This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryUpdates Bug fixes, Highlights, and Settings & UI improvements across a mixed release.
Full changelog
Agent Zero v2.0
Highlights
-
Native Responses API transport — Agent turns now prefer the OpenAI Responses API when available, with automatic chat-completions fallback for providers that don't support it. Responses metadata is persisted in history and agent state for provider-state continuation, replay, and function-call execution. Prompt caching is normalized per provider (OpenAI/Azure, Anthropic, Gemini, Bedrock, OpenRouter).
-
Parallel tool calls — A new parallel tool-call runtime lets the agent batch independent tool calls concurrently as visible child chats. Parallel await timeouts are non-destructive so jobs can be re-awaited, and nested subordinate chats work normally inside parallel workers.
-
Revamped MCP server configuration — MCP servers now support project-scoped configuration with global/project merge semantics, a richer settings UI with list-first layout, server and tool search, per-tool enable/disable toggles, a dedicated scanner modal, and chat composer access. MCP runtime handling is hardened for dotted tool names, timeouts, status accuracy, lock scope, and cleanup of wedged transports.
-
Time Travel workspace selector — The Time Travel plugin now supports selectable workspaces (workdir/project), with a workspace picker in the UI and new API endpoints.
-
LiteLLM global kwargs — Normalized global LiteLLM configuration handling ensures framework defaults, configured globals, and per-call overrides merge correctly. Global kwargs are kept as per-call options rather than frozen into provider defaults.
-
Shared canvas surfaces — Files is promoted to the universal canvas rail alongside Browser, Editor, and Desktop. All surfaces use a shared draggable/resizable floating modal with Focus mode. Surface windows persist across page refresh, and the right-canvas rail is visible on mobile (routing to modals on narrow screens).
-
Welcome screen refresh — Reworked welcome screen with a shared new-chat composer, quick actions, discovery cards, OAuth accounts, and a system resources panel. The welcome screen stays free of docked canvas surfaces.
-
Skills improvements — A new Settings > Skills scanner section runs security checks on skill zips before import. Loaded skills now persist through chat compaction by storing skill IDs as chat-wide context data and reattaching bodies post-compaction. Browser automation skills gain trigger frontmatter for better discovery. The
a0-developmentskill is refactored into focused reference files. -
Protocol prompt area — A new prompt region ("protocol") is injected before message history, with per-turn temporary and persistent slots. Project instructions and active/loaded skills are now delivered through protocol rather than extras.
-
A2A streaming — Agent Zero now advertises streaming capability on A2A endpoints by default.
New local provider support
- oMLX — First-class local provider for Apple Silicon with Docker-friendly defaults and paged SSD cache documentation.
- llama.cpp / llama-server — Registered as chat and embedding providers with host.docker.internal defaults.
- vLLM — Registered as chat and embedding providers; empty tools arrays are stripped for strict OpenAI-compatible servers.
- LM Studio & Ollama — Shipped Docker-friendly defaults so containerized Agent Zero reaches host-running services without manual api_base edits.
- Tiny Local tool-use profile — Bundled agent profile for small local models.
Telegram integration
- Major improvements to native Telegram integration UX and streaming.
- Telegram tool lifecycle hooks are now safe no-ops for non-Telegram contexts.
Security & dependency updates
- LiteLLM upgraded to 1.88.1 (above CVE-2026-42271 patched floor); OpenAI SDK pinned to 1.88.1.
- Starlette pinned to patched 1.0.1 release for Host-header advisory.
requirements2.txtfolded back into a singlerequirements.txt.
Settings & UI improvements
- Settings sidebar now has search with filtered results; sidebar accordion expansion is decoupled from active section; content pane scrolls independently. Backup & Restore promoted to its own section.
- Context window size control moved above the Advanced disclosure for main and utility model slots.
- Stale preset kwargs are cleared on model switches so unsupported parameters don't leak across providers.
- Rubik is now the default WebUI font, including native browser controls and the login page.
- Shared
.text-buttonCSS primitive restored so controls render correctly without chat composer dependency. - WebSocket heartbeat interval and timeout raised with environment overrides to prevent disconnects during long operations.
- Editor generalized from Markdown-only to exact-text
.mdand.txtdocuments with open, save, Save As, and rename support. "Open in Editor" is a visible File Browser row action. - Google Cloud Gemini OAuth provider renamed for clarity.
- What's New showcase modal with version gating, permanent opt-out, and bundled media for new features.
- Project extension data hooks let plugins contribute named project settings sections without coupling to core helpers.
Bug fixes
- Pager CPU spin — Disabled pagers (
PAGER=cat,GIT_PAGER=cat) in non-interactive code execution shells sogit diff/git logno longer block forever at 100% CPU. Fixes #1697. - MCP settings apply NameError — Fixed undefined variable when applying global MCP servers.
- Compaction backups with malformed Unicode — Surrogate-containing chat content no longer breaks JSON/transcript backup writes.
- Parallel worker chat log orphans — Ephemeral parallel worker chat folders are cleaned up; directories without
chat.jsonare ignored at startup. - Subordinate agent profiles — Profile arguments are validated against available profiles; profiles persist in saved chats and survive profile switches and restarts.
- Sentence-transformer embedding aliases — Stale provider/model aliases are patched at the config boundary so memory embeddings use the intended local HuggingFace provider.
- Project skills folder initialization —
.a0proj/skillsis created during project setup and repaired when loading existing projects. - Connector file chunking — Chunked
connector_file_op_resultpayloads are buffered and reassembled before resolution. - Responses API 404 fallback — Wrapped NotFoundError responses from providers without the Responses API now correctly fall back to chat completions.
- Document query image routing — Images, screenshots, and diagrams prefer
vision_loadwhen vision tools are available. - Remote tool prompt gating — Remote tool prompts are hidden unless the connected CLI advertises the matching capability.
- Mobile fixes — Welcome composer wrapping, project action layout, compaction modal spacing, modal layering over canvas rail, and composer alignment polished for narrow viewports.
- Unsecured connection settings link — The "Configure credentials" banner now opens Settings at the correct section.
- Welcome composer idle placeholder overlap — Ghost placeholder suppressed until a chat is selected.
- Xpra amd64 Docker fallback — Minimal fallback package set now works on amd64 when the preferred Xpra repository is unsatisfiable.
- pytest capture import — Guard added so pytest capture objects work with the code execution TTY helper.
Infrastructure & Docker
- Self-update manager synced at startup when the installed copy is stale.
- Uploads directory created during Docker runtime initialization before services start.
- Docker open file limit raised at startup with explicit compose
nofileexample. - Comprehensive file-level DOX documentation added across the repository with matching
AGENTS.mdindexes.
Documentation
- New Launcher guide with runtime setup, Installs, Instances, and screenshot notes.
- v1.20-to-v2.0 image upgrade path documented with backup/restore guidance.
- README install section reorganized into Launcher, A0 Install, and direct Docker paths with A0 Launcher v0.9 download matrix.
Security Fixes
- LiteLLM upgraded to 1.88.1 (patches CVE-2026-42271)
- Starlette pinned to patched 1.0.1 for Host-header advisory
- OpenAI SDK pinned to 1.88.1
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v2.5 Legacy filesystem logs in /a0/logs are deleted on startup.
- v2.5 Launcher host access controls removed from Core WebUI.
- v2.5 Model presets become global; project-scoped definitions removed.
- v1.16 Legacy speech settings and APIs removed; use _kokoro_tts and _whisper_stt plugins instead.
- v1.14 Multi-action tools standardized around tool_args.action with backward compatibility
Beta — feedback welcome: [email protected]