This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryConsolidated goal tool replaces separate modules while preserving existing behavior.
Full changelog
Agent Zero Release Notes
-
Consolidated goal tool — Replaced the separate create, get, update, and storage modules with a single multi-action goal tool while preserving the slash command, API, goal strip, and active-goal response behavior.
-
Resumable, secret-safe chat compaction — Compaction now preserves authorization, evidence, pending work, loaded skills, and secret references in a fixed resumable-state summary. The stale context-window cache is cleared after compaction.
-
Smarter runtime secret redaction — Masking of
usr/.envvalues is now limited to API keys and login/password credentials, preventing ordinary settings from corrupting chat text. Global and project secrets remain fully protected. -
Shell and SSH process exits handled as completion — Terminated local, SSH, and TTY shells are now detected and treated as definitive command completion. New
is_terminatedandget_exit_codehelpers are available across session types. Terminated sessions are recreated lazily before the next command. -
Deferred task resource cleanup — Callables and arguments are now released after task completion or cancellation, preventing retained references. Child tasks are cleaned up and best-effort destructors added for local and SSH sessions.
-
Paramiko import traceback leak fixed — Cleared a stale traceback retained by Paramiko's optional-import cache that was keeping the code-execution tool-loading stack and first agent in memory.
-
Chrome Web Store extension installs fixed — Redundant same-version reinstalls are skipped, updates are staged before replacing files, and active browser runtimes are restarted safely.
-
Stabilized internal Docker browser rendering — WebUI navigation now returns after the initial document commit, socket timeouts align with browser command deadlines, and cropped or mismatched screencast frames are rejected to prevent viewport stretching.
-
Inline confirmation for extension deletion — The native confirm dialog is replaced with the shared inline confirmation UI, with proper escaping of extension names.
-
Page-tail history snapshots for connectors — Interactive clients can now receive a bounded tail snapshot and cursor-based older pages. Clients that do not request history hints still receive complete replay.
-
Hardened malformed response and tool handling — Missing or malformed response arguments now raise a repairable exception instead of exposing a
KeyError. Fenced or structurally broken tool intent is routed through the existing misformat repair path so streamed chats no longer stall in a thinking state. -
Stabilized WebUI mount geometry — Added responsive shell styling with a 250 px desktop sidebar that yields to the mounted left panel and collapses on mobile. The welcome composer now reserves its final height during hydration.
-
Launcher download links updated to v1.4 — README and platform installer links now point to the published v1.4 Launcher artifacts.
Breaking Changes
- Removed separate `create`, `get`, `update`, and `storage` goal modules; replaced with a single multi-action goal tool while preserving slash command, API, goal strip, and active-goal response behavior.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v2.5 Legacy filesystem logs in /a0/logs are deleted on startup.
- v2.5 Launcher host access controls removed from Core WebUI.
- v2.5 Model presets become global; project-scoped definitions removed.
- v1.16 Legacy speech settings and APIs removed; use _kokoro_tts and _whisper_stt plugins instead.
- v1.14 Multi-action tools standardized around tool_args.action with backward compatibility
Beta — feedback welcome: [email protected]