DEV Community: 涼風羽月

LibreFang 2026.9.14 Released

涼風羽月 — Fri, 16 Oct 2026 05:38:38 +0000

LibreFang 2026.9.14 Released

v2026.9.14 is a milestone release bringing autonomous goal execution, multi-instance channels, per-agent reasoning modes, and comprehensive configuration tooling to the dashboard and CLI. This release stabilizes the agent-authoring experience while closing several security boundaries and fixing 50+ bugs.

203 PRs from 5 contributors since v2026.8.30.

Autonomous Goal Execution & Goals System

Agents can now drive themselves through iterative tasks without human invocation. A goal defines what success looks like; LibreFang auto-spawns a disposable worker agent that runs the goal, optionally spawns a verifier that judges each iteration, and learns from tagged markers (GOAL_LEARNED: <text>) it encounters along the way.

New in this release:

librefang goal "<description>" CLI command with --loop-engineering mode for automated verification
Goals screen in the TUI with wizard-driven creation and live phase tracking
/goal slash command in Telegram and Slack
Dashboard Goals page with phase badges and outcome visibility
Per-goal evaluator_model to judge completion, plus auto-generated skills from captured learnings

Agent Types: Manifests as First-Class Citizens

Agent types (reusable manifests) moved from templates/ to the canonical agent-types/ directory and gained full CRUD support. Create, edit, and delete types from the dashboard Agent Types page instead of hand-editing TOML. Types can now be promoted directly to the public registry as a GitHub PR.

Related improvements:

Dashboard Agent Types page with card grid, Quick Run for ephemeral spawns
Shared Folders editor on agent type and instance details
librefang agent new discovers types in the flat canonical store
Registry sync resolves both legacy agents/ and new agent-types/ directories
Source template origin tracked on every agent spawned from a type

Channel Multi-Instance Support

A single channel adapter (Telegram, Slack, etc.) can now run as multiple named instances, each with its own configuration, secrets namespace, and assigned agent. Manage instances from the dashboard Channels screen or the TUI.

Key features:

Per-instance secret namespacing prevents credential sharing between bots
Collision detection rejects names that would map to the same namespace
Add/configure/delete UI on both dashboard and TUI
Instance name and per-instance agent binding in config forms

Per-Agent Reasoning Mode & Extended Thinking

DeepSeek V4 and OpenRouter-routed models now respect per-agent reasoning-mode settings. Agents can be configured to run with none, low, high, or max reasoning effort. The Anthropic driver now handles current Claude models (5, Sonnet 5, Opus 4.8+) which removed sampling parameters and moved extended thinking to a new schema.

What changed:

reasoning_mode settable per agent, globally, or per task
Provider-aware translation: DeepSeek gets thinking fields, OpenRouter gets nested reasoning, others get top-level reasoning_effort
Adaptive thinking on Claude (effort comes from reasoning_mode alone, no separate budget)
Fallback chain model = "default" now resolves correctly

Configuration, Credentials & Vaults

The operator experience for configuration just got significantly better. The dashboard gains a schema-driven config editor; the vault write API lets surfaces store credentials securely; and editing flows now validate and report failures instead of silently accepting bad input.

What's new:

Dashboard Config page with per-field editable rows derived from GET /api/config/schema
TUI Settings screen gains Configuration tab with real-time validation
Vault write API: GET /api/vault/keys, PUT /api/vault/keys/{key}, DELETE /api/vault/keys/{key}
Vault reads show effective source: environment, vault, or unset
Dashboard Channels settings are writable again

Model Management & Parameters

Every model parameter now uses the same control everywhere it appears. Context window, max output tokens, temperature, top-p, and the two penalties are now consistently editable with shared presets and bounds checking.

Improvements:

context_window and max_output_tokens are editable per agent from the API, CLI, TUI, and dashboard
Model parameter overrides survive registry syncs (schema v56)
Per-model limits show effective value vs. catalog figure
Unsupported parameters (e.g., reasoning_effort on a gateway that doesn't support it) are stripped and retried transparently

Memory System Hardening

Automatic memory scoping now closes three holes that let memories leak across boundaries:

capabilities.memory_read = [] now blocks substrate recall and context-engine injection (not just auto-retrieve)
capabilities.memory_write = [] blocks the per-turn writer, not just extraction
Per-turn writer stamps both chat_scope and session_scope so raw dialogue respects agent isolation
Full-text-index rebuilds on UPDATEs that cannot change indexed content (access-count bumps, decay sweeps)
Session and cron compaction run on the agent's own model chain, not the kernel default

Dashboard & TUI Enhancements

The UX got smoother everywhere. Failed operations now report what the daemon said instead of generic lines. The dashboard shows real values for configuration settings instead of cached placeholders. The TUI's goal detail panel, memory config editor, and every error message is now precise and actionable.

