This release includes breaking changes for platform teams planning a safe upgrade.
Published 1mo
AI Agents & Assistants
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
a2a
agent
agent-framework
agent-os-desktop
agent-skills
agentic-ai
+13 more
agentic-workflow
agentos
agents
agents-team
agentshub
ai-agents
autonomous-agents
llm
llm-agents
llm-tools
mcp
multi-agent-systems
ochestration
Affected surfaces
breaking_upgrade
Summary
AI summaryOne-touch installs stamp release markers, update cache writes become race‑safe, runners ignore shadow packages, and stale plugin caches self‑heal.
Full changelog
- One-touch installs now stamp plugin release markers. Fresh installs write
RELEASEand Python shims into Claude Code and Codex plugin cache
directories, and the one-touch verifier now fails ifupdate --checkdoes
not reportcurrent. - Update cache writes are race-safe. Manual
hephaestus update --checkand
fail-silent background auto-update no longer share the same temporary JSON
filename. - Bundled runners ignore shadow packages in the working directory.
bin/hephaestusnow forces its own runtime root to the front of Python's
module path, so a project checkout with anotheragentlas_cloud/folder does
not hijack the installed runner. - Self-healing updates for stale plugin caches.
hephaestus updatenow
recovers runtimes with noRELEASEmarker and refreshes existing Claude Code
and Codex plugin cache directories in addition to the neutral
~/.agentlas/runtime/currentinstall. - Non-interactive
/hep-uploadno longer stalls. After Cloud or Agentlas
Hub has been chosen,hep-upload <agent-folder> --visibility private-link
and--visibility marketplacerun through the bundled publisher without
requiring an interactive TTY. - English README language cleanup. Removed Korean examples from the English
README command table and changed the language selector label to English. - Deterministic
/hep-buildteam shape gate. Added
scripts/verify-team-package.shplus valid/degenerate fixtures so generated
packages must be either onesingle-agentworker or a real team with
orchestrator/HQ, topology, memory, policy, eval, QA, and one HQ command. - Ownership-boundary single vs team classifier. Documented the 0-3 step
classifier across canonical skills, modes, command adapters, and mode map so
/hep-buildno longer treats the word "team" as enough evidence by itself. - Plain-language clarify questions. Builder interview and clarify surfaces
now ask ordinary user-facing questions about whether one expert can do the
job or several experts must split and merge it, while internal labels such as
ownership boundary, memory/context, and produces/consumes stay hidden. - Agentlas Cloud/Network personalization contract. Documented the remote
Agentlas Web/MCP behavior where signed-in/hep-networksearches Cloud,
then bookmarks, then public Hub, while/hep-cloudremains Cloud-only. - Workspace-scoped borrowed-agent memory. Added the implemented storage
contract for Agentlas Web agent bindings, overlays, promoted memory items,
promoted playbook cards, plugin locks, retrieval receipts, run events, and
self-evolution proposals. Public Hub packages are not mutated by one
workspace's personalization. - Runtime bundle overlay boundary. Clarified that Cloud/Hub bundles may
receive bounded workspace overlays and receipt ids, but raw prompts,
transcripts, secrets, credential values, and private local files are not
durable personalization records.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Hephaestus
Open Agent OS for Claude Code, Codex, and Cursor with a meta-agent builder, A2A Hub routing, local ontology, and memory/security gates. Apache-2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]