This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+3 more
Affected surfaces
Summary
AI summaryUpdates What's New, Sharper Everyday Tools, and Real Multi-User Isolation across a mixed release.
Full changelog
DeepTutor v1.4.3 Release Notes
Release Date: 2026.06.12
The biggest release since v1.4.0. TutorBot grows up into
Partners, Chat collapses into a single agent loop, multi-user gets real
per-user isolation, and Visualize, Co-writer, the file viewer, document
parsing, and the CLI all level up. The docs at
deeptutor.info have been rebuilt alongside —
every Partner channel now has its own setup guide, in English and Chinese.
Upgrading from TutorBot? Migration is automatic and non-destructive:
on first start your bots become Partners — channel configs (secrets
included), model selection, and the soul library carry over, and each
bot's persona becomes itsSOUL.md. The olddata/tutorbot/tree is
left untouched, so rolling back stays safe. One breaking change: the
HTTP API moved from/api/v1/tutorbot/...to/api/v1/partners/...—
update any scripts that call it. The[tutorbot]pip extra keeps
working as an alias for[partners].
What's New
TutorBot → Partners
Your bots are now Partners — same idea, much stronger execution:
- Partners run on the same agent loop as product Chat (the separate
nanobot engine is gone), so every Chat improvement reaches your IM bots
automatically. - Production-grade message pipeline: send retries, dedup, coalescing, and
a per-channel delivery matrix. - Live streaming replies on Telegram, Discord, and Feishu — answers
render as they are generated. - New WeCom AI Bot channel; 15 channel connectors total, from Slack
and Discord to DingTalk, QQ, and WhatsApp. - Web chat now takes attachments — drop images or files straight into
a Partner conversation. - A rewritten soul template library with an in-app editor.
One Loop for Chat
The two-phase targeting/respond pipeline is gone. Chat now runs a single
exploring agent loop with native tool calling end to end — fewer moving
parts, smarter tool use, no more mis-routed turns. A new Activity
header keeps the status line pinned on top and folds the thinking/tool
trace away once the answer lands.
Real Multi-User Isolation
- Per-user grants v2: tools, MCP servers, and exec access are controlled
per user from the admin UI. - Workspace layout moves to
data/users/<uid>+data/system; existing
deployments migrate automatically. - The exec runner mounts only the calling user's workspace subtree (new
Dockerfile.runner), so sandboxed code never sees another user's files.
Visualize, Rebuilt
Inline, theme-aware SVG rendering; structured prompts; and a local
validate + repair pass replacing the old full-round LLM review — faster,
cheaper, and far fewer broken diagrams. Fullscreen now works for every
visual type.
Sharper Everyday Tools
- Co-writer renders flowcharts and sequence diagrams via Mermaid, and
selection-scoped questions can pull from your knowledge base and the web. - File viewer: true in-browser docx/xlsx previews, drag-to-resize, and
the Activity panel now lives alongside your open files. - MinerU cloud parsing as an alternative to the local backend
(/settings/mineru), and question extraction now captures question
type, difficulty, and answers. - Office skills work out of the box — docx/pdf/pptx/xlsx generation no
longer requires flipping a sandbox switch. - CLI chat, rewritten: aligned with the new loop protocol, interactive
ask_userprompts in the terminal, Ctrl-C cancellation, and collapsible
thinking output.
Fixes That Matter
Qwen models no longer leak JSON wrappers into answers, Windows installs
get UTF-8 right, Zulip bots catch mentions reliably, and a
file-descriptor exhaustion bug plus false-positive health checks are gone.
Docs, Synced
deeptutor.info was rebuilt with this release:
a dedicated setup guide for every Partner channel (English + 中文),
refreshed screenshots throughout, and updated CLI and server API
references.
Upgrade Notes
pip install -U deeptutor— the migrations run automatically on first
start, and all of them are idempotent.- Legacy
multi-user/trees move todata/users/in place; TutorBot
bots become Partners (see the note at the top). - Exec-based skills now allow subprocesses by default. To restore the old
behavior, setsandbox_allow_subprocesstofalsein system settings.
Full Changelog: https://github.com/HKUDS/DeepTutor/compare/v1.4.2...v1.4.3
Breaking Changes
- HTTP API endpoint moved from `/api/v1/tutorbot/...` to `/api/v1/partners/...`
- Workspace layout migrated from `data/multi-user/` (or similar) to `data/users/` and `data/system/` automatically
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v1.4.5 Guided Learning rebuilt as tutor chat with hard mastery gate; old fixed-stage flow removed.
- v1.4.0-beta Deletes the legacy main.yaml capability copy; each capability now uses its own prompt files
- v1.4.0-beta Removes legacy main.yaml capability copy in favor of per-capability prompt files
- v1.4.0-beta Removes legacy agents/ and prompts/ directories for research, solve, question modes
Beta — feedback welcome: [email protected]