Highlights:

Dashboard login survives daemon restart (session tokens now restored correctly)
Agent detail drawer shows injected token footprint and last five LLM calls
Memory tab shows resolved extraction model and provenance
Workflow run detail shows step progress (current_step_index, total_steps, per-step variables)
Goals page shows autonomous run phase badges (finished, rate-limited, stopped, etc.)
Slider tick legends now position labels at their true values, not evenly spaced
Provider page shows real availability status, not a stale cached state
Add button re-enabled on Channels page after first instance is configured

Bug Fixes & Stability

50+ bugs fixed, including critical issues that affected real deployments:

Memory consolidation no longer merges memories across different peers, chats, or sessions
Tool loop guard now detects repeated identical results and refuses the call after three runs
Streaming replies with malformed tool-call markup are replaced with an honest sentence instead of sent raw to channels
Network byte quota now actually enforces [resources] max_network_bytes_per_hour (was accepted but ignored)
Docker sandbox container pooling now works (was created and destroyed per call)
Workflow step prompts expanded in single pass (order-independent, no iteration on substituted values)
Cron schedule editing no longer reverts to defaults when no changes made
Sidecar channel delete now removes every adapter instance, not guessed ones
Config reload correctly reports what actually took effect (not applied work it withheld)
Session streaming no longer wedges the daemon on message-history compaction
Approval routing now properly scoped to requesting agent's configured channels
Windows launcher (librefang.exe) no longer stack-overflows on startup

Security Fixes

Approval field payload injection blocked: config writes can no longer smuggle credential fields into tables
MCP server listing now requires Admin role (was exposing tokens in SSE/HTTP URLs)
API key revocation on POST /api/config/reload now applies to REST surface (was only effective on WebSocket)
Passkey login no longer accepts credentials filed under the wrong principal
Dashboard root path protected by auth (was unprotected even with password configured)
Dangerous-command gate no longer bypassed by quoted program names ("rm" -rf / now blocked)
Sidecar secrets no longer shared between sibling instances
Plugin [env] expansion can no longer reference reserved secrets
Chat WebSocket now verifies caller owns the agent (not just exists)
Rich HTML sanitization moved to structured parsing (no longer regex-based escaping that can be evaded)

Performance

Sidecar schema probes run concurrently (cold-start boot time reduced 10–30x on deployments with many adapters)
Per-adapter send backpressure prevents queuing under burst load
Memory index rebuilt only on content changes, not on every access-count bump or decay sweep
Reduced lock contention in concurrent retry scenarios

Migration Notes

Operator-visible behavior change: max_network_bytes_per_hour now enforces the 100 MB default if unset. Agents moving more traffic need an explicit larger value or 0 for unlimited.
Workflow approval gates now actually pause runs and wait for humans (previously ran unattended). Anything behind an approval gate will now require explicit approval to proceed.
Agent session isolation: agents running session_mode = "new" no longer recall raw dialogue from earlier invocations; set session_scoped_recall = false in agent.toml to restore prior behavior.
Configuration includes with unknown fields are now rejected when strict_config = true (was silently ignoring them).

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.8.30 Released

涼風羽月 — Fri, 16 Oct 2026 05:38:04 +0000

LibreFang 2026.8.30 Released

554 PRs from 2 contributors have landed since v2026.8.19, bringing major improvements to agent memory, workflow composition, identity management, and operational reliability. Here's what you need to know.

What's New

Agents Can Now Think for Themselves

For the first time, agents can search, add, forget, and consolidate their own semantic memory without going through the REST API. Four new tools—memory_semantic_search, memory_semantic_add, memory_semantic_forget, and memory_semantic_stats—give agents direct access to what they've learned. This is the unlock for self-correcting memory: if a stale "service X is down" entry keeps being recalled, the agent can now find it, fix it, or merge near-duplicates reinforcing bad beliefs. Recall is also now split between extracted facts and raw dialogue, so memory works as a two-class system that allocates budget fairly instead of letting one class starve the other.

Session-scoped memory isolation is now configurable per agent, and per-capability access controls let you decide which agents can read vs. write their own stores—essential for shared or public agents where one visitor's context must stay separate from the next.

Workflows Are Now Composable, Portable, and Inspectable

Agents can define workflows mid-conversation with the new workflow_create tool. Workflows now support named agent bindings—pick a specific running instance, an agent name resolved at step time, or an agent type spawned from a template—so the same workflow runs on any LibreFang instance without pre-registration. The Canvas editor makes this visible and editable, with per-step session mode and required-skills validation before dispatch.

Workflow runs now record their owner (a user or group), and every step's cost rolls up to the agent that asked for it, so spend attribution stays honest even when workflows fan out across shared agent types.

