Talos 0.19.21-alpha

Talos 0.19.21-alpha

This release lets Talos run curated third-party CLIs — cli-anything harnesses such as n8n or LibreOffice — through the same gate as everything else. The operator-owned registry (data/cli-anything.json, fail-closed like mcp-servers.json) pins each harness by package, version and SHA-256 with an absolute command path and an exact subcommand allowlist: the model names a harness and a subcommand, never a path or a version. What the registry does not list is DENY without an approval question; what it lists is NEEDS_HUMAN, with standing rules binding exactly (harness, subcommand).

• Runs go through the sandbox with argv built by shlex.join — a model argument can never become a second command — with the network off unless the entry allows it, and the harness inherits only the minimized sandbox environment: an env field in a registry entry hard-rejects the entry, the MCP credential rule.
• Nested two-token subcommands for git-style harness CLIs (workflow list) are split back into two argv elements at their single space; the allowlist stays exact — workflow list never covers workflow delete.
• The site now says what the design has been all along: a Swiss army knife whose every blade carries a lock — and you hold the key.

Linux and macOS GitHub CI passed for this release commit.

Validation: 2,864 source tests collected (sanitized release source: 2,863 passed, 1 environment skip); 263/263 adversarial cases. OSV: no findings. Archive signature verified; tampered bytes rejected. The full live-model 44-case E2E was not repeated: the change adds a gated tool bridge behind the existing approval contract, which the E2E harness does not wire.

The attached archive is signed with the existing Ed25519 release key. Verify its SHA-256 and signature as documented in SECURITY.md. Private profiles, credentials and operator data are excluded.

Published at https://talos-agent.ch. Website downloads match the signed GitHub assets byte-for-byte (HTTPS read-back, SHA-256 and Ed25519 verified); the site's status.json and installer now serve 0.19.21-alpha. Previous release downloads remain available.

Talos 0.19.20-alpha

Talos 0.19.20-alpha

This release makes browser actions check what they act on. An inspect receipt now carries a per-field guard — an element identity over the accessible state — and every mutating browser action accepts expect with that guard: if the element changed since it was inspected, the action is refused ("the observed element changed since it was inspected") instead of typing into or clicking whatever sits there now. A malformed guard is rejected by the contract before the browser is ever touched.

• open navigates the existing Chromium tab instead of piling up a new tab per call. The stacked tabs stole focus from the very navigation meant to prevent them. Chromium is started once if it is not running, detached with setsid so the bounded run wrapper cannot kill it with the job.
• The transitive pins are floored: anyio at 4.14.2 (GHSA-82r6-8w77-94w6, CVSS 9.3, and GHSA-5p39-cfhj-2xmp, CVSS 6.8), idna at 3.15 (PYSEC-2026-215, CVSS 6.9) and the development-only pygments at 2.20.0. The locked installs already carried the fixed versions; the requirement ranges claimed to tolerate the vulnerable ones, and an OSV scan resolves a range by its minimum.
• README, changelog and website release metadata are aligned in the source tree.

Linux and macOS GitHub CI passed for this release commit.

Validation: 2,826 source tests collected (sanitized release source: 2,825 passed, 1 environment skip); 254/254 adversarial cases. OSV: no findings after the pin floors above. Archive signature verified; tampered bytes rejected. The full live-model 44-case E2E was not repeated: the change sits in the computer browser driver, which the E2E harness does not wire. The guarded path was proven in the VM against the installed driver instead (computer_browser_guard_e2e passed, op=browser over the API with HTTP 200).

The attached archive is signed with the existing Ed25519 release key. Verify its SHA-256 and signature as documented in SECURITY.md. Private profiles, credentials and operator data are excluded.

Published at https://talos-agent.ch. Website downloads match the signed GitHub assets byte-for-byte (HTTPS read-back, SHA-256 and Ed25519 verified); the site's status.json and installer now serve 0.19.20-alpha. Previous release downloads remain available.

