Skip to content

LightAgent v0.9.7

Choose a tag to compare

View all tags
@wxai-space wxai-space released this 15 Aug 08:45
v0.9.7
b070815
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

LightAgent v0.9.7 closes the remaining pre-v1.0 security and extensibility gaps with an optional, dependency-free Connector contract and stronger validation around high-risk runtime boundaries.

  • Add ConnectorManifest, ConnectorValidator, structured diagnostics, and offline validation for Tools, Skills, MCP settings, Hooks, memory adapters, optional extras, and local documentation.
  • Add credential-free local research and enterprise API Connector examples that reuse existing LightAgent extension points without a parallel plugin runtime.
  • Expand Python executor AST hardening for aliases, dynamic dispatch, getattr, attrgetter, __dict__/subscript access, dangerous builtins, nested imports, and safe false-positive cases.
  • Expand shared Graph Memory adversarial tests for cross-user poisoning, tenant/user/agent isolation, low-trust facts, trusted-neighborhood preservation, and audit counts.
  • Add an explicitly opt-in real Mem0 Graph integration matrix and documentation that separates framework mitigations from backend/advisory scope.
  • Add the first v1.0 public API compatibility inventory.

Compatibility

  • Existing agent.run("hello"), structured results, streaming, LightFlow, Hooks, Guardrails, review, and memory APIs remain compatible.
  • Connector manifests compose existing extension points and do not introduce a parallel plugin runtime.
  • Connector validation performs no default network calls and does not install dependencies, start MCP services, or invoke components.
  • No new required core dependency is introduced.

Security Scope

The tracked fake-backend tests validate LightAgent's framework boundary against destructive shared-memory behavior. The real Mem0 Graph matrix remains opt-in and must be run against exact isolated backend and storage configurations before issue #39 can be scoped or closed. v0.9.7 should not be described as a complete Mem0 Graph backend fix.

Validation

  • GitHub CI passed on Python 3.10, 3.11, 3.12, and 3.13.
  • Full future-CI suite: 193 passed, 1 skipped.
  • The skipped test is the explicitly opt-in real Mem0 Graph integration matrix.
  • python -m compileall -q ..., git diff --check, and wheel build passed.
  • Built wheel: lightagent-0.9.7-py3-none-any.whl.

Full changes: v0.9.6...v0.9.7

Assets 2
Loading