Agents Can Spawn Ephemeral Workers

Most delegation is task-shaped, not colleague-shaped: hand work to a fresh context for one turn, get an answer back, and clean up. agent_spawn with ephemeral: true now does this without creating agent records, sessions, or workspaces. Workers inherit the spawning agent's tool set and spend cap, and nesting is bounded by the same recursion limit multi-step workflows use. POST /api/agents/spawn-ephemeral and the Quick Run button on the Agent Types page let you test this without writing an agent.

Worker runs leave a record with their task, answer, model, tokens, cost, and outcome—readable at GET /api/agents/{id}/ephemeral-runs so you can inspect what agents delegated and what it cost them.

Identity and Access Control Are Now Group-Aware

Groups are now a first-class entity. Define a team in config.toml with [[groups]], assign roles to every member, and use that group as the owner of workflows, cron jobs, or access policies. Identity-provider groups can now map onto local groups via [external_auth.group_map], so removing someone from your Okta team or Keycloak group instantly revokes their LibreFang access. OIDC role claims can authorize API access through [external_auth.role_map], completing the SSO picture.

Slack Channels Got Smarter

Agents can now see who's in a channel with the channel_members tool, answer one person privately with channel_dm, and receive images and files that visitors upload. Display names are resolved through the Slack API with configurable caching, so your agent names people by handle instead of by ID. All of this is behind configurable flags—bulk enumeration, display-name resolution, and file forwarding—so you control the tradeoff between capability and data persistence.

Backups Are Selective and Restorable

Restore a backup onto a running machine instead of only onto a blank slate, keep your current config while adopting everything else, and choose which components to restore—agents, cron jobs, memory, data directory. The TUI's new Backups tab lets you do this over SSH without hand-writing HTTP requests. Archive manifests carry component metadata, so the client always matches what it sends against what the archive actually contains.

Audit hash chains that have broken can now be repaired without destroying the evidence: librefang security audit-reanchor archives the broken rows to a tamper-evident JSON file before re-anchoring the chain, so compliance stays intact.

Kubernetes and Mounted Configuration Just Work

Managed configuration mode now reaches every surface. The daemon resolves config.toml exactly once at boot and every interface reads that one path, so a Kubernetes ConfigMap or Docker bind mount is no longer a footgun. Pod rollouts are confirmed by comparing checksums—the same value the API reports back—instead of inferring from restart counts. A Kubernetes overlay at deploy/kubernetes/overlays/managed-config/ shows the exact shape this was built for.

Provisioned agent directories let you declare agents in a tree the deployment owns, and the daemon prevents rewrites while keeping agent operations (suspend, resume, messages) fully available. Removal of a declaration releases the agent back to runtime ownership, so moving between managed and manual is reversible.

Under the Hood

Performance and Reliability

Memory extraction no longer runs on turns that don't need it, and the extraction model is now visible and configurable instead of silently inherited.
Confidence decay now charges exactly once per interval instead of accumulating quadratically, so memory doesn't mysteriously evaporate after a week of disuse.
Recalled memory bullets are cut at sentence boundaries instead of mid-word, preserving readability and preventing the model from inventing missing text.
Context windows for self-hosted gateways are now discovered and editable, so conservative fallback assumptions don't evict your actual content.
The agent loop's memory section now splits budget between facts and dialogue fairly, and every clipped bullet is marked so you see what was omitted.
Model overrides are editable from the dashboard and survive registry syncs, so one operator correction applies to every agent on that model.

Developer Experience

The CLI now accepts --session-id on librefang message, so scripted callers can address one conversation among many that a single agent serves.
Workflow templates now appear in librefang workflow run output, and the TUI's workflow creator names all three agent binding modes it accepts.
Agent-created skills now record the agent that made them instead of a placeholder, so the provenance is visible in the registry.
The dashboard, REST API, and TUI all surface pending skills and MCP servers—declarations nothing has installed yet—so gaps in a workflow are visible before it runs.
Usage and budget endpoints now accept date ranges and export to CSV, so monthly reporting doesn't require a client-side workaround.
Error messages now name the budget cap that was hit and what it's set to, instead of generic "raise a limit" guidance.

Security and Hardening

Audio extracted from video is now bounded by both its container size and its own decoded size, preventing a large container from holding much more audio than the cap allows.
Backup restore entry counts, decompression ratios, and extracted sizes are all bounded, and symlink escapes are rejected.
Automatic memory respects session boundaries and per-capability access controls, so one visitor's context never leaks into the next.
Agent manifests destined for a shared registry are automatically sanitized of instance-specific details—absolute paths, credential env vars, private URLs, free-text hostnames.
The TUI templates screen no longer invents a capability declaration when spawning agents; operator-created types run with their actual declared permissions.
Dashboard caller authentication is now moved off async workers and scrubbed from HTTP 500 responses while retained in server logs for diagnosis.

