This release adds 3 notable features for engineering teams evaluating rollout.
Published 2mo
AI Agents & Assistants
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
agentic-ai
ai-agent
anthropic
autonomous-agents
llm
claude
+6 more
discord-bot
mcp
model-context-protocol
self-hosted
telegram-bot
typescript
Affected surfaces
rce_ssrf
breaking_upgrade
Summary
AI summaryUpdates 1.12.0, Bug Fixes, and 2026-05-18 across a mixed release.
Full changelog
1.12.0 (2026-05-18)
Features
- backend: add Codex as a fourth backend provider (#174) (7d476b9)
- backend: add Kilo CLI as backend provider (#161) (9263611)
- backend: add OpenAI Agents SDK as fifth backend (#199) (d9a6e90)
- backend: Kilo 1:1 with Claude SDK + shared framework + backend registry (#169) (9ef3689)
- claude-sdk: add Notification and StopFailure hooks for SDK telemetry (#128) (63c9cb8)
- cli: setup wizard prompts for Discord bot token + applicationId (#185) (ed36c04)
- cli: setup wizard supports backend selection + Discord frontend (#180) (8a9fb78)
- codex: factory cleanup hook + expanded conformance + parity log line (#177) (077cf3b)
- codex: friendly startup warning when no auth source available (#182) (5842517)
- codex: runOneShotAgent + full model registry + 4-way registry parity tests (#175) (44ab734)
- codex: set sensible ThreadOptions defaults — sandbox / approval / network (#183) (85e0d8c)
- discord: show backend label in /status header (#191) (d10cbea)
- frontend: add Discord frontend (discord.js v14) (#160) (625148c)
- handlers: surface user-quoted portions from reply context (Bot API 7.0) (#157) (92210ec)
- heartbeat: outbound telegram — explicit chat_id routing (#150) (77e7771)
- picker: backend-agnostic model picker — provider groups, persisted free filter, decoupled /settings (#207) (91df6a9)
- telegram: show backend label in /status header (#184) (9d18672)
- tools: expose Talon MCP tools to the Discord frontend (#203) (a4a1ae3)
- triggers: add persistent triggers that survive Talon restarts (#201) (40f4dd7)
- triggers: self-authored watcher scripts that wake the bot (#96) (cafc8d4)
Bug Fixes
- heartbeat: evict wedged SDK subprocesses, never deadlock the lock (#144) (d17a4eb)
- heartbeat: frontend-agnostic outbound + comprehensive test coverage (#151) (85251d3)
- kilo: make the chat flow actually work end-to-end (#170) (8286706)
- openai-agents: isolate config from generic OPENAI_* env vars (#206) (fc16cb2)
- six correctness and safety bugs (timer leak, HTML injection, log component, flush consistency, status regex) (#156) (7530244)
- telegram: escape backend modelDetails so /model and /settings render (#164) (01f59ed)
- tools: chat_id schema accepts negative IDs for groups/channels (#153) (9298246)
- tools: mark react as a turn terminator (endsTurn: true) (#148) (afb03ef)
- tools: preserve Discord snowflake IDs in tool input schemas (#204) (f46efce)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Talon
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]