Active development: 50 commits across 14 contributors
Code ActivitySource linked
2 active day(s) in use-agent-os/agent-os.
agent-os
Utility
Verified BuilderThe Open Agent Operation System
ShippingLast ship 1d ago
Latest ship
Builder activity
Build timeline
AgentOS 2026.9.3
Github ReleaseSource verified
A release about output that never reached the screen, and addresses that were never checked against the chain. ## The render was the model's decision, so it did not happen Skills could already publish an artifact — a chart, and as of this release a card grid — and the model was supposed to call `publish_artifact` when one was written. Live-testing the card renderer produced the same outcome seven times across two models: the script ran, the payload was written to the workspace, and the answer came back as a hand-written markdown table. `~/.agentos/media/artifacts/` stayed empty. A render that
View evidenceAgentOS 2026.9.2
Github ReleaseSource verified
A release about numbers that were already there and nobody read — the price a marketplace of sellers is quoting right now, the dollars the router saved on every turn since it shipped — and about four gates that were checking something adjacent to the thing they were supposed to guard. ## A provider where sellers compete on price **Surplus Intelligence** (`surplus`) joins as a runtime provider. It is a two-sided marketplace: each request is routed to the cheapest healthy seller. Configuration is ordinary — an OpenAI-compatible provider with a buyer API key (`SURPLUS_API_KEY`, `inf_…`) against `
View evidenceAgentOS 2026.9.1
Github ReleaseSource verified
A release about the blast radius of a shared surface. Projects turned out to be one — shared knowledge text, editable by any member session, injected into every member's system prompt — and three of the fixes below are about drawing that boundary properly. Alongside it, the gateway learns to say what it is doing while it runs. ## Projects: one prompt injection should not reach every session A project's knowledge text is injected into the system prompt of **every** member session, every turn. That makes it the highest-value write target in the product, and the `projects_*` agent tools handed it
View evidenceAgentOS 2026.8.29
Github ReleaseSource verified
A release about reaching the agent by email, and about the places where output left the process without being counted — bytes into memory, secrets into the transcript. ## Email is a channel A mailbox is now a first-class channel (`type = "email"`). Inbound over IMAP polling, outbound over SMTP with `In-Reply-To`/`References` so a reply stays in the mail thread it answers. There is no platform app to register — IMAP/SMTP credentials are the whole setup. One mail thread is one session. Quoted history is stripped before the text reaches the model, HTML-only mail is flattened to text, and inbound
View evidenceAgentOS 2026.8.28
Github ReleaseSource verified
A release about giving sessions a place to live. Chat sessions can now be grouped into projects that carry shared knowledge into every member session's prompt, and the cron parser stops arguing with operators about what a perfectly ordinary expression means. ## Projects Sessions can now be grouped into **projects** — and a project sits above agents, not inside one. Sessions of any agent can join the same project; the project's agent field is only the default for "New chat in project". The part that does the work is **knowledge**: each project carries a free-form text that is injected into the
View evidenceAgentOS 2026.8.27
Github ReleaseSource verified
A release about ceilings and about what a file hands back. Money gets a hard stop that survives a restart, a skill zip stops being a way to take the gateway down, a credential read out of a config file stops landing in the transcript, and three subsystems that shipped in the wheel while doing nothing are gone. ## A budget you can actually hit A new `[budgets]` config section sets money ceilings — per session, per UTC day, per agent, per channel: ```toml [budgets] session_limit_usd = 5.00 session_warn_usd = 4.00 daily_limit_usd = 50.00 daily_warn_usd = 40.00 ``` A turn that starts at or above a
View evidenceAgentOS 2026.8.24
Github ReleaseSource verified
A release about who is allowed to say yes, and what a turn actually cost. Channel approvals become a button that checks who pressed it, cost stops being a number you only see at the end of the month, Aeon joins the Partner Skills shelf, and four ways into the gateway close behind us. ## An approval is a button now — and it checks who pressed it Telegram inline keyboards, Slack Block Kit actions, and Discord message components render an Approve/Deny pair for a gated tool call, instead of asking the operator to type a reply into a channel and hope the parser agreed with them. The button is the e
View evidenceAgentOS 2026.8.23
Github ReleaseSource verified
A release about reaching past the model's own text: the agent can drive a real browser, failover stops paying for a dead provider once per turn, a skill's dependencies install whatever kind they declare, and a chart downloads as the chart you were looking at. ## The agent can drive a real browser A `browser` built-in, backed by the agent-browser CLI (Vercel Labs, Apache-2.0): navigate, read a page as an accessibility snapshot with element refs, click, type, fill, wait, run JavaScript, answer native dialogs, and screenshot. Managed and headless by default; attach mode drives the operator's own
