Skip to content

escapeboy/agent-fleet-o

v1.26.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent-orchestration agentic-ai ai-agents ai-automation autonomous-agents claude
+14 more
crewai-alternative langgraph-alternative laravel livewire llm-workflow mcp-server model-context-protocol multi-agent n8n-alternative ollama openai php self-hosted workflow-automation

Affected surfaces

auth rbac

Summary

AI summary

Strip CRLF from tenant-supplied signature header names to prevent injection attacks.

Full changelog

What's changed

  • chore(release): 1.26.0 (34129246)
  • fix(ai): resolve sub-program teams to their dedicated LLM key (bf08afff)
  • fix(deploy): use getAttribute for team_id in context-git-sync model hooks (7825c5ae)
  • fix(sandbox,git-sync): symlink-safe teardown + serialize workflow YAML pushes (4cba192b)
  • fix: address QA + security review findings (kanwas-inspired) (9a5696de)
  • feat: kanwas-inspired sprint — unified timeline, git-backed context, sandbox observability, project snapshots (81046493)
  • fix(integration): dedup polled signals by source_native_id (fe734ce8)
  • feat(ai): dedicated provider for internal classification LLM (ff9c2353)
  • fix(signal): cap Sentry Watchdog batch + dispatch one job per team (6638a53d)
  • fix(integration): use valid Sentry search query for unresolved issues (4fb247e4)
  • feat(ai): dedicated sub-program platform LLM key (4833f4e5)
  • fix(signal): correct Sentry Watchdog signal matching and issue ingestion (5c4941b2)
  • fix(signal): team-aware intent classification, skip sentry source (9df37531)
  • feat(api): default agent provider/model to team-resolved platform default (4ef64b1d)
  • fix(mcp): annotate SentryWatchdogRunTool as destructive (75881a74)
  • fix(scheduler): remove ->sentryMonitor() — crashing cron check-ins (9599d8e9)
  • feat(integration): per-project scoping for the Sentry driver (6ebeac5d)
  • feat(signal): Sentry Watchdog — email digest channel (d5442724)
  • feat(signal): Sentry Watchdog — autonomous Sentry issue triage (8bacf675)
  • fix(sentry): raise cron monitor failureIssueThreshold to 4 (d879cd63)
  • fix(sentry): stop shadowing sentry-laravel's HubInterface binding (af2ae76a)
  • feat(sentry): cron monitoring, profiling, logs, MCP tool tags (bd58524c)
  • fix: resolve four Sentry issues — Builder/HAVING/pgvector/Alpine var (dc2a57b7)
  • feat(phoenix): complete pilot — hierarchy, sampling, masking, MCP, metrics, alert (8fdbcb56)
  • fix(ai-gateway): Phoenix exporter must speak protobuf, not JSON (9329d4b5)
  • feat(ai-gateway): add Phoenix OTLP export middleware (39437482)
  • fix(dashboard): add Gate::authorize to DashboardPage::setPersona (a169b9cf)
  • feat(memory): route extractors through proposal review pipeline (8e0c0c41)
  • chore: add circuit-breakers:reset command before branch sync (2809f4ec)
  • feat(mcp): auto-discover Tool classes from app/Mcp/Tools/** (d6de9b39)
  • fix(mcp): add #[IsDestructive] to 4 write-tier tools (b93458d8)
  • fix(mcp): add #[IsDestructive] to 4 write-tier tools (09380d18)
  • feat: borrow 5 ideas from prilog.ai (1c844ffa)
  • fix(mcp): rename notFound() to notFoundError() in governance sprint tools (787a6f40)
  • chore(phpstan): regenerate baseline to absorb develop debt (68a4d5ee)
  • chore: update CLAUDE.md boost guidelines (cf211e9d)
  • feat(bug-reports): admin UX improvements — reopen, edit, sort, dates, search (#81) (56be79ea)
  • fix(livewire): add Gate::authorize to BugReportDetailPage::saveEdit (cd23b259)
  • fix(ci): fix PHPStan errors and regenerate baseline (dd27034c)
  • fix(ai): use setex instead of set with array options in ComputeProviderRankingJob (3c046cc5)
  • fix(ai): use setex instead of set with array options in ComputeProviderRankingJob (a47b4606)
  • style: apply pint fixes — observability sprint files (8197ad20)
  • fix(deps): regenerate composer.lock — add prometheus + laravel-health (8b6fea71)
  • feat(bug-reports): admin UX improvements (18632774)
  • feat: SSE streaming + optimistic UI for agent status toggles, assistant panel, and step terminal (81e0918a)
  • fix: remove unsupported .minimum()/.maximum() JsonSchema calls from new MCP tools (f9961659)
  • feat: agent governance — auto-memory, credential domain allowlist, signal relevance scoring, strict protocol audit (eddb8263)
  • feat(mcp): add MCP tools for 5 determ-borrowed features (52507b31)
  • fix(crew/agent/shared): address review findings from determ-borrowed sprint (8df7aa20)
  • feat(crew/agent/shared): implement 5 Determ-borrowed patterns (3bcc4a8e)
  • feat(bug-reports): render markdown in comments (edde9dc8)
  • fix(observability): ignore stale circuit breakers in alert metric (e1b2b1b5)
  • fix(observability,bridge,ai): close 3 outstanding bugs from observability sprint (dd655c55)
  • refactor(ai): make teamHasProvider() protected so cloud can override (fb29b98d)
  • fix(observability): close known gaps + ship spatie/laravel-health checks (d7a728d0)
  • feat(observability): platform observability overhaul — Sprints 1-4 (21879e80)
  • feat(widget): refresh bundle + add auto-triage classifier (bug-triage Stage 2 + 3) (3fa42a5e)
