AgentOS 2026.8.19

A release about what actually reaches the model: a skill can pin the rule it needs read, a tool result survives into the next turn intact, a cron job can name its own directory, and the system prompt stopped teaching a gateway things it cannot do.

A cron job can name its own directory

A script path passed to cron may now contain {job_id}, which the scheduler replaces with the created job's own id before the job is persisted. The add result reports the resolved path back as script_path.

A job that keeps its files in a directory named after itself could not name that directory at creation time, because the id is minted by the create. The only route there was four steps — stage the script somewhere else, add the job against the staging path, move the file, repoint the job — during which a live job points at a path it will not keep, and any run abandoned midway leaves files behind that nothing can attribute to a job. One add now does it.

It works for a script job and for an agent_turn job's pre-run script, from the tool, the CLI, and the RPC surface alike, because the substitution happens in SchedulerOps rather than in any one caller. A stored path that somehow still holds the placeholder refuses to run rather than creating a directory called {job_id}. (#332)

A skill can pin the section it needs read

Put <!-- always --> on the line directly above a heading and skill_view returns that section wherever it sits in the file.

Over the read ceiling, skill_view returns a skill's opening sections plus an index of the rest — so position in the file decided what a model actually read, and a rule written into a large skill's tail was never seen unless the model thought to ask for that section by name. senior-unilp-manager is 44k characters against a 10k ceiling, and two merged fixes had written their rules past the cut; neither reached the model, and the next run repeated both mistakes.

Pinned sections come out of the same ceiling rather than adding to it — at most half of it, with the opening taking what is left — and the index marks them as already shown. skill_view.outlined is now logged at INFO with a pinned count, because it is the only event that says most of a skill did not reach the model. (#332)

A tool can declare its own transcript ceiling

Pinning governs what one skill_view call returns. What survives into the next turn was a separate cut, and a harder one: every tool result was written to the transcript truncated to its first 2,000 characters, and 40 of the 50 bundled skills are larger than that.

A session read senior-unilp-manager, saw the pinned directory rule in an 11,996-character result, and one turn later replayed 2,000 characters that did not contain it — and wrote the files flat. Nothing downstream could recover it, because the request builder compacts from what was persisted, not from the original. The layer under no pressure at all, writing one SQLite row, was cutting harder and more crudely than the layer that has a budget to defend.

A tool may now declare the ceiling its own results are persisted under, and skill_view sets one from [skills].max_skill_view_chars. The ceiling is resolved when a result is persisted rather than at registration, so it follows a config change; a tool that declares nothing keeps the 2,000 characters that suit volatile output. (#334)

The system prompt was rewritten and gated by surface

Tool Call Style now teaches parallel tool batches and a verify-with-tools bias instead of the no-op "wait for tool results" line. A new Task Execution block carries a persistence rule with an anti-stuck escape hatch and an explicit approval-denial boundary. Safety gained irreversible and outward-facing action confirmation, secrets handling, and the <untrusted> envelope convention along with its coverage caveat.

Sections now render only for the surfaces that can use them. Reply Tags, Messaging, and Reactions require at least one configured channel adapter; Silent Replies requires a session that can receive internal system events. A pure Web UI/CLI gateway no longer teaches reply-tag syntax, emoji reactions, or a NO_REPLY sentinel it can never legitimately use — roughly 257 tokens saved per full-mode session. Both gates are boot-time or session-kind stable, so the cacheable base prompt does not churn, and section-level contract tests pin each block per prompt mode and tool set. (#336, #338)

senior-unilp-manager was rewritten against all of it

• A ratchet monitor defaults to a script cron job. tick already reconciles and fires in one process, so the script shape costs no model call and takes no tool_policy; agent_turn is now the documented opt-in for when a model is genuinely wanted in the loop, with its cost named — a full turn on every tick of a job that is almost always a no-op. (#325)
• Every file a monitor needs lives under ~/.agentos/scripts/senior-unilp-manager/<cron_id>/ and nowhere else, so the mapping from job to files is one-to-one: delete the job, delete the directory. Mandate state deliberately stays outside it, under $UNILP_STATE_DIR / $AGENTOS_HOME/state/unilp / ~/.agentos/state/unilp. (#326)
• "Files on disk for a monitor" became "Setting up a monitor" and shrank from 4,238 characters to roughly 2,100, because script="senior-unilp-manager/{job_id}/tick.sh" replaces the sequence it existed to explain — and it carries <!-- always -->, so it reaches the model whatever the read ceiling is. (#332)

Fixed

• Web chat: copying an assistant message no longer prepends the collapsible reasoning block. extractBubbleText() stripped only .msg-actions and .msg-meta, so the Thinking label — and the full reasoning body once expanded — landed in the clipboard ahead of the reply. (#322)

Install

uv tool install --python 3.12 "use-agent-os[recommended]==2026.8.19"

Full changelog: https://github.com/use-agent-os/agent-os/blob/v2026.8.19/CHANGELOG.md