Fixes

Over 200 fixes landed this release. Key themes:

Concurrency and state: Fixed lock poisoning in audit chains, credential vaults, MCP reloads, and a dozen other stateful paths. Serialized session refreshes, token refreshes, and config writes so concurrent mutations don't race.

Type safety: Added missing schema updates, fixed API contracts that had drifted from reality, and corrected generated client code.

Gateway compatibility: Models served through OpenAI-compatible proxies (vLLM, LM Studio, llama.cpp, LiteLLM) now discover context windows, handle reasoning-effort parameter mismatches, and accept cached discovery across restarts.

Windows platform: Fixed path separators in template checks, database reservations, and archive restoration so CI and deployments work identically on every OS.

Channel adapters: Slack, Telegram, Discord, WhatsApp, WeChat, Bluesky, Mastodon, Reddit, and a dozen others all got hardening against transient failures, malformed states, and protocol edge cases.

Dashboard: Nearly 100 UI fixes—cache invalidation, focus management, state initialization, async task cleanup, and accessibility improvements.

Memory correctness: Stopped memories from forking under concurrent writes, fixed embedding dimensionality checks, and corrected the class-blind recall that was evicting facts in favor of raw dialogue.

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.10.16 Released

涼風羽月 — Fri, 16 Oct 2026 05:37:46 +0000

LibreFang 2026.10.16 Released

LibreFang 2026.10.16 brings a unified agent editor, avatar support for agents and users, knowledge-base sharing, and significant stability improvements across the platform.

144 PRs from 6 contributors since v2026.9.19.

Agent Configuration & Identity

We've consolidated how you configure and identify agents. Everything — model parameters, personality, avatar, tools, skills, channels, memory access, cost limits, and planning settings — now lives in one unified config tab on the agent view. No more hunting across drawer, routing panel, and schedule tabs.

Agent and user avatars are here: upload images or use emoji to personalize your agents and teammates across the dashboard, session lists, and every chat message. The agent list now shows avatars too, making it easy to tell your agents apart at a glance.

Agent manifest version history records every configuration change with its source (dashboard edit, restore, raw TOML, …), so you can review what changed and when, restore any prior version with a diff preview, and see the history from the TUI or the dashboard without switching contexts.

Knowledge Management & Chat

Knowledge bases let you upload documents once and grant access to specific agents. No more per-session file uploads — write @knowledge-base/document.md in your prompt and any agent with access can read it. The UI surfaces knowledge-base sharing alongside every other agent capability.

Chat improvements: Mermaid diagrams now render inline instead of showing raw syntax. Conversations with the same agent appear as tabs instead of hiding behind a dropdown. You can now select specific messages to export or print, so you get a clean document of just what matters without the whole sidebar.

Model Control & Discovery

Model parameters (top_k, min_p, repeat_penalty) now have dedicated UI controls in the dashboard and TUI instead of living in untyped extra_params. The searchable model picker replaces free-text model entry — no more memorizing model IDs.

Live model discovery preferences are preserved across restarts, and providers can now map credentials to request headers for authenticated remote MCP servers. Discovery still fails gracefully when endpoints are slow, and gateways report pricing and capacity through their optional /model/info extension.

Terminal & Automation

The TUI got major upgrades: shared-folders editor lets you declare workspaces without opening the manifest in another window. Goals screen now surfaces loop engineering, per-goal cadence, and verification settings. Workflow runs display live step progress (▰▰▱▱▱ 2/5). Agent configuration history renders in the terminal, so terminal-only operators can audit changes without opening a browser.

The TUI also reports daemon errors instead of showing empty lists or spinners that never stop — fetch errors now surface with the daemon's reason and status.

Tasks & Approvals

Task priority and per-task timeouts are now exposed in the UI (the New Task dialog gained both fields). Tasks assigned to non-existent agents are now rejected upfront instead of queueing forever.

Approval notifications now route correctly through sidecars, and authenticated dashboard users now respect your configured memory access policy instead of failing open.

Stability & Security

Sampling parameters (top_p, frequency_penalty, presence_penalty) now reach the wire correctly for every provider that uses them — Anthropic, Gemini, Ollama, OpenAI-format drivers, and custom endpoints all get the right fields without fallbacks.

Ephemeral worker runs now report when they hit the iteration cap, and when they do, you get what they accumulated before stopping instead of silence. History compaction runs on every turn type now, not just streaming.

SSH transport security: upgraded russh, closing four SSH advisories. Filename guard validates all incoming names against Windows-hostile characters and path exploits, refusing rather than sanitizing. Cron scripts must resolve under the scripts directory now, closing a path traversal. Integration installs no longer write untrusted keys into the vault.

The ||spoiler|| and ==highlight== syntax works again in Telegram messages (these had silently vanished on the blocks-based path). Voice messages to users who forbid them fall back to audio documents. Windows concurrent writes to identity files no longer fail spuriously.