View evidenceAgentOS 2026.8.21
Github ReleaseSource verified
A release about the ways in came in unequal: a voice note now says what it says, a scheduled turn can finish what it starts, a fetched page is finally untrusted in the way the prompt already claimed, and a custom skill starts from something that passes the gate. ## A voice note is a message now Inbound Telegram voice messages, audio files, and round video notes are transcribed before the turn is built, and the transcript becomes the message text. Before this, a voice note reached the agent as the placeholder `[voice]` with the audio stripped — the message arrived, admitted and delivered, carry
View evidenceAgentOS 2026.8.19
Github ReleaseSource verified
A release about what actually reaches the model: a skill can pin the rule it needs read, a tool result survives into the next turn intact, a cron job can name its own directory, and the system prompt stopped teaching a gateway things it cannot do. ## A cron job can name its own directory A `script` path passed to `cron` may now contain `{job_id}`, which the scheduler replaces with the created job's own id before the job is persisted. The `add` result reports the resolved path back as `script_path`. A job that keeps its files in a directory named after itself could not name that directory at cr
View evidenceAgentOS 2026.8.17
Github ReleaseSource verified
A scheduling-and-sessions release: cron jobs can be edited instead of rebuilt, they can name where they announce, and sessions can be renamed from every surface. ## Cron jobs are editable The in-agent `cron` tool can finally change a job in place. Previously the only strategy available to an agent in chat was to `add` a replacement and `remove` the original — which deleted the job the user wanted to keep and reset every setting the re-create did not name: an `agent_turn` fell back to `reminder`, a job pinned to `Asia/Bangkok` moved to UTC, its tool policy was dropped, and its output started la
View evidenceAgentOS 2026.8.15
Github ReleaseSource verified
A search-and-Web-UI release. `web_search` gains Tavily as a built-in runtime provider, the Web UI finally tells you when a new release is out — the CLI has done that for several versions — and every sidebar view becomes reachable from the keyboard through Gmail-style `g` chords. ### Added - **A built-in Tavily provider for `web_search`.** Tavily was previously reachable only through the `multi-search-engine` skill, which shells out to a script. It is now a runtime provider registered next to `brave` and `duckduckgo`, so selecting `tavily` and setting `TAVILY_API_KEY` is the whole setup — no sk
View evidenceAgentOS 2026.8.13
Github ReleaseSource verified
A crypto-skill release. AgentOS can now launch a token on pools.fun and manage the creator fees afterwards, from a skill that keeps reading and signing in separate scripts and hashes the plan it quotes so the transaction that broadcasts is provably the one you approved. ### Added - **A bundled `poolsdotfun-token-launcher` skill.** Launches a token through the pools.fun `PartyFactory` on Robinhood Chain (4663) and manages creator fees on the `PartyLocker` afterwards. There is no RPC to configure — the chain is fixed and the endpoint is built in, so the only thing to set is `POOLSFUN_PRIVATE_KEY
View evidenceAgentOS 2026.8.12
Github ReleaseSource verified
A model-control and reasoning release. Choosing which model answers a turn is now a control in the chat composer rather than a slash command to remember, and a pin you set stays set. The Web UI shows the model thinking while it works, and a hub-installed skill that renames itself in its own manifest no longer masquerades as a local one. ### Added - **A route picker in the chat composer.** One searchable list holding `Auto`, the text tiers your `[agentos_router]` config actually defines — each labelled with the model it resolves to, e.g. `c1 · gpt-5.6-luna` — and every model the active provider
View evidenceAgentOS 2026.8.11
Github ReleaseSource verified
An X-search and internationalization release. AgentOS can search X (Twitter) through xAI, and a SuperGrok subscription pays for it instead of an API key nobody with a subscription holds. Every Web UI view now reads its copy from a catalog rather than having English written into the JSX, so a second language is a catalog away rather than a rewrite of every view. Translation turns stop drifting a price tier based on the language they were written in. ### Added - **`x_search`: search X (Twitter) from an agent turn.** A built-in tool backed by xAI's server-side `x_search` on the Responses API. xAI
View evidenceAgentOS 2026.8.9
Github ReleaseSource verified
A channels-and-internals release. Telegram replies stream instead of arriving all at once at the end; the seven GMGN skills stop reading as one skill listed seven times; a model's price and context window are declared once rather than restated in five places; and shell workspace lockdown stops missing a redirection that has no space around the `>`. ### Added - **Telegram replies stream.** Telegram was the only major chat adapter without `send_streaming`, so `resolve_channel_stream_policy` picked `typing_final` from method presence: a typing indicator for the whole run, then the entire answer d
View evidenceAgentOS 2026.8.7
Github ReleaseSource verified
