Xagent v0.7.3
A full OAuth overhaul, five new connectors, a first-login onboarding wizard, skill import from file, and a large batch of security hardening and reliability fixes
📅 Released September 5, 2026
🔄 How to update
cd xagent && git pull
docker compose up -d
pip install --upgrade xagent-ai
✅ Highlights
OAuth overhaul
A builtin OAuth catalog, trusted actor-owned OAuth, owner-scoped APIs, and a hardened OAuth lifecycle fenced by generation.
Five new connectors
Mixpanel, ChartMogul and Magento join, plus Employment Hero and MYOB AccountRight over OAuth.
Onboarding & Skill Hub
A first-login onboarding wizard, and skills can now be imported from an uploaded file.
🚀 What's New
🔐 Full OAuth overhaul
Adds a builtin OAuth catalog and trusted actor-owned OAuth, introduces owner-scoped OAuth APIs, fences OAuth persistence by lifecycle generation, and hardens the OAuth lifecycle overall.
🔌 Five new connectors
Adds Mixpanel, ChartMogul and Magento MCP connectors, plus Employment Hero and MYOB AccountRight OAuth MCP connectors; the connector seam gains an optional team access hook.
🧩 Skill Hub improvements
Import a skill from an uploaded file, give personal-skill writes an attempt-owned identity, and validate skill bundles at the shared write boundary.
🚀 First-login onboarding wizard
Adds a first-login onboarding wizard with a redirect hook.
🧱 Actor and runtime isolation
Isolates MCP runtime and task context, adds stable MCP lifecycle generations and an atomic app-scoped teardown primitive, and lets channels continue waiting actor tasks.
🖥️ Widget experience
An expand/collapse toggle in the overflow menu, and the embedded widget becomes a true full-screen overlay on mobile.
👥 Sidebar renamed to My Team
Renames the sidebar Agents/Templates entries to My Team/Add teammates.
🗜️ Context compaction
Carries a compacted summary across turns, keeps compaction on the summary path, and demotes message dropping from strategy to backstop.
🕸️ Explainable web crawling
Records why a crawl stopped and who refused each link, flags a site-blocked crawl without failing the import, and treats a missing robots.txt as no restrictions.
🛡️ Platform models and startup gates
Enforces platform model identities with transactional staging, adds host admission gates, and allows excluding xrouter candidate models.
🧠 Memory and trusted policy
Adds trusted service policy overrides and separates recall input from execution context.
🛠 Stability & Polish
- Install Chrome/Chromium in the sandbox image for chrome-devtools MCP
- Widget: require reload for unreplayable sessions
- Let the answering model own the response language
- Stabilize the Telegram voice cleanup test
- Add client-safe error codes
- MCP: resolve a server’s catalog app by stable identity on teardown
- Persist terminal command outcomes atomically
- Recognize provider-level tool_choice rejections and widen the connection-test timeout
- Defer contended durable form responses
- Skip legacy-resume close on a replayed injection
- Onboarding: remove the visible focus outline on step headings
- Close every final_answer stream a ReAct batch opens
- MCP: don’t 409 a builtin connector reconnect over a stale args-only diff
- CI: de-flake the tracker pool-pressure loop-responsiveness tests
- Surface terminal external-input rejections and couple the defer budget to the lease TTL
- DB: fail startup when the live taskstatus enum has drifted
- Retry OAuth token refresh across connect-phase failures and 5xx
- Jitter the trigger dispatcher’s first tick after startup
- Only drop OAuth connections on confirmed permanent refresh failure
- Tolerate transient poll failures while waiting on a background job
- Ground tool-call arguments, not just answer text
- MCP: carry field schema metadata into the tool args model
- Preserve request provenance across checkpoints
- Parse JSON-encoded array strings in MCP tool-arg normalization
- Retry tool calls without reasoning effort
- Lock the Custom API and MCP server definition rows on edit and delete
- Surface connector runtime failures to the chat client
- Close the OS-native proxy bypass in httpx web-fetch clients
- Guard chrome seed migration downgrade against missing columns
- Scope Slack reads to the channels the user named or selected
- Restore CA-bundle verification on trust_env=False httpx transports
- PostHog: gate proxied requests on trusted egress
- CI: restrict the nightly build to the upstream repository
- Mixpanel: fix a capping-collapse KeyError in three list tools
- Reclassify checkpoint rows missing the run partition
- Broadcast stale_run external CANCEL rejections per-reason
- Expose structured terminal command outcomes on agent_error frames
- Allow attached-task output downloads
- CI: skip unaffected jobs by filtering on changed paths
- Canonicalize request language and pending answers
- Read and render output language through one seam
- Events stream: require the steps-version reader on the attach fast paths
- CI: bump checkout, setup-python, setup-node, docker/* and the cache actions
- CI: add a weekly Trivy scan of the published Docker images