v0.7.0

What's Changed

158 commits

New Features (10)

• Image Lightbox — full-featured image viewer with prev/next navigation, thumbnail sizing, and download button for chat images and artifacts. Browse visual content inline without opening new tabs or losing context.
• Anthropic API Format Translation — the LLM client now translates between OpenAI and Anthropic API formats, configurable per-model via an API format dropdown in the model modal. Connect Claude and other Anthropic-compatible models natively without a proxy.
• Per-Agent Run-As-User Isolation — configure a Linux user per agent for bash and runpy execution, with environment variables preserved across sudo boundaries. Each agent runs sandboxed under its own OS account.
• Ctrl+G Agent Quick Search — keyboard-driven overlay for instant agent search and navigation. Type a partial name and jump directly to any agent without touching the mouse or leaving the current page.
• Scheduler Auto-Extend Trigger — new trigger type that automatically extends running schedules, enabling perpetual scheduling patterns without manual renewal.
• List Artifacts Tool — new tool lets agents browse their artifact directory. Automatically granted to any agent that has the save_artifact tool.
• Agent Sidebar Unread Indicators — a blue dot and selection ring on sidebar avatars show which agents have pending responses, so you never miss a completed task while browsing elsewhere.
• /shutdown Slash Command — super agents can cleanly shut down the entire Evonic server from within a conversation, no terminal access needed.
• Workplace CLI Subcommand — manage workplaces from the command line with evonic workplace: list, inspect, and configure workplaces without the web UI.
• Scheduler Log Tab — the scheduler detail view now includes activity execution details, captured output, and timing for each scheduled run, making it possible to troubleshoot failures directly from the UI.

Plugin's Features (2)

• Exa-Search — AI-powered web search capability for agents, enabling real-time information retrieval from the internet with structured JSON output and semantic content extraction (exa-search skill).
• Obscura — lightweight headless browser for web scraping, JS rendering, CDP server (Puppeteer/Playwright), and MCP server. A lighter alternative to PinchTab with no dependencies and a single binary (obscura skill).

Enhancements (34)

