AgentOS 2026.8.3

A packaging, skills, and upgrade-path release. If you installed AgentOS from a local checkout, agentos upgrade has been shipping you a stale web UI — that is fixed here, and this is the release to take.

Fixed

• agentos upgrade no longer ships a stale React control UI. scripts/install_source.sh installs the directory itself, so uv's tool receipt records a directory requirement; uv tool upgrade then re-resolved that requirement and rebuilt the wheel from the working tree. The wheel bundles src/agentos/gateway/static/dist/**, but nothing in the upgrade path runs npm run build — so every upgrade re-packaged whatever browser bundle happened to be on disk. Python code moved forward, the web UI silently did not. agentos upgrade now installs the published release (uv tool install --force --python <running> "use-agent-os[recommended]" / pipx install --force …), whose wheel carries a control UI built and verified in CI. Installing a checkout stays with scripts/install_source.sh, the only path that rebuilds the bundle first; the command names it when it detects a checkout-backed install.
• agentos upgrade printed its own commands with the extras silently removed. Rich parsed the [recommended] in use-agent-os[recommended] as a markup tag and dropped it, so copying the printed command produced an install missing the ONNX embedding models and the pilot router.
• Pilot Router tier defaults were priced and sized against tables that had no entry for them. Both tables fail open without logging: pricing falls through a startswith scan to whatever shorter prefix matches first (or a generic $3/$15), the catalog falls through an exact-key miss to a generic 200K context / 16K output. glm-4.7-flashx was estimating at the generic default, and seven ids — including anthropic/claude-opus-5, the OpenRouter c3 default, whose bare spelling was listed at 1M/128K — were sizing turns against generic limits. Every tier default now carries an explicit entry in both tables, enforced by a test that walks all router tier profiles. (#139)
• OpenCAP cost estimates silently used a different gateway's rate sheet after one failed boot fetch. The price cache was seeded exactly once and never refreshed, so a single timeout meant every estimate for the life of the process came from the shared static table — which carries Bankr rates running 3–5× below OpenCAP's own. The cache now refreshes on a TTL and refetches when cold, mirroring the OpenRouter live-pricing path, with a shorter negative cache so an unreachable catalog costs one bounded attempt rather than one per lookup. A fallback estimate is logged once per model, so a substituted number is no longer indistinguishable from a catalog-backed one. Set AGENTOS_OPENCAP_LIVE_PRICING=0 to disable the refresh.
• A hub install could silently shadow a bundled skill. A skill declaring requires is dropped from the prompt until its binary and variables are present, so from inside a turn an installed-but-unconfigured skill is indistinguishable from one that was never installed — and a same-named catalog row installs into the managed layer, which outranks bundled. The installer now refuses a first install that would shadow a bundled skill (overridable with force, never blocking a reinstall or agentos skills update); skill_search_community answers with an installed_match block naming what the local skill is missing, ahead of the catalog results; and the agentos skill documents both rules.
• skill_view(name="agentos", section="Skills") resolves. The material sat under bold labels, which parse_sections does not index. The six operation groups under Common operations are real headings now, so each can be read on its own.

Added

• Seven GMGN trading skills ship bundled under the new Trading category on the Skills page: gmgn-token, gmgn-market, gmgn-portfolio, gmgn-track, gmgn-holder-analysis (read-only) plus gmgn-swap and gmgn-cooking (financial execution, risk: high). They are vendored from https://github.com/GMGNAI/gmgn-skills under MIT and drive the third-party gmgn-cli npm package, which AgentOS does not redistribute: each declares requires.bins: [gmgn-cli] and requires.env: GMGN_API_KEY, so they list as "Needs setup" with an npm install -g gmgn-cli hint until an operator installs the CLI and supplies their own key. Gated out of the model prompt until then, exactly like senior-unilp-manager.

Changed

• pip install use-agent-os no longer resolves dependencies open-ended. Bounds now cover the rest of the base runtime list and the consumer-facing extras, completing the first seven caps from 2026.7.30. Each cap sits at the first release its upstream may break in, measured from uv.lock: the next major for a >=1.0 project, and the next minor for a 0.x one, where semver puts the breaking change. That distinction is load-bearing — typer<1.0 against a locked 0.24.1 reads as bounded and is not, and weasyprint<70.0 against a locked 68.1 was already letting an untested 69.0 into fresh installs. Bounds are targeted rather than blanket: structlog and html2text are CalVer, and pyyaml/jinja2/cachetools and peers have long-stable surfaces, so capping those would only make AgentOS harder to co-install. The rule and its exemptions are written down in CONTRIBUTING.md and enforced by tests/test_packaging/test_pyproject_invariants.py, which recomputes both boundaries from the lockfile — so a new dependency cannot ship unbounded, and a cap cannot drift off the rule, by accident. dev stays uncapped. (#153)

Security

• Durable memory redaction moves onto the shared scanner. It ran its own three-pattern list, so anything that list missed was written to disk verbatim. redact_memory_text now goes through redact_sensitive_text — the full provider-prefix set — and does so with force=True, because AGENTOS_REDACT_SECRETS=0 is an egress escape hatch and must not unmask what lands in durable storage. The keyword rule (api_key, secret, token, password) handles quoted values and leaves already-masked text alone instead of double-redacting it. The shared scanner also learned the remaining AWS key-id prefixes (ASIA temporary credentials, ABIA, ACCA) and now matches Authorization and x-api-key-family headers when the name or value is quoted — the JSON and dict spellings a tool result actually arrives in, which the bare name: value patterns walked past.

Full changelog: v2026.8.2.post1...v2026.8.3