Behind the Scenes

Mermaid dependency vulnerabilities (CVE-2026-4800, CVE-2026-2950) resolved by overriding lodash-es on the four packages that carry it.
LiteLLM gateways now fold /model/info into their discovery results when the listing leaves capacity unknown.
Model routing clearly indicates when Stable mode makes it inert — both in the API response and in the UI.
Personality edits now survive a provider swap (vibe, archetype, greeting_style used to disappear).
Agent workspace collisions during spawn are detected and refused — you can no longer accidentally give an agent another agent's directory.
A renamed or cloned agent no longer introduces itself by its old name.
Kubernetes deployments now have a community Helm chart mirroring the Kustomize manifests, with proper restricted Pod Security and single-replica StatefulSet enforcement.
Config hot-reload is smarter: a field you omit from the reload document now keeps its live value instead of resetting to the compiled default. Explicitly state key = [] to clear a list.
Binary versioning now tracks the actual commit it was built from, even in worktrees and after branch rewrites.

Developer Experience

CLI skill publishing now reaches GitHub Enterprise Server via skills.promotion.api_base_url.
The Rust and Telegram sidecars now commit Cargo.lock and MSRV is measured rather than declared (SDK 1.71, Telegram 1.88).
Generated SDKs now correctly type response bodies for all endpoints (was untyped blob for registry-diff and restore).
librefang skill publish --dry-run prints the configured repository.
macOS binaries are now Developer ID signed, preserving Full Disk Access and Automation grants across updates.

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.8.19 Released

涼風羽月 — Tue, 18 Aug 2026 23:03:56 +0000

LibreFang 2026.8.19 Released

474 PRs from 5 contributors since v2026.7.31.

This release is a massive stability and security push. We've closed dozens of data-loss vectors, locked down SSRF, hardened atomic file writes throughout the daemon, and fixed a ton of edge cases that were silently failing or corrupting state. On the feature side: managed configuration mode for self-hosted deployments, long-form audio transcription that doesn't drop your 20-minute recordings, and Polish language support. Performance-wise we've moved a bunch of blocking I/O off async workers and bolted on some overdue mutex poison recovery so a single panic doesn't disable half the daemon.

What's New

Security & Reliability

This release closes a lot of holes. We've sealed path-traversal in skill/channel IDs, fixed SSRF vectors in link context and webhook callbacks, escaped untrusted data in OAuth responses, and re-locked the auth scoping so non-owners can't probe other agents' sessions. On the data side: we now fsync parent directories after atomic file writes, serialize concurrent writes to shared files (e.g. secrets.env), and validate every SQLite row decode so corruption surfaces instead of silently dropping data. Credentials get redacted consistently before export, and the desktop app no longer bypasses shell security when uninstalling.

Most impactful: we've recovered poison recovery for ~40 locks throughout the daemon. A single panic in a critical section used to permanently disable feature areas (metering, routing, audit, skills, memory) for the entire process lifetime. Now they recover and log what went wrong, so one bad turn doesn't ghost you.

Managed Configuration

New LIBREFANG_CONFIG_MODE=managed lets you own config.toml instead of the daemon. Set it in your environment, and every API route that would mutate config answers 423 Locked. Works great with Kubernetes ConfigMaps or read-only mounts. The API now also reports the config's SHA-256, write status, and last-modified time so your dashboard can render it read-only server-side. Plus custom providers can opt into live model discovery if you're running self-hosted Ollama or vLLM and want the model list to refresh automatically.

Long-Form Audio & Video

media_transcribe can now process recordings in windowed chunks and write to a file. Your 30-minute recording won't drop anymore — it was hitting the spill threshold and the tool-result size cap together. Windows also get deduplicated on their Ogg granule position so you don't lose audio at boundaries. Transcription of .mp4 and .mov now works (they need seeking, so we stage to disk first).

Async Agent Messaging & Task Waking

agent_send is now non-blocking by default — returns a task ID you can poll. Previous default made you predict whether a delegation would be slow and opt in to async: true, which was a coin flip. false only when you need the answer in-turn.

Tasks assigned to agents now wake them automatically, no manual trigger required. If nobody's listening to task_posted events, the task still reaches its owner via a synthesized wake. Dead triggers can no longer shadow real work.

Localization Fixes

Polish (pl) is now a first-class supported language. We also restored missing diacritics in Spanish and French (válido, déjà, ¿agente no encontrado?, etc.) and added missing Japanese error keys.

Performance

A lot of blocking filesystem and database work has moved off Tokio's async workers. Config reads/writes, SQLite queries, WASM module loads, and PDF extraction now run on the blocking pool so they don't park your request handler. Desktop app SPA installs, agent-template discovery, and Chromium binary probing also got offloaded. We also offloaded the image vulnerability scanner (Trivy) to run on every build — no user-facing gate yet (waiting on remediation), but full JSON/SARIF artifacts are retained for CI review.

