[pull] main from agent0ai:main - #4
Open
pull[bot] wants to merge 1576 commits into
Open
Conversation
Move device-code, manual callback, and setup controls into the provider row that started the OAuth flow so pending state stays anchored to its provider. Add static coverage and plugin DOX guidance for inline provider detail rendering.
Update the OAuth settings poller to wait for the provider interval, carry slow_down interval updates forward, and respect provider expiration times so GitHub Copilot device-code auth can complete after browser authorization. Dispatch the legacy device-login endpoint by provider_id and add regressions plus DOX guidance for provider-aware device polling.
Normalize active Remote Control URLs to same-origin values before adding them to CSRF allowlists, so Tailscale Funnel URLs with paths or trailing slashes can bootstrap tokens correctly. Allow WebSocket origin validation to trust only the currently active Remote Control origin, including Docker split-process tunnel service URLs, while preserving rejection for unrelated external origins. Add focused regression coverage for active Tailscale-style origins, tunnel-service origin lookup, and negative cross-origin cases; keep run_ui decorator re-exports compatible with existing CSRF tests.
Open the Editor file browser from the active project context before falling back to the configured workdir. Keep manual Editor launches on the empty start page instead of auto-creating blank Markdown files, while preserving explicit Markdown creation from the empty state. Add static regression coverage for both behaviors.
Move the Editor preview/source toggle into the left-side toolbar cluster so mode switching sits with editing controls. Add a dedicated right-side Save button and remove Save from the overflow menu, leaving the menu for rename and close actions. Cover the toolbar placement with a static regression test.
Add direct directory navigation to the file browser path bar and preserve the current listing when typed paths fail. Add a default-enabled setting to remember the last successful file browser directory, while keeping explicit open paths deterministic.
Add comprehensive file-level DOX documentation across the repo and update directory AGENTS.md indexes. Many new `*.py.dox.md` files were added under api, helpers, tools, plugins, extensions, webui, and other dirs to document endpoint purpose, ownership, runtime contracts, work guidance, and verification. Several AGENTS.md files were created or updated (agents profiles, api, docker, extensions, helpers, plugins, skills, webui components, etc.) to list child DOX files and clarify documentation/work guidance. Also add example and bundled profile DOX files (agent0, default, developer, hacker, researcher) and minor updates to helpers/dirty_json.py and its tests. These changes improve on-disk documentation coverage and establish the convention that each direct runtime file should have a matching `*.dox.md` describing its contracts and verification steps.
Add a core startup migration that refreshes /exe/self_update_manager.py from the repository copy when the installed runtime updater is missing the socket-safe backup and Desktop cleanup markers. Validate the source updater before replacing anything, preserve the previous runtime script as a backup, and leave current or non-regular targets untouched. Add regression coverage for stale runtime replacement, safe no-op/refusal paths, and the real repository updater source.
Add settings sidebar search with filtered section results and clear affordance. Decouple sidebar accordion expansion from the active section so groups can be opened or collapsed manually. Keep the settings menu/search column fixed while the content pane scrolls, and promote Backup & Restore to its own section under Self Update.
Add selectable workspace support to the Time Travel plugin and introduce normalized global LiteLLM configuration handling. models.py: add DEFAULT_LITELLM_GLOBAL_KWARGS and helpers to normalize, load, apply, and merge LiteLLM global kwargs; call configure_litellm/set per-call merges in LiteLLM wrappers so framework defaults, configured globals, and per-call overrides combine correctly. Add tests to assert merging and runtime application. plugins/_time_travel: update docs and plugin metadata to describe workdir/project selection. API handlers now accept workspace_id and a new history_workspaces endpoint lists selectable workspaces. helpers/time_travel: implement workspace listing, selection, and resolution logic (workdir/project options, availability/locking, default selection). UI: add workspace picker to time-travel panel, wire selection/load into time-travel store, pass workspace_id to API calls, and add click hook to open the panel. Update styles and refresh/load behavior accordingly. Tests: extend tests for LiteLLM global kwargs merging and adapt stream test to expect merged params; add tests for selectable workspaces, default selection, and locked external workdir handling.
Add project-scoped MCP server configuration with global/project merge semantics, a richer settings UI, and chat composer access. Introduce MCP config scanning plus project-aware status/detail/log/apply APIs while preserving the raw JSON editor. Strengthen MCP runtime handling for dotted tool names, timeouts, status accuracy, and project-aware tool execution, with focused regression coverage.
Revamp the global and project MCP manager surfaces with list-first layout, clearer examples, a dedicated scanner modal, manager/raw toolbar parity, and local-command-first server creation.\n\nAdd server and tool search, plugin-style enable toggles, per-tool disabled_tools handling in the MCP backend, internal A0 MCP tool search, regression coverage, and updated DOX contracts.