Talos 0.19.19-alpha

Talos 0.19.19-alpha

This maintenance release fixes how Telegram runs close out. Telegram only ever shows a message's latest state, so an interim state the operator had read was effectively deleted by the next edit. The end of a run now goes out as a compact append-only receipt (duration, tool actions, result status), sent after the answer's confirmed delivery and never edited. A run parked at an approval is not finished, so it gets no receipt.

• The run's summary now shows exactly once: with the receipt delivered, the frozen display keeps the plain work trail and the receipt alone carries the summary. If the receipt cannot be sent, the display carries the full final state as before.
• Callback taps are acknowledged when they arrive instead of after queueing: an approval button that aged in the worker queue made Telegram reject the late answerCallbackQuery with a 400, and the error cascade marked the queued turn failed. A stale or duplicate ack is now cosmetic, and a reply that cannot edit the old approval card is delivered as a fresh message instead.
• Telegram's description from the error response body is now logged. A bare "400 Bad Request" was undiagnosable; the bot token in the URL stays redacted.
• README, changelog and website release metadata are aligned in the source tree.

Linux and macOS GitHub CI passed for this release commit.

Validation: 2,817 source tests collected (sanitized release source: 2,816 passed, 1 environment skip); 254/254 adversarial cases. OSV: no critical or high findings (three medium/low advisories against pinned versions: idna 3.9.0 → 3.15; pygments 2.9.0, development-only → 2.15.1/2.20.0). Archive signature verified; tampered bytes rejected. Full live-model 44-case E2E was not repeated: the change sits in the Telegram transport, which the E2E harness does not wire.

The attached archive is signed with the existing Ed25519 release key. Verify its SHA-256 and signature as documented in SECURITY.md. Private profiles, credentials and operator data are excluded.

Published at https://talos-agent.ch. Website downloads match the signed GitHub assets byte-for-byte (HTTPS read-back, SHA-256 and Ed25519 verified); the site's status.json and installer now serve 0.19.19-alpha. Previous release downloads remain available.

Talos 0.19.18-alpha

Talos 0.19.18-alpha

This maintenance release fixes corrupted accents and emoji in streamed model replies. Charset-less SSE responses now retain their UTF-8 bytes until Talos decodes the JSON payload, so text such as Grüße 🛠 arrives intact.

• Applies to the direct API reasoner used by Ollama, Anthropic API, OpenAI API, NVIDIA NIM and Kimi API.
• The regression fails with the previous decoder and passes with this release. A real local Ollama request returned the exact Unicode text, including the streamed callback.
• README, CLAUDE.md, changelog and website release metadata are aligned in the source tree.

Linux and macOS GitHub CI passed for this release commit.

Validation: 59 release targets passed twice; 2,809 source tests collected (sanitized release source: 2,807 passed, 2 repository-context skips); 254/254 adversarial cases; 14 website browser checks. OSV: zero findings. A fresh installation passed 2,807 tests with 27 platform/repository skips and all 254 adversarial cases; all 130 runtime files matched the release source. Archive signature verified; tampered bytes rejected. Full live-model 44-case E2E was not repeated.

The attached archive is signed with the existing Ed25519 release key. Verify its SHA-256 and signature as documented in SECURITY.md. Private profiles, credentials and operator data are excluded.

Published at https://talos-agent.ch. Website downloads match the signed GitHub assets byte-for-byte. All 14 live browser checks passed; a fresh installation from the public HTTPS installer passed 2,807 tests (27 platform/repository skips) and all 254 adversarial cases. Previous release downloads remain available.

Talos 0.19.17-alpha

Talos 0.19.17-alpha

This maintenance release makes configured model fallback easier to interrupt and keeps short work announcements from ending a task prematurely.