Bug Fixes

Link extraction wasn't recursing into list items, and the page-selector was picking the first <article> instead of the container holding multiple articles. Fixed.
Windows tests got disabled by a desktop app linking failure. Re-enabled with a workaround, keeping the compile+link coverage.
Slack messages with lots of whitespace rendered as walls of blanks; fixed. Also fixed sections overshooting the 3000-character limit and getting dropped entirely.
Trigger cooldown was per-trigger instead of per-subject, so a second distinct thing happening fast got discarded. Now scoped correctly.
Image generation against OpenAI's gpt-image-* models failed on response_format rejection. Removed it for that family.
browser_read_page now deduplicates links and renders them as ⟨n⟩ markers + a separate table, cutting link payload 70–84% on dense pages and keeping markers clickable.

Grab the full list if you want the gory details.

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.7.31 Released

涼風羽月 — Fri, 31 Jul 2026 04:01:17 +0000

LibreFang 2026.7.31 Released

58 PRs from 4 contributors since v2026.7.27.

LibreFang 2026.7.31 ships production-ready multi-account support, Kubernetes deployment, EveryAPI auto-detection, and a security hardening pass that closes 20+ authorization and credential-handling gaps.

Core improvements

API security gets teeth: Master API keys now support hashing (SHA-256 or Argon2id), environment variable indirection, and vault storage — so you can rotate the secret without touching config.toml. The hash-only mode closes a WebSocket/terminal auth bypass that would have re-opened a bare-key exposure path. Per-user provider credentials (added in the last release) now correctly bill and budget the user whose key is being spent, and the authorization system gained 20 fixes to ownership checks, RBAC gates, and cross-account attack surfaces.

EveryAPI integration is automatic: The daemon now auto-detects the EveryAPI CLI if you're logged in, sources model metadata from the gateway itself (not a stale OpenRouter snapshot), and refreshes the catalog on a configurable TTL. A new dashboard connect action means you never need a terminal to add the gateway.

Browser automation just got richer: Agents can now attach to browser-level Chrome DevTools Protocol endpoints via Target.createTarget, enabling session-wide automation instead of page-specific. Page extraction is now configurable (max characters, reported in the truncation marker), and video containers (MP4, MOV, MKV, AVI) are accepted for transcription with automatic audio extraction.

Hands stay customized across daemon restarts: Edits to built-in hands now persist to an operator override directory instead of getting erased by the next registry sync. The hand's live configuration also reaches agents immediately on save from the dashboard, not just on restart.

Multi-account messaging works correctly: Channel status indicators now reflect supervisor liveness, per-channel settings reach the right bot account, and deferred approvals route through the account-qualified delivery path.

Kubernetes is supported out of the box: A single-replica baseline with readiness contract, restricted Pod Security, and rootless support is shipped under deploy/kubernetes/. The daemon gains LIBREFANG_API_KEY env override and --system macOS LaunchDaemon support for always-on installs.

Added features

EveryAPI gateway auto-detection and dashboard connect: Read credentials from ~/.config/everyapi/credentials.json on demand, fetch live model list from the gateway's /api/pricing, refresh on a configurable TTL, auto-detect CLI login, and surface a connect action on the dashboard (no terminal required).
Per-user LLM provider credentials: Users can now store their own upstream provider API keys (encrypted in the vault), bill their own spend against their own budget, and the cost is attributed correctly per-user across all spend paths (REST, streaming, ephemeral).
Hand customization on disk: Edits to registry-shipped hands now persist to ~/.librefang/hands/ instead of getting erased on sync. Hand settings changes reach live agents immediately; manifest edits are applied on the next activation.
Browser-level Chrome DevTools Protocol: Agents can attach to browser-level CDP endpoints by creating a target first, enabling session-wide automation. Page extraction is now operator-configurable ([browser] max_content_chars) and reports the pre-truncation length so the model knows what it's missing.
Video container support for transcription: media_transcribe and speech_to_text now accept MP4, MOV, MKV, AVI containers with automatic audio extraction and Ogg/Opus re-encode.
STT language and prompt parameters: language and prompt parameters now reach Whisper-compatible providers (Groq, OpenAI, MiniMax, Fireworks, Together, SiliconFlow) instead of being silently dropped.
MCP resources primitive: The client now implements resources/list, resources/read, and resources/templates/list, surfacing server resources as synthetic tools and inlining resource content into prompts.
Kubernetes-ready deployment: Single-replica manifests under deploy/kubernetes/ with restricted Pod Security, readiness probes on /api/ready (separate from liveness), and rootless support.
macOS system LaunchDaemon: service install --system now registers a boot-time LaunchDaemon (instead of login-time LaunchAgent), so the daemon starts even when the user hasn't logged in yet.
Per-channel sidecar settings: dm_policy, group_policy, threading, and output_format overrides per [[sidecar_channels]], restoring fine-grained control lost in the sidecar migration.
Config schema in GET /api/config: The response now includes every writable field plus a x-non-writable list so the dashboard can render read-only fields with hints to edit config.toml instead.
Explicit hand scheduling: Hands now require an explicit [autonomous] block or schedule to tick — no more silent background loops inferred from max_iterations.
Registry sync toggle: Set [registry] auto_sync = false to freeze the checkout and prevent edits from being erased on daemon restart.
Skill changelog fragments: Write one .md file per changelog entry under changelog.d/{added,fixed,changed}/ to avoid merge conflicts — fragments are auto-collected into ## [Unreleased] on release.
Process completion notifications: process_start with notify_on_completion: true triggers a TaskCompletionEvent when the process exits, reusing the async-task delivery path (no polling needed).
All 25 channel type adapters in scheduler: The scheduler delivery-target dropdown now lists WeChat, WeCom, Feishu, DingTalk, Teams, Google Chat, Matrix, Mattermost, WhatsApp, QQ, LINE, and the rest by name.
MCP OAuth via dashboard: MCP servers can now be configured with OAuth credentials through the dashboard, and the MCP bridge carries sender account context for proper access control.
NixOS first-class support: Flake gains nixosModules.default with services.librefang configuration, overlays.default, and evaluation-time assertions (e.g., no environmentFile inside /nix/store).
Distributed debug symbols: Release binaries ship with stripped executables and separate .dSYM / .dwp debug symbols, so crash reports can be symbolized without including symbols in the download.

