astron-agent

v1.0.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 19d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agent agentic-workflow ai enterprise iflytek-astron llm

+8 more

low-code mcp multi-agent next-gen orchestration python superagent workflow

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 9d

Release v1.0.7 adds workflow automation scheduling and loop nodes while fixing skill‑script execution URL refreshes and team‑space data isolation issues.

Why it matters: Introduces schedule/loop capabilities for automating workflows; patches critical skill‑execution URL handling and resolves team‑space data sharing bugs, improving reliability.

Summary

AI summary

Added workflow automation scheduling, loop nodes, skill script sandbox execution, and team-space ownership validation.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Support Skill script execution in a third-party sandbox from Agent nodes. Support Skill script execution in a third-party sandbox from Agent nodes. Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Support workflow file artifacts generated by sandboxed Skill scripts. Support workflow file artifacts generated by sandboxed Skill scripts. Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Persist Ragflow dataset ID and route by ID. Persist Ragflow dataset ID and route by ID. Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Add workflow automation scheduling and workflow loop node capability. Add workflow automation scheduling and workflow loop node capability. Source: llm_adapter@2026-05-21 Confidence: high	—
Dependency	Medium	Updated RPA configuration for deployment/runtime consistency. Updated RPA configuration for deployment/runtime consistency. Source: llm_adapter@2026-05-21 Confidence: low	—
Dependency	Low	Update RPA configuration for consistent deployment and runtime behavior. Update RPA configuration for consistent deployment and runtime behavior. Source: granite4.1:30b@2026-05-22-audit Confidence: low	—
Performance	Medium	Keep traceback information when sending errors, improving troubleshooting visibility. Keep traceback information when sending errors, improving troubleshooting visibility. Source: llm_adapter@2026-05-21 Confidence: low	—
Performance	Low	Retain traceback information in error messages to improve troubleshooting visibility. Retain traceback information in error messages to improve troubleshooting visibility. Source: granite4.1:30b@2026-05-22-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fixed direct chat execution for workflow Agent nodes using Skills by refreshing Skill OSS presigned URLs before runtime execution. Fixed direct chat execution for workflow Agent nodes using Skills by refreshing Skill OSS presigned URLs before runtime execution. Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fixed workflow dialog display issues. Fixed workflow dialog display issues. Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Fixed team-space data sharing issues. Fixed team-space data sharing issues. Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Added ownership validation for space delete and update endpoints. Added ownership validation for space delete and update endpoints. Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Fixed CI-related issues. Fixed CI-related issues. Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Resolve team-space data sharing problems and add ownership validation for space update/delete APIs. Resolve team-space data sharing problems and add ownership validation for space update/delete APIs. Source: granite4.1:30b@2026-05-22-audit Confidence: low	—
Refactor	Medium	Added script sandbox provider card layout in resource management. Added script sandbox provider card layout in resource management. Source: llm_adapter@2026-05-21 Confidence: low	—
Refactor	Medium	Added clear fallback message when no script sandbox is configured. Added clear fallback message when no script sandbox is configured. Source: llm_adapter@2026-05-21 Confidence: low	—

Full changelog

Astron Agent v1.0.7

This release focuses on workflow reliability, automation capabilities, Skill script sandbox execution, team-space data isolation, and operational polish across the Astron Agent platform.

Highlights

Added Skill script sandbox execution support for Agent nodes, with E2B as the first third-party sandbox provider.
Added workflow artifact collection for Skill script outputs, allowing generated files to be uploaded to OSS and managed from the workflow file view.
Added workflow automation scheduling support, enabling workflows to be triggered and managed by schedule.
Added workflow loop node capability for iterative orchestration scenarios.
Persisted Ragflow dataset IDs and routed knowledge requests by dataset ID for more stable RAG integration.
Improved team-space data sharing behavior and strengthened ownership validation for space update/delete APIs.

New Features

Support Skill script execution in a third-party sandbox from Agent nodes.
- Resource management now includes a script sandbox configuration entry.
- E2B is supported as the first sandbox provider through the official SDK.
- Agent nodes can expose default run_skill_xxx tools and let the model decide when to invoke Skill scripts.
- Standard SKILL.md format is preserved; no runtime field is required.
Support workflow file artifacts generated by sandboxed Skill scripts.
- Script outputs are collected from the sandbox workspace, uploaded to OSS, and associated with the workflow.
- The workflow UI includes a file entry for viewing, downloading, and deleting generated artifacts.
Persist Ragflow dataset ID and route by ID (#1250).
Add workflow automation scheduling and workflow loop node (#1264).

Fixes

Fixed direct chat execution for workflow Agent nodes using Skills by refreshing Skill OSS presigned URLs before runtime execution, preventing expired SKILL.md download links from causing 403 failures.
Fixed workflow dialog display issues (#1294).
Fixed team-space data sharing issues (#1300).
Added ownership validation for space delete and update endpoints (#1302).
Fixed CI-related issues (#1309).

Improvements

Added a script sandbox provider card layout in resource management, leaving room for future sandbox providers beyond E2B.
Added a clear fallback message when no script sandbox is configured, so models can explain that administrators must configure a sandbox before Skill scripts can run.
Keep traceback information when sending errors, improving troubleshooting visibility (#1183).
Added governance documents (#1280).
Updated RPA configuration for deployment/runtime consistency (#1289).

Upgrade Notes

No breaking changes are expected for existing deployments.
To run Skill scripts, administrators must configure a script sandbox provider in resource management. E2B is supported in this release.
Teams using Skill scripts should verify sandbox configuration, artifact upload settings, and workflow file visibility after upgrade.
Teams using workflow automation or loop nodes should verify workflow execution behavior after upgrade.
Operators should pull the latest images and restart the deployment stack to apply this release.

Full Changelog

Changes are based on PRs merged into main since v1.0.6, plus the Skill sandbox execution and artifact-management work included in this release line.

Security Fixes

Added ownership validation for space update/delete APIs, preventing unauthorized modifications

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track astron-agent

Get notified when new releases ship.

About astron-agent

Enterprise-grade, commercial-friendly agentic workflow platform for building next-generation SuperAgents.

All releases →