Use the shared inline confirmation helper for configured MCP server removal and keep the delete icon neutral until confirmation.\n\nApply confirmed removals immediately, refresh server status from the apply response, guard against stale/double actions, and document the new MCP manager behavior.
Route Agent Zero turns through a LiteLLM transport layer that prefers the Responses API while preserving chat-completions fallback for providers without compatible endpoints. Persist Responses metadata in history and agent state so provider-state continuation, local replay, native function-call execution, and stored-response cleanup survive normal chat workflows. Normalize prompt caching by provider: OpenAI and Azure use prompt_cache_key and prompt_cache_retention, while Anthropic, Gemini, Bedrock, OpenRouter, and compatible chat providers keep block-level cache_control breakpoints and cached tool definitions.
Upgrade LiteLLM to 1.88.1 so Agent Zero is above the CVE-2026-42271 patched floor, and move the OpenAI SDK pin to 2.41.1 to satisfy LiteLLM's new dependency range. Pin Starlette to the patched 1.0.1 release for the Host-header request.url.path advisory. Fold requirements2.txt back into requirements.txt now that browser-use is no longer part of the repo dependency set, and update installer and setup docs to use a single requirements file.
…production feat: major improvements to native Telegram integration UX and streaming
Teach the Responses fallback classifier to inspect status codes, wrapped exception types, and response bodies so LiteLLM NotFoundError wrappers that hide the /v1/responses URL still fall back to chat completions. Keep rate-limit errors non-fallback and add a regression test for the OpenAIException detail-only 404 shape observed with providers that do not expose the Responses API.
Ensure native browser controls use the shared Rubik font token so Firefox no longer falls back to its UI font in form elements.\n\nImport Rubik on the login page and document the WebUI font contract, keeping mono aliases reserved for code and fixed-width data.
Treat model-slot kwargs as provider-specific preset fields: applying a preset now replaces explicit kwargs and clears inherited kwargs when the preset omits them, while preserving durable tuning like context windows and rate limits. Mirror the behavior in the WebUI preset merge helper and add regressions for Codex-like presets so unsupported parameters such as temperature cannot leak into Responses API providers.
Make Telegram tool lifecycle hooks no-op for contexts that do not expose a raw data dict or do not carry the Telegram bot marker. This keeps global tool extension dispatch safe for non-Telegram contexts, including Responses API tool-call regression tests, without changing behavior for real Telegram sessions.
Wrap FastA2A agent card generation so Agent Zero advertises streaming support on A2A endpoints by default. Add focused regression coverage for the agent-card capability rewrite and proxy wiring, and update the helper DOX profile for the new wrapper.
Limit LiteLLM module mutation to documented global switches such as drop_params, while preserving configured LiteLLM kwargs as per-call options. Avoid freezing global kwargs into provider defaults so runtime settings remain current, and extend focused tests for drop_params, additional_drop_params, and provider default behavior.
- add a parallel wrapper and runtime for concurrent background tool calls - run parallel call_subordinate jobs as child chats with visible subagent steps that match normal subordinate args - render parallel child tool steps with normal tool-call args while keeping job handles in wrapper results and prompt extras - group parallel child chats in the sidebar with persistent accordion and caret behavior - add prompt, extension, DOX, and regression coverage
- document that parallel accepts full reply-shaped tool call objects and ignores planning-only fields - steer prompt guidance toward one mixed batch for ready independent calls instead of splitting by tool type - add normalization and prompt regression coverage plus matching DOX notes
Hide A0 connector remote tool prompts unless a connected CLI advertises the matching capability. Remote file access enables text_editor_remote, F4-enabled remote execution enables code_execution_remote, and supported enabled Computer Use that is not in rearm-required state enables computer_use_remote. Apply the same gate to Responses API function-tool generation, move the prompt hook to the active tool-prompt extension path, and update connector prompt wording, DOX, and regression coverage. Verified with: - conda run -n a0 pytest tests/test_a0_connector_prompt_gating.py tests/test_default_prompt_budget.py tests/test_responses_architecture.py -q
Delete the Core WebUI gateway menu and its client-side control store so Host access stays owned by A0 Launcher. Keep /computer-use informational in WebUI and direct users to Launcher or A0 CLI for host changes.
Include usr/.env in the agent-facing SecretsManager sources so runtime credentials are masked in tool results, history, logs, and streamed output. Keep the writable default secrets manager scoped to usr/secrets.env. Add regression coverage for dotenv masking and document the source contract.
Serialize extension discovery requests to avoid exhausting embedded Chromium request resources. Always clear component loading placeholders after failures and add focused regression coverage.