Fixed bugs & security issues

Authorization & access control (20+ fixes):

Owner-gate GET /api/config/export (previously exposed plaintext master key to any Admin).
Authorize channel slash-commands (/approve, /switch-agent, etc.) through RBAC before dispatch.
Role-gate terminal and agent WebSocket upgrades (Admin+ for PTY, User+ for turns).
Enforce ownership on process_poll / process_write / process_kill.
Gate MCP-server config mutations to Owner (RCE risk via plugin lifecycle scripts).
Scrub daemon environment before process_start spawns (was exposing LIBREFANG_VAULT_KEY and provider keys).
Stop persistent plugins from inheriting full daemon environment.
Bind POST /api/auth/refresh to the session it can prove it owns (was leaking other users' upstream tokens to Admin callers).
Apply dangerous-command blocklist to process_start (was bypassing shell_exec allowlist checks).
Enforce webhook_triggers.max_payload_bytes at the wire level.

Multi-user data isolation (6+ fixes):

Scope knowledge graph (entities/relations) per user, mirroring the memory scoping from the prior release.
Stop compacted-session summaries from leaking across users on multi-user agents.
Correctly attribute per-user provider-key spend to the user and enforce their budget.
Scoped GET /api/memory/agents/{id}/relations to the path's agent.
Prevent cross-account channel_send tool calls.
Key channel message deduplication on per-user sender ID.

Credential & secret handling (8+ fixes):

Accept api_key_hash ($sha256$...) in place of plaintext master key.
Route master API key through env/vault indirection without re-reading config.toml on reload.
Hash-only credentials now work for WebSocket, terminal, and HTTP (previously were a bypass).
Stop EveryAPI gateway base URL from being repointed to whatever account the CLI is logged into.
Canonicalize provider name before per-user key lookup (so aliases bill the user's key, not fallback).
Stop GET /api/mcp/servers from serializing MCP environment values (was exposing inline credentials).
Reject cross-account channel_send on the /mcp bridge path.
Extended thinking now emitted through OpenAI-compatible driver (was parsed on receive only).

Streaming & error handling:

Surface mid-stream LLM errors (overload, rate-limit) instead of silently truncating to an empty "success" turn.
Apply content-emitted guard at both streaming layers so a provider error doesn't concatenate partial responses.
Classify insufficient_quota as a billing error (not a malformed request) and apply long retry backoff.
Terminal frames are now correlated with their chat turns (late frames no longer overwrite newer answers).

Configuration & state:

Config-reload now correctly gates [registry] auto_sync to live-read (was falsely reporting restart-required).
api_key_hash regenerates upgrade hints and warns if no transmittable key exists.
Distinguish json.null from unset fields in the http_compat server round-trip (was corrupting redacted header values).
Reject unknown keys in [mcp_servers.transport] and both HttpCompat variants (was silently discarding typos).
Compare canonicalized JSON values in config-reload diffs (was spuriously reporting changes on every reload for maps).
Parse frequency = "reactive" without error (was a validation error while having no effect anyway).

