Changelog

This security release rebuilds the Control Plane, relay, daemon, web, and mem0 container images on Node.js 24.22.1, which includes the Node.js security release of October 20, 2026. v2.5.0 images shipped with Node.js 24.22.0.

Upgrade note: Deployments running these images should upgrade to v2.5.1. Daemons installed with npm use the host's own Node.js and are not changed by this release.

• Assistant Mode (Beta) — Assistant mode is now available to every agent and works with Claude, Codex, and OpenCode. When an assistant joins a channel, it reads the place once to get to know it, introduces itself, and offers ways to help. Follow-ups can watch a GitHub or GitLab pull request, merge request, or issue and wake when it changes. Assistants also keep a people directory and an organization record in Knowledge.
• Tasks — Agents can hand long work to delegated tasks. One Tasks tab lists delegated tasks and follow-ups, where you can see and stop them.
• More Permission Sync and Sign-In Options — Session access can follow people's permissions in Telegram, Discord, Google Chat, and GitLab. Users can sign in with GitLab, and Setup Server configures the Telegram and Discord login apps.
• Skill Sources from Any Git Host — Import skills from GitLab projects or any HTTPS Git repository. The console shows skills that failed to install.
• Muse Code Runtime — Agents can run on Muse Code, which is preinstalled in the full runtime image.
• Console Updates — Agent memory is shown as one tree of layers beside a reader, and the Billing page breaks usage down by model. Slack now renders Markdown tables.

Behavior change: Assistant mode now requires managed memory stored in the Control Plane. The assistant-mode console flag and the chart's features.assistantMode value are removed; an existing setting is ignored.

• Sub-Sessions, Recall, and Reminders for Every Agent — Any agent can hand long work to a background sub-session and keep the conversation free. You can list and stop sub-sessions from the console. Every agent can also recall its earlier conversations and set reminders.
• Access Judged by Who Is Asking — Reading or posting in another conversation is allowed when the person asking has access to it, across all platforms. Agents detect people from outside the organization. Conversations the platform marks as external, such as Slack Connect channels, start turned off.
• Memory Layered by Audience — Each agent's memory is split by who can see the conversation, so private content is not recalled elsewhere. The console shows the layers and your own memory.
• What People Can Do in Chat — A new setting replaces "Allow runtime changes in chat": only talk, also approve tool calls, or also change settings. Approval cards now appear on Telegram, Discord, Feishu/Lark, and Google Chat. Where permissions are synced, only the agent's editors can act from chat.
• Files and Images — The console can preview images and download files from sessions, browse and create workspace folders, and show images an agent generates in webchat. The Docker Compose stack and Helm chart now bundle an S3-compatible object store that moves files without passing through the Control Plane.
• More Provider Options — Self-hosted agents can use an organization Anthropic or OpenAI key, Decisions can run on OpenAI (including image input), and Cloud daemons evaluate Decisions through the Cloud gateway. The Billing page shows usage per model.
• Assistant Mode Preview — Behind the assistant-mode console flag, an agent can keep one long conversation per place, track items, patrol them, and draft posts for approval.

This release also lets the owner remove an agent from a multi-agent playground conversation, and fixes many session, approval, and sub-session reliability issues.

Behavior change: Existing agents move to "Also approve tool calls", the new default. New agents start in their runtime's auto or full-access permission mode. The bot no longer joins a public Slack channel automatically; it asks the person behind the turn, and the per-bot auto-join setting is removed. The Agent/Channel memory scope choice is removed in favor of automatic layers.

Upgrade note: The daemon refuses to start if its config still sets sandbox.backend or security.requireSandbox, or if it is started with --require-sandbox. Remove those settings, or use "sandbox": { "host": false } to refuse unsandboxed sessions. Daemons older than v2.0.0 must be upgraded to connect properly.

• Slack Home Tab — Every Slack app now has a Home tab with getting-started steps and links to its organization and agent settings in the console. An app that lost its agent shows a Reconnect button that rebinds it without another OAuth approval.
• Install Slack First — Users can install the Slack app before they have an AgentConnect organization or agent, then sign in from Slack and connect the workspace to an agent they can edit.
• Single-Session Slack DMs — A Slack DM can now use single-session mode, so every message in the DM continues one conversation.

Upgrade note: Existing Slack apps need their manifest refreshed after upgrading the relay or daemon that serves them to enable the Home tab.