• Cancellation and busy status follow the model call that is actually running.
• Background tasks keep the configured fallback chain with independent cancellation state.
• A successful tool receipt allows the next bounded continuation check; repeated announcements without progress stop explicitly. Completed tool actions are never replayed.
• Sandbox and updater checks also work when the installation path contains spaces or ampersands.

Validation: 2,808 source tests collected; Linux and macOS CI passed; 254/254 adversarial cases passed. A fresh Mac installation passed 2,806 tests with 27 platform/repository skips, including the Mac profile tests. The Pi archive passed 2,780 tests with 28 repository-only skips. Recovery targets passed twice. OSV: zero findings.

A 15-minute controlled soak covered 20 recovery/control cycles with simulated provider faults. This release does not claim a fresh full 44-case real-model E2E run or multi-hour production soak.

The attached archive is signed with the existing Ed25519 release key. Verify the SHA-256 checksum and signature as described in SECURITY.md before installing. Private operator profiles and credentials are not included.

Talos 0.19.16-alpha

Talos 0.19.16-alpha improves reliability when a provider fails or a task stops at a promise to act.

• Empty API replies and declared stream errors keep their failure type through the configured fallback chain. Exhausted routes end with an explicit error and preserve the task context.
• Short immediate work announcements receive one bounded follow-up. Completed tool actions are not replayed, and an unfinished task is reported as unfinished.
• Failed channel polling backs off from 1 to 30 seconds, resets on recovery and keeps messages from healthy channels moving.
• Oversized web reads suggest a smaller text source. Operator-defined OpenAI-compatible endpoints use their own credentials and native API routing.
• Dependency minimums now match the secure versions already pinned in the release locks.
• README, contributor guidance and all website pages carry current release metadata: 2,790 collected tests and 32 gated tools.

Validation: Linux and macOS CI, 254 adversarial cases, Raspberry Pi package checks, a fresh signature-verified installation and mobile/desktop website checks. Website-only tests are skipped in the source archive because the website is distributed separately.

Upgrade an existing installation with talos update --check, then talos update. New installations can read the installer at talos-agent.ch/install.sh before running it with Bash.

The archive is signed with the existing Ed25519 release key. Verify both the checksum and signature as described in SECURITY.md.

SHA-256 (talos-0.19.16-alpha.tar.gz):

9a4ed10b6620e56ab596b5d481cfdd57738df082fe3a27b4c934f998b9f45fd1

0.19.15-alpha

An attachment that could not be fetched now says why.

Before, the agent saw only "Its content is not available to you" — with no way to tell a file that was too large from one in a format it cannot read. Faced with that, it went looking through the filesystem for the file instead.

A hint that withholds the reason costs more time than no hint at all. Now:

• Too large → the size, the limit, and a way out.
  It is 24.5 MB — too large to fetch: Telegram lets a bot download at most 20 MB. Ask for a smaller copy, or put the file where it can be read directly.
• Unreadable format → the formats that are readable.
  .zip is not a format this can read. Readable: pdf, docx, xlsx, pptx, txt, md, csv, json.

Documents get their own ceiling. A photo is not a data carrier and stays capped at 12 MB. A document is one — that is what it is for — so it may use Telegram's real 20 MB limit. Half of that excluded exactly the files the feature exists for: property dossiers, annual accounts, contracts.

The file suffix is derived in one place now. Fetching and explaining have to give the same answer, or the hint describes something other than what the fetch does.

Verify this download

sha256  a1f7f3b9c3c949ae4e61612a95d7ba70d6373c94094b9f10365131226f835a86

The .sig is a raw Ed25519 signature over the archive bytes, base64-encoded. The public key is pinned in install.sh:

Do7lfPckC7pJJtD4BECN/mLPIOqHZVWm/j/MfJOK2hk=

Suite: 2758 tests, 254 adversarial cases.

0.19.14-alpha

The agent can read documents now.

Until now it could see a photo and hear a voice message, but not read an invoice. Send it a PDF and it answered "Its content is not available to you" — honest, and useless.

read_document takes a path and returns text: PDF, Word, Excel, PowerPoint, plus plain text formats.