  • feat: add reported_type column to signals (bug-triage Stage 1) (49bbc8de)
  • fix: unstick debug-track experiments from building state (fd626483)
  • feat(workflow,ui): node executor tests + approval inbox tier badge (7f0757fd)
  • feat(workflow): bug-fix-merge template + seeder + classify_pr_tier MCP tool (6eafa7c8)
  • feat(signal): wire bug-fix delegation to per-agent/team default workflow (2158244a)
  • feat(workflow): node executors + T4 floor invariant for PR tier merge (378c0c7d)
  • feat(workflow): add PrTierClassifier + foundation for tier-gated PR merge (cd85f0ce)
  • ci(phpstan): bump memory-limit 512M -> 2G (37d2bda1)
  • fix(phpstan): set maximumNumberOfProcesses=1 to avoid OOM in CI (6813b975)
  • fix: add IsDestructive annotation to 3 Release MCP tools (682873f4)
  • chore: regen phpstan baseline for entityhq-borrowed features (72f7ac36)
  • fix: pint formatting on signal_comments idempotency migration (c6b854f9)
  • feat: 4 full implementations of previously deferred items (bc7f5bcb)
  • feat: 10 out-of-scope EntityHQ items (1 deferred — GPG) (c02aa4c5)
  • feat: borrowed EntityHQ-inspired features (4 features) (ef920a32)
  • feat(signal): close bug-fix-agent loop on both ends — reporter follow-up + PR merge (4365fd0a)
  • feat(signal): idempotent add_comment via optional idempotency_key (dff78922)
  • fix(pipeline): use flat input_tokens/output_tokens cols in stage telemetry (b93d0629)
  • chore(tests): bump phpunit memory_limit 512M → 1G (fd251d3e)
  • style: pint trailing comma in ProviderHasApiKeyTest (2cf96aa2)
  • fix(ai-gateway): align providerHasApiKey field name with config/ai.php (6052c3d5)
  • test(seeders): pin Harbormaster popular-tool entry shape (#76) (e3a50f49)
  • feat(seeders): register Harbormaster as a popular MCP stdio tool (#75) (6ce1a3cf)
  • feat(bridge): SSE streaming consumer for HTTP-mode bridges (5747554c)
  • fix(signal): route bug-report delegation through canonical state machine (5bd57eee)
  • fix(bridge): pass 4xx daemon errors through, drop generic 502 wrap (#73) (2a8f029e)
  • chore(mcp): bump tools/list page size 300 → 1000 (19ed3a27)
  • feat(bridge): HTTP-direct MCP routing for HTTP-tunnel-mode bridges (3f446842)
  • fix(test): apply Pint concat_space style to Redis isolation block (1ca0f4b3)
  • fix(test): isolate Redis cache DB per paratest worker via TEST_TOKEN (3211940d)
  • fix(test): TeamFactory slug must be unique to avoid SQLite UNIQUE constraint flake (e866d49d)
  • test(mcp): catch attribute namespace bugs via newInstance() in schema test (c81aef15)
  • feat(console): add opcache:clear command (c99b2f7d)
  • fix(mcp): replace null-bind hack with real McpTeamBinding middleware (067deb00)
  • fix(mcp): unblock Barsy bug-fix-agent — schema drift + null-bind null-blindness (563ae422)
  • fix(signal,ai): valid ExperimentTrack + per-agent MCP for non-VPS Claude Code (022ebaf2)
  • fix(local-agents): relay discovery must not depend on local_agents.enabled (e5cbfb01)
  • style: pint fully_qualified_strict_types on Credential @property docblock (d845d9f5)
  • fix(phpstan): unblock CI on develop — Credential @property + 1Password fallout (1d52d66c)
  • fix(bitbucket): drop redundant credential_type guard, harden secret_data typing (35a01245)
  • style: pint fix no_multiline_whitespace_around_double_arrow in BitbucketToolsTest (64b55653)
  • feat(bitbucket): basic-auth driver + 4 MCP tools for bug-fix-agent (dbc5993b)
  • feat(auth): passkey login flow on /login (1Password / Apple Keychain / Hello) (3b3c1fee)
  • feat(1password): functional CLI-backed integration + site-compat hygiene (41b347d1)
  • style: pint autofix HttpRequestNodeExecutor (CI green) (dbc4b303)
  • fix(security): strip CRLF from tenant-supplied signature header names (31591bc2)
  • feat(workflow,webhook): close FleetQ Finance migration gaps (8a040029)
  • fix(mcp): accept Sanctum tokens at /mcp HTTP endpoint (5a8ce262)
  • fix(docker): pivot to mcp-remote wrapper — connects to user's real FleetQ (813097b6)
  • fix(docker): slim Glama Dockerfile — drop unused exts, ignore platform reqs (f7544867)
  • fix(phpstan): drop redundant array_values, fix Redis::set ext-redis args, drop dead ?? on int return (798c652b)
  • refactor(mcp/compact): TDQS-friendly tool descriptions for Glama AAA (91d8ca60)
  • feat(glama): root Dockerfile + stdio MCP boot for Glama AAA (c9fa5e30)
  • style: pint autofix (7 files) — CI green (8f0bd66c)
  • feat(ai-gateway): Tier A — per-request BYOK override + cost/latency ranker (a6e4aeb5)

Upgrade

git fetch --tags origin
git checkout tags/v1.26.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.

Security Fixes

  • fix(security): strip CRLF from tenant-supplied signature header names (31591bc2)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track escapeboy/agent-fleet-o

Get notified when new releases ship.

Sign up free

About escapeboy/agent-fleet-o

AI Agent Mission Control with 200+ MCP tools. Manage agents, experiments, workflows, crews, skills, and more via stdio + HTTP/SSE. Self-hosted, open-source (AGPL-3.0)

All releases →

Beta — feedback welcome: [email protected]