• Source Cache for Cluster Workspaces — Cluster daemons can start workspace clones from Git bundles in an S3-compatible object store and write updated bundles back, with usage accounting, cleanup, and metrics. It is off by default and changes nothing until a bucket is configured.
• Code-Host Feedback on GitLab and Gitea — Review and CI feedback on GitLab merge requests and Gitea pull requests can now resume the session that opened them, as GitHub already does.
• Unified Approvals — Console, Slack channel, and approval-DM cards now settle approvals through one path. From the console, editors can allow a managed-memory write for the whole session.
• Multi-Agent Conversations — Continue a hook conversation that several agents worked on, and @mention the agents you want to reply.
• Console Updates — Download files uploaded to or written by a session, use a navigation drawer on phones, and see recovering daemons marked as Reconnecting. Members of a daemon group that share one PostgreSQL store can now resume each other's sessions.
• Operations — The Helm chart runs database migrations in a pre-upgrade Job and offers an optional Control Plane PodDisruptionBudget. Repository grants are re-checked on a schedule, and grants whose attesting member lost access are marked stale.

This release also improves reliability across Control Plane restarts and handoffs, adds a Slack welcome for the built-in agent, and upgrades the bundled Logto in Docker Compose to 1.44.0.

Behavior change: Syncing an agent's workspace now requires edit access. A channel's shared session can no longer be made private by one participant. The chart refuses to render more than one Control Plane replica. Slack installs no longer request the unused team:read, users:read.email, search:read.files, and search:read.users scopes.

Upgrade note: Helm now waits for the migration Job during install and upgrade, so a release with a long migration may need a longer --timeout.

• Agent Chat API — Add a chat API to an agent from its Integrations tab and call it directly with an API key, over AI SDK UI or AG-UI. Questions and tool approvals raised during a turn go back to the caller, a Decision can gate which messages the agent answers, and the console includes a Quickstart with curl, Node, and browser examples.
• Service Accounts — Organization owners can add service-account members that never sign in and manage their API keys in Settings.
• Forgejo Support — Connect Forgejo 15 and later through the Gitea integration.
• Google Chat — Google Chat is now offered in every console. The agent replies with a placeholder that becomes its answer, and it welcomes users when added and responds to /help.
• Decisions Improvement — Try one sample message against every consumer of a Decision, see each chained step's model result in Recent evaluations, edit a Decision's places from its Used in card, and apply a channel's By decision rules to all of its bot's channels.

This release also retries recoverable runtime failures within the active turn, gives cold sandbox pods more time to start, and points documentation links at the new docs site.

Behavior change: Newly created default agents allow runtime changes in chat.

• Decisions — Define reusable questions that a model answers to route work: gate a conversation, route a shared bot's messages, pick a session's runtime and model, or route GitHub, GitLab, and Gitea events to repositories. Decisions can be chained, tried against sample messages, and reviewed through their recent evaluations, and are now available in every console.
• Daemon Groups — Spread sessions across a group's daemons by capacity and run isolated sessions on another member's executor. Self-hosted daemons can share a PostgreSQL session store, and daemon groups no longer require a feature flag.
• Session Modes and !new — Choose how each conversation maps messages to sessions, and use !new to start over in a conversation.
• More Messaging Platforms — QQ official bots support private chats, group mentions, user profiles, and file attachments. Google Chat, including Chat apps built as Workspace add-ons, is available as a preview behind the google-chat console flag.
• Repository Access — Authorize or watch every repository an installation covers, lower a grant's access in place, and choose whether each additional repository is always checked out or made available on demand.
• Release Triggers — Trigger agents when GitHub, GitLab, or Gitea releases are published, and configure installation-wide GitHub triggers.
• Scoped API Keys — Limit a personal API key to read-only or agent-chat access, restrict it to selected agents, and edit or regenerate it after creation.
• Slack Channel Reach — Slack agents can read and post in any public channel on demand and reply in existing threads. Private channels and DMs remain limited to the conversation that invoked the agent.
• Console Updates — The console adds a draft Simplified Chinese translation, follows the system color scheme, and has a redesigned Knowledge page.

This release also improves sandbox and Kubernetes session reliability, resumes admitted turns after a daemon restart, and adds Gemini CLI model selection.

Behavior change: Organization owners can now view, edit, and re-share every resource in their organization, including restricted ones. Slack bots join public channels on demand by default; this can be turned off per bot in the console. New session branches use the a10t/ prefix. Requests authenticated with an API key can no longer create organizations or manage API keys or daemon credentials.

Repository maintainers can now allow specific trusted contributors to trigger agents without granting them broader repository permissions.

This release also fixes Gitea access checks for users with team-granted write permissions and credential handling for Claude custom providers.

• Agent Setup in Webchat — Configure agents, manage skills and MCP servers, and connect code hosts directly from chat. Configuration cards remain available after refreshing the page.

This release also improves MCP OAuth compatibility and prevents a failed skill-source installation from blocking session startup.

• MCP OAuth — Connect custom MCP servers through OAuth, with authorization and token refresh managed by AgentConnect.
• Private Skill Sources — Install skills from private GitHub repositories covered by your organization's GitHub App installation.
• Code-host Label Filters — Filter issue and pull-request subscriptions by label across GitHub, GitLab, and Gitea.

Subscription change: Existing GitHub issue subscriptions using the label-applied cadence migrate to every update with the same label filter. They now also react to later updates and replies while a matching label remains.