Xagent v0.8.4
A chat-first teammate workspace, prompt context and visitor attachments for the widget, signed uploads for MCP connectors, tiered connector smoke checks, and Auto model failover
📅 Released October 25, 2026
🔄 How to update
cd xagent && git pull
docker compose up -d
pip install --upgrade xagent-ai
✅ Highlights
Teammate workspace
A new chat-first workspace and onboarding, with workspace state isolated by account and task intent.
Widget prompt context
Host pages pass business context to the agent, and visitors can attach files in the session.
Connector smoke checks
Deployed connectors are checked at three levels: configuration, connection and a read-only tool call.
🚀 What's New
🤝 Chat-first teammate workspace
A new chat-first teammate workspace and onboarding flow; chat workspace state is isolated by account and task intent; workspace navigation dialogs are aligned.
🧩 Widget prompt context
Agents declare prompt context fields and filter their values, and the fields can be edited in the Builder; host pages pass prompt context through the widget_key entry and it is injected into every agent turn; the deploy dialog gains an embed snippet slot.
📎 Attachments in session chat
Visitors in the widget's session chat can attach files, backed by a new upload data path; turns that carry files show the user's own text.
☁️ MCP signed uploads
Connectors can upload workspace files through a signed URL before the tool call; MCP servers store signed upload settings and carry them into connections, editable in the custom MCP form; signed upload checks and an authorization-retrying host call are added.
🔍 Tiered connector smoke checks
Deployed connectors get an L1 configuration check, an L2 connection check and an L3 read-only tool-call probe; built-in OAuth client readiness is checked after deploy; a connector can be started the way a task does, outside a task, with an in-container startability check for every connector; sessions and probes accept an actor policy.
📊 Broader usage metering
Audio and video generation are metered; embedding and rerank are metered, and non-run usage is delivered.
🔀 Auto model failover
Auto fails over to its fallback when the selected model is down, and keeps the fallback out of routing while other candidates remain.
⚖️ Fair command dispatch
Dispatcher slots are reserved for interactive commands; the batch-line scan takes interactive and control commands, and a cancel or pause can pass held batch commands; task commands record a fairness key with slots counted per key, and claimable commands are indexed by fairness key and class; planned process restarts can opt into a release hold.
🛡️ Isolation and access control
HTML previews run on an isolated origin; SQL tool execution is isolated and deployment SQL connection policies are enforced; tool usage endpoints require authentication; local media reads are confined to authorized staging; LLM input is stripped from guest trace frames.
🌐 Public-only egress and patched dependencies
Public-only HTTP client transports now guard managed HTTP connectors, model SDK clients, remote MCP sessions and OAuth refresh, proxy-backed asset fetches and A2A; remote speech and image input downloads are bounded; compatible Python security dependencies are upgraded, media parser dependencies patched, and frontend tests migrated to patched Vitest 4.
🔌 Connector upgrades
Planner gains delete-plan and delete-bucket tools; Linear can put issues in a project and find projects by name or link; Google Calendar invites can be accepted, declined or tentatively accepted; Zendesk sends the Marketplace request headers; admin agent management is paginated.
🛠 Stability & Polish
- Performance: build the admission predicate once per process and skip candidate construction when nothing can be claimed; share one guarded CA context across public HTTP transports; reuse generated MCP argument models across adapters
- Memory: add fixed memory scope binding, honor user memory deletion requests, and reconcile memory retrieval caches
- Database: add retry classification and policy for v2 fact writes; trace: retry v2 event commits under the same fact identity
- Web: correlate the auto-resume in-flight dispatch subquery
- SQL worker: preserve PostgreSQL writes and binary results, and keep empty export columns
- Prevent runtime acquisition token reuse
- Teams: stop sending $top to Graph lists that reject it
- Web: decide idle release on the batch line by the earliest command
- Tools: bound execute_python_code execution time
- Surface disabled Slack DM configuration
- Tolerate missing Xero pagination metadata
- Report Outlook search failures correctly
- ReAct: bound final answers to verified findings
- Mixpanel: support named user activity lookup
- Events: keep the attempt identity on resumed tool-interaction settlements
- Web: tell the client a deferred delivery's outcome when the resume is cancelled again
- Web: sweep idle cached agent runtimes per process
- Agent: stop the run when a settlement fact fails to commit
- MCP: let a team member open a team-linked MCP server's detail
- Workspace: prepare files for non-root sandboxes and move construction off async loops
- Attachments: reuse durable workspace inputs
- Tasks: retry authoritative outbound and existing-input acceptance
- MCP: read signed upload settings from the connection
- Tests and docs: make the memory lifecycle-lock admission test deterministic, cover an interrupt that lands before a streaming LLM call starts, and describe the batch-line backlog read as it is
- Bump compose images to 0.8.3