Decorate unified_call and unified_turn so community plugins can observe the real logical model-call boundary. Add focused coverage for the generated start and end extension points.
Point the root README's A0 Launcher downloads and release note link at the published v1.3 assets without moving the Agent Zero v2.4 tag.
This reverts commit bf2046f.
Replace the separate create, get, update, and storage modules with one multi-action goal tool while preserving the slash command, API, goal strip, and active-goal response behavior.
Preserve authorization, evidence, pending work, loaded skills, and secret references in a fixed resumable-state summary. Clear the stale context-window cache after compaction and cover the prompt and persistence contracts with focused tests.
Filter usr/.env masking to API keys and login/password credentials so ordinary settings cannot corrupt chat text. Keep global and project secrets protected, and cover full-response, prompt, and streaming behavior with a regression test.
Detect and treat terminated local/SSH/TTY shells as definitive command completion. Add is_terminated and get_exit_code helpers to LocalInteractiveSession, SSHInteractiveSession, and TTYSession; expand _is_closed_pty_error to recognize exited TTY processes. CodeExecution now reports a shell-exit prompt, recreates terminated sessions lazily before the next command, and returns immediately when a shell has exited. Docs and README updated to describe strict-mode/exit behavior, and tests were added/updated to cover the new termination detection and handling.
Clear DeferredTask callables and arguments after completion or cancellation while running each invocation from a safe private snapshot. Preserve result retrieval and active restart behavior, clean up child tasks, and add best-effort local and SSH session destructors with focused lifecycle regression coverage.
Paramiko caches its optional invoke import error with the original traceback, retaining the code-execution tool-loading stack and first agent. Clear only the stale traceback while preserving the exception, and add focused regression coverage.
Skip redundant same-version reinstalls and stage updates before replacing extension files. Show clear install progress, offload blocking work, and restart active browser runtimes safely.
Return WebUI navigation after the initial document commit and align the socket timeout with browser command deadlines. Remove forced viewport nudges and reject cropped or mismatched screencast frames so tab changes and pointer movement do not stretch the viewport.
Replace the native confirm dialog with the shared inline confirmation UI. Escape extension names before rendering the destructive prompt.
Serve a bounded tail snapshot and cursor-based older pages for interactive clients. Preserve complete replay for clients that do not request history hints.
Raise RepairableException when response lacks a top-level text or message string. The existing recovery path now warns the model to correct the call instead of exposing a KeyError, while preserving legacy message arguments.
Require complete standalone text requests for execution while accepting supported text-tool formats. Route fenced and structurally broken tool intent through the existing misformat repair path so streamed chats do not remain in a thinking state.
Add responsive shell styling for a 250px desktop sidebar slot that yields to the mounted left panel and collapses on mobile. Reserve the welcome composer's final height while nested input components hydrate, and document that component-local layout contract.
Point the README release page and platform installers to the published v1.4 Launcher artifacts.
Route native Responses output text through the normalized response-tool executor instead of ending the monologue directly. Preserve active goal overrides and Responses state cleanup, wait for complete native streams, and reject empty response payloads.
Guard partially parsed tool arguments while streaming and render both text and legacy message response fields. Keep live response logs synchronized without allowing incomplete code arguments to raise.
Explain that fenced examples are documentation-only and make the canonical response example match the required wire format. Add focused guardrails for the rendered instruction and unfenced example.
Keep fenced examples readable in prompt Markdown while removing only JSON fence markers from the final assembled system prompt. Cover all bundled profiles and preserve non-JSON fences.
Configure Cerebras as a native LiteLLM provider using Chat Completions and its live model catalog. Expose Cerebras in onboarding with API-key guidance, a production default model, and a bundled logo, with focused provider and UI coverage.
Require verified window focus before target-bound typing and report remote computer-use receipts from observed evidence.\n\nGuide agents through scoped snapshots and focus verification while refusing window presses and identical failed-action retries.
Keep response tool calls at the top level so they can end the parent message loop instead of forcing an unnecessary follow-up turn.\n\nDocument the parallel constraint and cover both runtime rejection and prompt guidance.
Normalize the legacy reasoning_effort field at the Codex Responses proxy boundary so it cannot reach the upstream endpoint in an unsupported shape. Preserve an explicit native reasoning object and cover alias conversion and precedence with regression tests.
Add project-scoped HTTP and SOCKS proxy settings for the internal Docker browser, including bypass and optional authentication. Pass them through Playwright's native proxy option, restart active Browser runtimes when they change, and update regression coverage and user documentation.
Place the internal Browser proxy fields in a native disclosure and keep its styling borderless. Refresh the guide screenshot and cover the config markup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )