surface modal headers to a shared 48px height with centered controls
• Refreshed context indicator after clearing chat
• Showed LiteLLM and Secrets settings by default without collapsible wrappers
• Avoided replaying queued WebUI updates — live benchmark showed catch-up reduced from 1.95s to immediate
• Fixed context window popover staying within bounds on short labels
• Fixed Browser tab switching stuck in loading state when reusing the same viewer URL
• Fixed branch button injection skipping markdown-wrapped action bars
• Clarified required Agent Editor instructions with validation errors and tooltip cleanup

Browser & Desktop

• Added Safari setup to Browser settings with structured setup guidance for Safari and Chromium-family browsers
• Sped up Browser and Desktop startup by limiting initial D-Bus and CUPS waits to one second
• Fitted Desktop display to the active canvas, removing the aspect-ratio fallback that cropped narrow viewports
• Fixed Desktop and Office package installation using the Python 3.13-compatible Kali snapshot
• Preserved the shared browser cleanup thread across context resets

Model & Provider Management

• Prevented chat parameters from leaking into embedding configurations
• Preserved Codex OAuth prompt cache affinity with stable session/thread IDs and bounded default cache keys
• Kept OAuth model discovery tied to account availability without replacing empty catalogs with generic registry models
• Reported provider usage for streamed Chat Completions turns with automatic retry when stream_options is rejected
• Kept encrypted Chat reasoning out of readable output by filtering provider encrypted-reasoning markers
• Preserved Codex Chat bridge usage and terminal outcomes with token count translation
• Reported invalid model parameter JSON before saving with editor context identifying the preset and slot
• Avoided repeated preset reads during embedding comparisons — median save time reduced from 1,171ms to 52ms
• Discarded model search results for changed drafts and queries
• Set tested Codex client version (0.153.3) by default for model discovery without CLI

Skills & Plugins

• Added an on-demand guide for managing projects, chats, profiles, and saved tasks through existing APIs
• Consolidated plugin authoring behind a0-create-plugin and lifecycle management behind a0-manage-plugin
• Required hooks.py for plugin setup and cleanup in authoring guidance
• Hid remote skill discovery until the A0 CLI connects
• Fixed trailing commas in six JSON skill examples and rewrote 23 skill descriptions for catalog preview
• Validated skill examples and sharpened descriptions with regression checks

Parallel Execution & Terminal

• Kept parallel terminal jobs alive until their commands finish, publishing progress through job results
• Kept goal operations out of disposable parallel workers with shared validation across dispatch paths
• Preserved streamed child log content in parallel jobs so user-visible output is never replaced

Security Fixes

• WhatsApp: Fixed media path traversal and enforced pre-download sender/group authorization
• Telegram: Fixed webhook authentication bypass — reject HTTP updates for polling bots and require matching nonempty webhook secret
• IMAP: Fixed sender whitelist bypass with strict mailbox parsing requiring exactly one valid From address

Infrastructure & Stability

• Optimized scoped tool policy resolution reusing one fresh policy snapshot across batches
• Unified embedding calls behind a single batch entry point removing duplicate transport logic
• Serialized shared event-loop initialization to prevent concurrent first-use from stranding tasks
• Preserved rollback stash identity during self-update by tracking Git object IDs
• Preserved non-LLM mode when reloading result metadata through dictionary and history round trips
• Restored legacy assistant history call compatibility accepting message-only and positional ID calls
• Shared editor log presentation across local and remote tools
• Kept the rate limiter demo out of test collection
• Used 4-space indented tree in workdir extras for token-compact agent-facing output
• Routed nudge as system message and minified message templates
• Simplified WhatsApp pairing to one QR-code action with sequential polling
• Updated Launcher README links to v1.7
• Ignored .venv in generated gitignore templates

Breaking Changes

• hist_add_ai_response now requires an llm_result parameter — use LLMResult.non_llm() for non-LLM turns (greeting, intervention progress). Legacy message-only and positional ID calls remain supported via automatic sentinel injection.
• thoughts is no longer auto-populated from reasoning when absent (reasoning-to-thoughts revert).
• Plugin authoring now requires hooks.py for dependency installation, initialization, and uninstall cleanup — execute.py setup patterns are no longer supported.