It is a read, and the kernel says so

The tool is a READ with a real target, exactly like see_image and hear. The kernel judges the path, so a payslip under ~/.secrets is refused without the reader knowing anything about it. Two adversarial cases hold that — including the counter-proof that an ordinary invoice stays readable.

Reading happens locally. A medical report has no business at a third-party service just to become text.

One dependency, not three

Only PDF needs a library (pypdf, loaded on first call). docx, xlsx and pptx are ZIP archives holding XML, and the standard library reads them.

Two attacks an office reader brings

Both are refused before anything is read:

• Zip bomb — 40 KB expands into gigabytes. The uncompressed size is taken from the archive index before a single byte is unpacked.
• XML entity — <!ENTITY xxe SYSTEM "file:///etc/shadow"> turns the parser into a file reader operating around the kernel: the file the kernel approved is the document, not what the parser pulls in afterwards. Any DOCTYPE or entity declaration is refused unread.

Document text reaches the model inside its own untrusted frame — data, never an instruction, even when phrased as one.

Verify this download

sha256  38785b734f11b8163a5413884d0b44f8953560fd4add69c56e5569c96494d229

The .sig is a raw Ed25519 signature over the archive bytes, base64-encoded. The public key is pinned in install.sh:

Do7lfPckC7pJJtD4BECN/mLPIOqHZVWm/j/MfJOK2hk=

Install

curl -fsSL https://talos-agent.ch/install.sh | sh

Suite: 2753 tests, 254 adversarial cases.

0.19.13-alpha

Skill ranking no longer hands the name bonus to filler words.

Skill names are kebab-case, so every word in one counted as a full match — including a filler word. In a 218-skill library with sat in 19 names, api in 25, for in 14. Each was worth ten points, while a genuinely relevant hit in the description scored one, so a question containing "with" ranked nineteen unrelated skills above the one that answered it.

A word shared by more than five percent of all skill names no longer earns the bonus. The share calibrates itself against the library at hand rather than against a hand-kept list of stop words, which would be wrong again in the next language. A name hit is never worth less than a description hit, so a skill that merely mentions a word in passing cannot overtake the ones that carry it in their name.

Measured on a real 218-skill library, 30 questions across two languages: 26/30 → 29/30, with nothing that worked before getting worse.

Verify this download

sha256  92c8480a96a7d941bd02046efc299cc1bcbfc7a478709cc73f0274084c8844a6

The .sig file is a raw Ed25519 signature over the archive bytes, base64-encoded. The public key is pinned in install.sh:

Do7lfPckC7pJJtD4BECN/mLPIOqHZVWm/j/MfJOK2hk=

Install

curl -fsSL https://talos-agent.ch/install.sh | sh

The installer checks the published checksum and verifies the signature in a throwaway environment before it unpacks anything.

Suite: 2733 tests, 252 adversarial cases.

Talos 0.19.12-alpha — a spent approval button stops claiming nothing ran

A live chat showed the agent answering "Approval invalid or expired. Nothing ran." while the event log for that same command carried exec.result: ran with your approval.

Two approval cards were open. On the first the operator chose always, which created a standing approval, and the next command ran under it. When the second card was tapped afterwards, its request had long since been resolved, and this branch fired.

The branch knows only that this button no longer applies. It does not know, and cannot know, whether the action happened. Asserting "Nothing ran" there is worse than saying nothing: it invites repeating an action that already ran — in this case a remote command. It now states only what is provable, and points at the log, which is the thing that can actually answer the question.

No test pinned that sentence, which is why it could be wrong for as long as it was. One does now.

Verified: 2,727 tests passed with no skips and 252/252 adversarial cases.

Archive SHA-256: 378e35701070808dc709fbfb481d98e7c4099d5f378f06dd3456d8005d911115

Install and setup · Documentation