• Realtime SSE Consolidation — five separate realtime event streams merged into one unified SSE endpoint, reducing browser connection overhead and eliminating race conditions between event sources.
• PROMPTPurify L5e Injection Guard — a compact ML classifier runs as a second-pass injection guard, catching prompt injection patterns that regex-based guards miss. Semantic analysis adds a layer beyond simple pattern matching.
• CSRF Protection — double-submit cookie pattern protects all state-changing endpoints against cross-site request forgery attacks. Automatically disabled during test runs.
• Auto-Assign Non-Lazy Skill Tools — when a non-lazy skill is assigned to an agent, its tools are now automatically registered without manual assignment. Prevents silently broken skills caused by forgotten tool configuration.
• Evonic Doctor Consistency Checks — two new diagnostic checks detect orphaned tool assignments: artifact tool consistency (section 9) and non-lazy skill tool consistency (section 10). Both support --fix to auto-correct mismatches.
• Stale Session Injection Detection — the runtime detects when an agent's session has been idle long enough for the context to be stale, injecting a staleness-aware prefix to keep the agent grounded. Configurable per-agent with sensitivity settings.
• Save Artifact Source Path Routing — artifacts can now be saved directly from file paths through sandbox and tunnel backends, eliminating the base64 encoding bottleneck for large files.
• Evonet.md Default KB — new super agent setups now ship with evonet.md as a default knowledge base, providing instant context about the Evonet tunnel architecture.
• In-Place Agent Switching — navigating between agents now swaps content without a full page reload, with soft-switch support for the super agent. Dramatically reduces wait time when bouncing between agents.
• Unified Chat State/Summary — /chat/state and /chat/summary merged into a single API call, halving network overhead on every chat turn.
• Configurable Sidebar Agent Limit — maximum visible agents in the sidebar is now configurable from System Settings instead of hardcoded.
• Server-Side Search/Filter — agent search and filtering moved to the backend, fixing the bug where search only matched the currently visible page.
• Avatar Initials — agents now display colored name-initial circles instead of generic placeholder icons, making agent identity instantly recognizable across the platform.
• Chat Image Download Button — every image in chat messages now has a download button overlay for one-click saving without right-click menus.
• Build Operations Rule Injection — agents with bash or runpy tools automatically receive instructions to run compilations inside tmux or screen sessions, preventing the agent loop from blocking during builds.
• Artifacts Pagination — the artifacts tab now paginates large collections with server-side search and filtering, keeping the UI responsive even with hundreds of files.
• KB File Modal Auto-Grow — the KB file editor textarea now auto-grows to fit content, eliminating nested scrollbars.
• CSS Concatenation Build Script — unified CSS build step produces a single minified stylesheet from modular source files.
• cat_file_bytes Streaming Transfer — file transfers across all backends use streaming instead of docker cp/shutil.copy2, supporting larger files without temporary disk copies.
• Smart Quote Normalization — curly/smart double quotes normalized before markdown parsing, preventing broken formatting from copy-pasted or small-model-generated text.
• Scheduler Full Output Capture — session_prompt output now fully captured and visible in the scheduler detail view for troubleshooting.
• Summarization Diagnostic Logs — skip reasons logged when summarization is bypassed, making summarization behavior debuggable.
• Stale Boundary Event Stripping — stale boundary events stripped from /chat/events to prevent ghost thinking bubbles after /clear.
• Memory NULL-Dimension Backfill — existing memories without dimension vectors backfilled so conflict detection catches all duplicates.
• Relative Avatar Path Storage — avatar_path stored as relative for backup/restore portability across different server deployments.
• Telegram Auto-Populate Display Name — agent display name automatically populated from Telegram profile data on first connection.
• sudo -E Environment Preservation — environment variables survive sudo elevation when running commands with run_as_user.
• Toast on Agent Enable/Disable — enabling or disabling agents from the detail page now shows a toast confirmation instead of silent action.
• Python -c Instead of Heredoc — bash execution uses python -c to keep stdin available for interactive input() calls.
• Download Button Repositioned — chat image download button moved to top-right overlay, keeping it accessible without cluttering the image area.
• Allow Soft-Switch to/from Super Agent — sessions no longer reject mode/agent change when switching to or from the super agent.
• Workplace Detail Tab Alignment — workplace detail page tabs now match agent_detail styling for visual consistency across the platform.
• Slow-Request Logging — requests exceeding 500ms logged with full path and timing for bottleneck identification.
• Verbose Logging by Default in CLI — CLI mode now matches GUI log output verbosity, giving consistent debugging output regardless of how you launch.

Performance (11)

• Agent Detail Page Speedup — eliminated database write contention and redundant queries on agent detail page loads, cutting load time significantly.
• SQLite Performance Tuning — WAL mode, synchronous, and cache size PRAGMAs tuned for the platform's read-heavy workload. Thread-local connection pooling reduces WAL checkpoint pressure.
• Buffer Events.Log Writes — event log writes buffered to reduce filesystem directory churn on high-traffic deployments.
• Cache app_settings — SettingsMixin caches app_settings to avoid hitting the database on every page load.
• Strip Empty Tool Descriptions — OpenAI tool definitions omit empty description strings, reducing token overhead on every request.
• DB Connection Lifecycle — connections closed after requests with anchor to prevent WAL checkpoint stalls and file descriptor exhaustion.
• Compiled Regex + Tool JSON Cache — regex patterns compiled at module level and tool JSON definitions cached with mtime invalidation, eliminating repeated serialization.
• Lazy Image Loading with Skeleton Shimmer — chat images load on-demand with skeleton shimmer animation placeholders, improving initial page render time on image-heavy conversations.
• O(log N) Event Boundary Lookup — bisect-based boundary search in get_events_in_range for faster event retrieval.
• LLM Client Settings Cache — context_length, prompt_buffer, and max_retries cached with 30s TTL to avoid redundant settings reads.
• Skill Manifest & Tool-Def Parsing Cache — skill manifest JSON and tool-def parsing cached to avoid repeated filesystem reads on every tool invocation. Fixed a mutable cache bug where shared tool-def dicts were accidentally mutated across agents.