A Web UI release. A token price chart draws in the chat transcript instead of arriving as a file you have to open somewhere else; the console's keyboard shortcuts became one registry with a list you can actually read; and the two settings surfaces that made you type a value from memory — router tier models, and everything you lose when you switch LLM provider — stopped doing that. ### Added - **Token price charts render inline in chat.** An artifact published as `application/vnd.agentos.chart+json` draws as an interactive candlestick chart in the transcript instead of a download chip, and the
View evidenceAgentOS 2026.8.6
Github ReleaseSource verified
A cron release. Schedules can run scripts now — without paying for a model turn on every tick — and the surface that tells you what a job actually did was rebuilt around that, because a script job is the shape that exposed how much of it was broken. ### Added - **A cron job can run a script instead of a model turn.** Every job that could *do* something went through the model chain, so a deterministic task — poll an endpoint, check a threshold, diff a feed — paid for a full turn on every tick. A 5-minute job is 288 turns a day to run a script that prints one line when something is wrong. Two sh
View evidenceAgentOS 2026.8.5
Github ReleaseSource verified
A cron-reliability and web-UI release. If you created a reminder from the web UI and it has been failing every single run, that is fixed here — and the cause was a session key stamped onto jobs that never asked for one. ### Fixed - **A vanished origin chat no longer fails every cron run.** The web UI stamps `originSessionKey` onto every reminder job while forcing its target to `isolated`, and reminder is the default payload kind for a new job — so jobs that never asked to be bound to a session carried one anyway. "New Chat" makes this routine rather than rare: it mints a session key client-sid
View evidenceAgentOS 2026.8.3
Github ReleaseSource verified
A packaging, skills, and upgrade-path release. If you installed AgentOS from a local checkout, `agentos upgrade` has been shipping you a stale web UI — that is fixed here, and this is the release to take. ### Fixed - **`agentos upgrade` no longer ships a stale React control UI.** `scripts/install_source.sh` installs the directory itself, so uv's tool receipt records a *directory* requirement; `uv tool upgrade` then re-resolved that requirement and rebuilt the wheel from the working tree. The wheel bundles `src/agentos/gateway/static/dist/**`, but nothing in the upgrade path runs `npm run build
View evidenceAgentOS 2026.8.2.post1
Github ReleaseSource verified
A post-release for **2026.8.2**. Same feature set as v2026.8.2 — this tag exists because the tagged Windows release job for v2026.8.2 failed *after* the tag was pushed, so the packaging fix could not reuse it. If you installed 2026.8.2, upgrading is only necessary if you use the `senior-unilp-manager` bundled skill or schedule cron prompts containing Unicode combining marks. ### Fixed - **A bundled skill's `assets/` markdown is shipped in the wheel.** The release wheel guard allowed markdown only at `SKILL.md` plus two force-included pptx references, so `senior-unilp-manager`'s `assets/v4-refe
View evidenceAgentOS 2026.7.31
Github ReleaseSource verified
A security release: the outbound credential guard is rebuilt around credential *values*, command output is scanned before it reaches the model, and the gateway token no longer leaks into child processes. ## Security - **`AGENTOS_GATEWAY_TOKEN` and the sandbox guard switches no longer reach child processes.** Every `exec_command` previously inherited `os.environ` verbatim, including the token that authenticates to the control plane. - **`http_request` now refuses cloud metadata endpoints** (`169.254.169.254`, `metadata.google.internal`, ECS task credentials). The repo already shipped an SSRF gu
View evidenceAgentOS 2026.7.30
Github ReleaseSource verified
## Added - **Capminal Skills in the Skills hub** — browse, inspect, and install allowlisted `Capminal/agent-skills` with publisher branding that falls back cleanly when the logo cannot be fetched (#144). ## Changed - **Runtime dependencies carry upper bounds** — a major release of a dependency can no longer land in an install that was resolved against the previous one (#153). ## Fixed - **The skills block is now something the model can act on** — the prompt budget no longer falls off a cliff that drops *every* description at once, names-only mode points at `skill_list` instead of one `skill_vi
View evidenceAgentOS 2026.7.29
Github ReleaseSource verified
## Added - **Bankr skills published from bankr.bot** — skills that live under an author's wallet address, instead of in the `BankrBot/skills` repository, can now be browsed and installed like any other hub skill. The `SKILL.md` is synthesized from the inline JSON payload, the skill is credited to its author rather than to Bankr, and only allowlisted skills install through the Bankr source. (#150) ## Security - **Audit report policy** — `SECURITY.md` now says what happens to an audit report: send findings through the private advisory form rather than as a pull request, there is no bug bounty pr
View evidence
Research notes
Written by HEY researchers and reviewed before publishing. Commentary with sources — not the project's own claims, and not evidence of shipping.
No published notes on agent-os yet.
Know something about agent-os? Sign in with GitHub to submit a research note. Notes are reviewed before they appear here.