v2.10

Agent Zero Release Notes

Internal Browser

• Bot-detection hardening — Chromium now runs headful through Patchright on a private Xvfb display, with page helpers isolated in Patchright's own world. Package pinning ensures fresh Docker images and self-updated installations converge on the same runtime.
• Interactive viewport — The internal Browser page is rendered through an authenticated Xpra session with CDP screencast and snapshot fallbacks. Chromium is kept out of fullscreen, native viewport resizing is synchronized across canvas and modal handoffs, and Xpra decoration and cursor artifacts are removed.
• Shared runtime — All chats now route through one persistent Chromium, Xvfb, and Xpra runtime. Sign-ins are shared across chats; tab ownership and per-chat limits remain context-bound. Only the owning chat's tabs are closed on reset or removal.
• Automatic tab restore — Browser tab ownership and URLs are persisted in the shared KVP store. Tabs are restored automatically for per-chat and shared scopes without showing Chromium's crash advisory.
• Browser model preset — The selected Browser preset is now activated after the first Browser tool call so follow-up model turns use it, with the main model preserved as a safe fallback.
• Startup and annotation improvements — Tab loading feedback stays stable and visible during interactive Browser startup. DOM hover feedback, multi-page annotation batches, compact composer-style controls, and shared Whisper draft-or-send behavior have been added.
• Simplified setup concurrency — Dependency reconciliation, cache migration, and Chromium installation are consolidated under a single setup lock.

Responses & Streaming Fixes

• Responses tool call completion — Function calls emitted during streaming are now recovered when a terminal Responses event omits them. The final response tool advertises a strict text-only schema across agent profiles.
• Codex OAuth utility responses — Completed SSE output items are preserved when the final Codex response envelope omits them, so non-streaming utility calls retain their generated text.
• Scoped strict response schema — The strict text-only response contract is now applied only at the Codex OAuth request boundary, keeping generic Responses tool schemas provider-neutral.

Agent & Subordinate Lifecycle

• Unified subordinate lifecycle — Direct and parallel call_subordinate execution now share one reusable, persisted child-context lifecycle. Failed children remain resumable with reset=false, and sibling reuse, recursive numbering, persistence, and nested task ownership are covered.

WebUI & Composer

• Scoped composer references — The WebUI composer now supports inert @ references for scoped profiles, tool policies, skills, and workspaces.
• Per-chat composer drafts — Unsent composer text is stored per chat in session storage and restored when switching contexts or refreshing the page. The Welcome composer prompt is preserved when its first send creates a chat.
• Goal mode shortcut — A Goal mode action in the composer popover prefills the /goal command and focuses the input.
• Scoped plugin changes no longer trigger reload prompts — Frontend reload notifications are now reserved for global plugin changes that affect the loaded WebUI bundle; project- and agent-scoped changes refresh silently.

Extensibility

• Bundled ACP session bridge — Agent Zero ships a built-in ACP bridge with an editor-hosted A0 CLI transport. A startup migration removes retired a0_acp installations and scoped overrides.
• Standalone user API and WebUI routes — usr/api is available as a contained fallback after built-in and plugin handlers. usr/extensions/webui assets are served from an authenticated, root-contained namespace while built-in extension paths remain unchanged.

Fixes & Infrastructure

• Backup restore preserves allowed origins — Restoring a backup created at a different URL no longer locks out the new instance; ALLOWED_ORIGINS on the destination is preserved.
• Pinned Docker desktop packages — LibreOffice and Xpra releases are pinned to the last successful multi-architecture build. The base image snapshot is locked to prevent Python 3.14 from being pulled into ready images.