Bug Fixes (36)

• Sidebar prevents empty chat space — max-height and align-self: flex-start on the sidebar container stops it from pushing empty space into the chat room on tall viewports.
• PID start conflict — single-instance prevention uses flock for atomic PID file access, fixing race conditions between parallel starts. Automatically skipped under pytest.
• 10 CI test failures resolved — MagicMock leak across tests, API delete endpoint handling, PID file cleanup, and _tlocal->_tls typo in test fixtures all fixed.
• Default KB not copied on web agent creation — new agents created via the web UI now properly receive default knowledge base files, matching CLI behavior.
• mkToggle race on agent pages — rapid-toggle race condition on agents, plugins, and skills page toggles fixed.
• Native confirm() replaced — eager skill activation uses Evonic showConfirm() instead of browser's native confirm(), matching platform styling.
• Browser autofill on search inputs — autocomplete disabled on all search fields to prevent browser autofill from injecting unrelated values.
• Continuation nudge disabled — auto-continuation prompt injection deactivated to prevent unwanted agent behavior.
• /summary accurate when summary unchanged — slash command returns the correct message instead of a misleading error when nothing changed.
• Missing clear_all_memories — /clear-memory slash command now properly removes all memories instead of silently failing.
• Contiguous per-session chat sequence — sequence numbers contiguous per session, preventing SSE from seeing phantom gaps that triggered unnecessary re-fetches.
• /summary AttributeError fix — resolved 'AgentRuntime' has no attribute '_maybe_summarize' crash.
• Artifacts tools managed by feature toggle — artifact-related tools controlled by the plugin feature toggle system instead of manual assignment.
• Persistent 'Saved!' label replaced — Tools tab uses disappearing toast notifications instead of a static label.
• Path traversal escape in portal resolution — path resolution hardened against directory traversal attacks escaping the portal root.
• save_artifact error message improvements — five fixes for unclear errors: missing filename, invalid filename, missing content, text-as-path misuse, and general exception context.
• read_file directory error — returns an actionable message when targeting a directory instead of a vague I/O exception.
• Auto reply-back removed — inter-agent auto-reply removed to prevent infinite ping-pong loops between agents.
• str_replace/patch smart-quote robustness — curly/smart double quotes in code no longer break str_replace and patch, especially for small models.
• Flash-of-border on non-remote agent badge — chat header badge no longer shows a brief border flash during initial render.
• Lightbox window scope — Lightbox exported to window scope so artifacts tab and non-chat views can invoke it.
• SSE/polling leak on navigation — SSE and polling connections properly closed on page navigation, preventing connection leaks.
• Injection guard false positive — base64-encoded file paths in CLI output no longer trigger the injection guard.
• web_test bubble popup navigation — notification bubble from web tests navigates to agent detail instead of sessions page.
• Badge visibility for local agents — workplace type badge resets className instead of using classList.add, fixing stale visibility state.
• Stale runpy reference removed — outdated descriptions referencing removed functionality cleaned from runpy tool documentation.
• Enter-key on session reply input — mobile/desktop Enter-key distinction now applies to session page reply input as well.
• Kanban assignee blocked on done tasks — completed and archived Kanban tasks can no longer have their assignee changed.
• Auto-extraction from plan markdown removed — task auto-extraction from plan markdown removed, fixing unintended task creation.
• Early guard for missing file_path in read_file — prevents AttributeError when read_file is called without a file_path argument.
• Verbose lock debug removal — [LOCK] _llm_lock debug logs silenced to reduce log noise.
• Remove exa-py dependency — unused exa-py removed from requirements.txt after exa-search skill migration.
• Remove redundant artifacts injection — duplicate artifacts SYSTEM.md injection removed from agents.py.
• Replace Tailwind arbitrary classes — arbitrary-value Tailwind classes replaced with inline CSS for more predictable thumbnail and lightbox styling.
• Sidebar position:fixed — sidebar positioning changed from CSS flex to position:fixed, preventing it from contributing to the flex container height and eliminating empty whitespace in the chat area.
• Bypass is_skill_enabled in auto-assign — _exec_assign_skills now bypasses the is_skill_enabled() gate when assigning tools, fixing an edge case where tools would silently fail to assign for newly-enabled skills.