Skip to content

Xeo Forge v1.23.0 — Local-First Agent Workbench

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Aug 01:14
· 34 commits to master since this release
v1.23.0
2858d1f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Xeo Forge v1.23.0 — The Honest Machine

The version where every promise is probeable: thinking you can see, effort levels that mean something, subagents that inherit authority instead of escaping it, and a sandbox ladder that tells you the truth about isolation.

Phase 0 — the regressions, root-caused (not patched)

  • The endless-reply loop is dead. Root cause: the agent loop's no-tool-calls path had planning and build branches but no chat branch — every chat answer fell into build-mode "fake completion" detectors that demanded tool evidence chat can never produce (NO_WORK_PERFORMED_NUDGE), re-prompting the model forever while the surface streamed the repetition. Chat now finalizes on first text termination, verbatim. (Live-verified: loop source contract pinned in scripts/smoke_v123_phase0.mjs, 13/13.)
  • Thinking blocks exist and are honest. Two channels merged: native reasoning_content events AND inline <think>…</think> tags (DeepSeek-R1-style proxy gateways) — extracted on both the persisted path (server) and the live path (client). Thinking survives completion; a run with no streamable reasoning at a level above Minimal shows "this model did not stream separate thinking — nothing was hidden" instead of silence.
  • Markdown + bidi. Assistant answers render through the hardened lib/markdown.ts renderer (tables, nested lists, fenced code, links); message containers carry dir="auto" for mixed Arabic/English.

Chat, redefined

Chat is now exactly what the contract says: plain smart conversation — the ChatGPT/Claude shape. Its only tool is web_search (3-engine fallback chain, live-probed 3/3 including Arabic queries; fail-closed honest errors, never fabricated results). It cannot read files, run commands, or touch the workspace — the difference from Work is authority, not intelligence: same reasoning quality, same thinking levels.

Thinking-effort levels (eight, honestly classified)

Minimal · Low · Medium · High · Enchanted High · Extra · Max · Ultra — selectable per task in the chat composer and the Work setup, stored on the task row ("the row is the truth"). Each level maps to a native reasoning_effort parameter (live-probed: accepted by every working model on our reference proxy) plus, for the four top levels, simulated discipline passes (plan → self-check → alternatives → adversarial critique) injected as system directives. The UI marks hybrid levels (+sim), emits a thinking_level audit event per run, and shows the chosen level inside the thinking block.

Subagents — parallel delegation through the front door

delegate_research fans out 2–4 read-only research subagents (files/lists/web only — concurrent writes impossible by construction). Every subagent executes under the parent's exact authority through the identical authorizeToolCall gate; every step lands in the audit trail tagged sub-1…sub-N; failures are isolated and reported per-subagent. The delegation itself answers to the per-level subagent rules (denied at read-only, asked at assist, allowed from execute up).

Sandbox — three tiers, zero euphemism

  • Standard — labeled plainly: hardened process execution, no OS-level isolation.
  • Strict — 8 extra deny rules as DATA (network, transfer tools, process control, delegation) prepended to the run's rule set.
  • Docker — real isolation: every execution command in an ephemeral container (workspace bind-mount, 1 CPU / 512 MB / 128 pids, network off). Docker is probed per run, never assumed; unavailable → fail-closed refusal with a guided, consent-first install path (per-OS steps + official download + re-check). Nothing downloads silently; mid-flight failure never leaves a half state.

Chosen from the Work setup (field 06, with a live Docker status dot) — honest descriptions rendered verbatim at choice time.

Deep audit fixes (audited by adversary, fixed by evidence)

  • Hook audit citations were persisting null — the authority verdict (rule + index) now travels into every audit event.
  • The Python runner's cleanup command escaped the rules gate (del, Windows-only, path unchecked) — the interpreter runs through the same gated run(); cleanup is unconditional in-process.
  • Dead UI eliminated: the 698-line orphaned SettingsClient deleted; "Switch workspace" now opens the real chooser (or states "Managed"); the hardcoded "Ready" pill reflects actual setup state; the decorative account-menu glyph and the false "Gateway connected" label are gone.
  • WorkIntake authority bullets now change with the chosen level (read-only strikes out writes; assist says per-action approval; autonomous names the push/publish exception).

Live model intelligence (provider probes, 2026-08-28)

20 text models probed across 4 capabilities (native tools, reasoning channel, reasoning_effort, streaming): 8 fully functional on the reference proxy right now (kimi-k3, gpt-oss-20b, glm-4.6v-flash, opus-5-thinking, opus-4-8-thinking, deepseek-v4-pro, glm-4.5-flash, mimo-V2.5); the rest fail provider-side (auth_unavailable 503 / 504 / malformed upstream) — documented honestly, with ~88K tokens of measured probe usage.

Verification honesty

  • scripts/smoke_v123_phase0.mjs — 13/13 (Node 24 type-stripping) for the Phase-0 contracts; vitest twins in test/ run in CI (the sandbox cannot build better-sqlite3 locally; CI is the canonical gate).
  • web_search: 3/3 live queries across engines (Arabic + English).
  • Sandbox module: live probe (modes, strict rules, docker detection, wrap command) on this machine.
  • Provider probes: raw JSON + consolidated tables in research/.

Known gaps (disclosed, not hidden)

  1. Per-task permission overrides: the loop accepts them, no path supplies them yet (raise the level instead, for now).
  2. GUI zone rules: enforced logic, contract-tested, no runtime consumer yet.
  3. Docker tier covers code_execute; interactive terminal still runs on-host (visible warning when docker tier selected).
  4. Subagents are read-only; write-capable delegation waits for a proven concurrent-write design.
  5. Multi-platform presence and skill self-improvement (Hermes features): roadmap, not v1.23.

Full competitive evidence: docs/competitive/hermes-analysis.md · docs/competitive/openhands-analysis.md

Assets 9
Loading