New Features
- Per-job harness and model — a job can carry its own harness and model:
publish(..., harness=, model=) pins them at enqueue, and the consumer resolves the rest from the agent_view config, so model or harness evaluations on one agent_view need no config change.
agento job:set-runtime — sets or clears a queued job's harness and model (--harness, --model, --clear) while the job is still TODO; a harness change also drops the stored session.agento run --harness / --model / --credential — pins the harness, model and credential of one run without a change to the agent_view config.agento e2e --harness — tests a harness other than the view's; the test claims only its own job and its own credential, so the rest of the pool and a live consumer are not disturbed.- Release e2e gate — every release now runs real-LLM end-to-end tests for Claude, Codex and Pi before it is published to PyPI; the tests run in parallel.
Bug Fixes
- Job runtime recorded for every outcome — harness, provider and model are written when the job is claimed, so FAILED, DEAD and retried jobs carry the values you need to debug them.
- Retries keep the runtime of the first attempt — a config change during a long job no longer switches the model or harness under a retry or a resume.
- Unknown pinned harness fails once — a job pinned to a harness no enabled module registers fails at once with a non-retryable error.
- A job pinned to another harness gets its own workspace files — it no longer runs on the view harness's build, and it never sees another harness's login.
- CLI errors are kept in the job output — when an agent CLI fails with empty stdout, its stderr is now stored in
job.output.
- A near-expiry OAuth credential no longer blocks the pool for a whole job — Claude and Codex credentials close to expiry are refreshed before the job starts, and the lease is released after a few seconds.
- Codex OAuth refresh works with Codex 0.157 — the refresh marks the token as expired in a temporary home so the CLI refreshes it; the changed token is never saved.
- A refused refresh token is a temporary auth error — it throttles the credential instead of failing the job with an unknown error.
- The run's toolbox capability is created after the refresh — a slow refresh can no longer use up most of its lifetime.
- SQL queries are cancelled on the server when they time out — MySQL and MSSQL no longer keep running a query nobody waits for.
- MSSQL tools honour
core/sql_timeout_seconds — queries no longer fail at the library default of 15 s.
- Large-result offload files no longer overwrite each other — the file name now carries a random suffix.
- Jira question handback resets the issue status — an issue handed back with a question no longer stays in the agent's working status.
- The Outlook secret migration lists the commands for every stale secret, not only the client secret.
- Integration tests use the configured MySQL host and port — the credential-index upgrade test no longer fails on a test database that is not on
localhost:3306.
Security
- A nested repository config can no longer run commands through the artifact store — the desk and the storage backend refuse a config placed inside the tree they operate on.
- Outlook replies align the DMARC
header.from with the sending mailbox.
Docs
- Added
docs/cli/job-runtime.md (per-job runtime contract) and docs/deployment/release-e2e.md (release e2e gate); documented the new agento run pins in docs/cli/run.md.
Upgrade
agento upgrade --version 0.17.2
