Xagent v0.7.2
Salesforce, Google Search Console and Deputy connectors, a built-in agent runtime, end-to-end timezone awareness, a docx report editing skill, plus security hardening and reliability fixes
📅 Released August 28, 2026
🔄 How to update
cd xagent && git pull
docker compose up -d
pip install --upgrade xagent-ai
✅ Highlights
Three new connectors
Salesforce (OAuth App), Google Search Console and Deputy join as MCP connectors, plus a Slack channel-join tool.
End-to-end timezone awareness
Widgets declare a timezone, chat messages carry the browser timezone, and the agent clock renders in the caller’s timezone.
docx report editing
A new docx-report-editorial builtin skill, with python-docx added to the sandbox image.
🚀 What's New
🔌 Salesforce, Google Search Console & Deputy connectors
Adds a Salesforce connector (OAuth App plus custom MCP tools), a Google Search Console MCP connector, and a Deputy OAuth MCP connector.
💬 Slack channel-join tool
Adds a user-gated Slack channel-join tool with actionable not-in-channel errors.
🏃 Built-in agent runtime
Adds a built-in agent runtime.
🕐 End-to-end timezone awareness
Embedders declare a timezone with data-timezone, chat messages report the browser timezone, the injected agent clock renders in the caller’s timezone, task-creation turns carry the caller timezone, and a current-time tool is callable mid-turn.
📄 docx report editing skill
Adds the docx-report-editorial builtin skill and python-docx to the sandbox image.
🧩 Widget experience
Panel width is resizable and persisted, with header close and new-conversation overflow controls.
👥 /task uses a My Team picker
Replaces the /task template grid with a My Team picker.
🧠 Faithful conversation context
Adds a faithful conversation context reconstruction service.
🔐 Security hardening
Hardens shared skill-archive extraction, isolates actor-owned OAuth credentials, adds actor OAuth flow state, and redacts client-facing exception text.
📡 Event stream & question identity
Sends a step snapshot on attach-time close paths and carries question event identity through publication.
🧮 OpenRouter improvements
Replays DeepSeek reasoning content on tool-call chains and allows thinking for DeepSeek-served models that declare it.
🛠 Stability & Polish
- Run orphaned temp-file cleanup in the background, off the inline startup path
- Classify the provider fault behind durable-storage failures
- Install the Docker CLI instead of the full docker.io engine
- Only send an explicitly requested temperature in the connection test
- OpenRouter: drop require_parameters from official-provider pinning
- Preserve taskless Session file rejection
- OpenRouter: retry provider-compat 4xx in the client for every entrypoint
- MCP: stop gating the connector ownership badge on connection state
- Carry the storage key on the exception, not in its message
- Trace: cap event payload rendering in ConsoleTraceHandler
- Unwrap SandboxLeaseProvider before MCP list_tools
- OpenAI: wrap the response_format resend and return the vision result
- Surface the backend’s real rejection reason in ClarificationForm
- Skip redundant sandbox workspace mkdir
- Bind the write path’s close, task lookup, and audit identity
- Strip final_answer bundled with work tool calls in ReAct
- Log the provider cause behind durable-storage faults
- Defer pypinyin import so sandboxed MCP tool calls don’t crash
- Fail closed when the runtime tool policy cannot be resolved
- Stop the injected clock claiming to be the current time
- Harden client-facing failure logging
- Name and contain durable-storage faults on the WebSocket paths
- Vision tool: parse text-envelope responses instead of reporting empty success
- Redact legacy failure history
- Make client-safe AST analysis fail closed
- Drop whitespace-only ask_user options and normalize BOM field names
- Narrow the Google Calendar connector scope to calendar.events
- Redact websocket background exception text
- Make durable resume contention idempotent
- Widget: bind answers to interaction requests
- WebSocket: redact incidental exception text from chat clients
- CI: move dev and CI PostgreSQL images from 16 to 17
- Publish a Docker Hub overview for the sandbox image