Session & message routing:

Serialize session_id_override = canonical_entry on the same lock as no-override persistent dispatch (was losing history on concurrent writes).
Resolve model context window provider-aware (OpenRouter agents now show real window, not 8192-token fallback).
Clear persistent compacted_summary_session_id on model switch so budget math uses the right window.
Cron fires with session_mode = "new" now isolate per fire (was sharing one for_sender_scope session).
GoalRunner::start now atomic (was leaving orphaned, unstoppable loops on concurrent starts).
Stop non-passive agents from being flagged unresponsive (the heartbeat monitor was using the wrong schedule check).

Tools & skill execution:

Apply tool_allowlist when rendering MCP tools (was ignoring glob patterns like mcp_notion__*).
Apply tool_allowlist on MCP tool execution, not just display.
Stop skill description and tool names from bypassing the prompt-injection scanner.
Stop the taint heuristic from false-positive-blocking numeric IDs (note-12345-67890.pdf) and long runs of digits.
Tool allowlist entries that cannot grant are now named in the response (not silent no-ops).
read_artifact results are exempt from re-spill gates (was looping on artifact fetch for results larger than spill_threshold_bytes).

Data correctness:

Session detail endpoint now reports cost_usd, total_tokens, duration_ms, and label (was missing all four).
Goal creation now normalizes blank parent_id / agent_id to "absent" and validates non-blank UUIDs up front.
Stop agent deletion from silently orphaning shared knowledge entities (was breaking entity ownership model).
Stop hand activation from fabricating mode = "full" exec policy (was silently bypassing approval queues).
Stop agent kill from deleting audit trail rows (was breaking the WORM Merkle chain).
Stop a partial [channel_overrides] table from gating group messages (was materializing defaults for unset fields).

Network & storage:

Stop symlinks in skill installers from copying external tree contents.
Bound ClawHub/Skillhub skill-zip extraction (was vulnerable to decompression bombs).
Stream attachment-URL fetches with running size cap instead of buffering (was OOMing on unbounded bodies).
Per-IP WebSocket connection tracker guard-drop TOCTOU fixed (was deleting live connection entries).
Tolerate empty-string error objects in OpenAI-compatible streaming (was aborting stream on benign "error": "").

CLI & integration:

Telegram menu button callbacks now work (was silently dropping on both Rust and Python sidecars).
Matrix sidecar inbound no longer silently dropped under default GroupPolicy::MentionOnly.
Correct the channel docs' claim about env var names and formats.
librefang skill install ./dir now accepts SKILL.md-only directories and Git URLs.
librefang skill search and install now point at the local synced registry (was pointing at nonexistent GitHub org).
librefang doctor EveryAPI check now warns on stale credentials (was reporting green after logout).
Dashboard Clone button now opens a dialog (was posting empty body and always failing).

Changed

Bump agent-client-protocol to 2.0.0 and update call sites.
Normalize on-disk upload naming to <uuid>.<ext> across all producers.
Thread user identity into audit trail for human-initiated API actions.
Migrate Linux system tray from tray-icon to pure D-Bus ksni implementation.
Docker entrypoint now detects root vs. rootless mode and adapts (works in Kubernetes without a second image tag).
Consolidate invisible/format code-point lists into a single source of truth.
Stop releasing stable CLI to homebrew-tap (now ships from homebrew-core; tap carries beta / rc / versioned formulas only).
Refresh OpenRouter model snapshot.
Move all CI/release workflows from Node 20 to Node 24.
Split release debug symbols into a separate asset (.dSYM / .dwp).

Security

This release closes 30+ authorization, credential-handling, and data-isolation gaps discovered in the prior release's multi-user and per-user credential work. Key hardening:

Owner-gated MCP-server mutations, plugin installation, and /api/config/export.
RBAC now gates terminal and WebSocket upgrades by role (Admin+ for PTY, User+ for turns).
Per-user budget enforcement on provider-key spend; spend is correctly attributed and audited.
Hash-only API key now works for WebSocket/terminal (closes a previous bypass).
Credential environment values no longer leak from GET /api/mcp/servers.
Canonical provider names used in per-user key vault lookups (aliases now bill user keys correctly).
Dangerous-command blocklist now applied to process_start.
Daemon environment scrubbed before spawning persistent processes.
Cross-account channel_send blocked on both HTTP and /mcp bridge paths.
Knowledge graph scoped per user on multi-user agents.
Compacted-session summaries no longer leak across users.
Unknown keys in MCP config rejected at boot (was silently dropping typos).

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.7.27 Released

涼風羽月 — Tue, 28 Jul 2026 06:33:53 +0000

LibreFang 2026.7.27 Released

We're shipping v2026.7.27 with 33 improvements spanning provider integrations, operational polish, and critical fidelity fixes.
Here's what matters for your Agent OS deployments.

New: Provider Integrations & Deployment

EveryAPI is now a first-class model provider.
Connect it via librefang models connect everyapi in the CLI or the new Providers page UI.
The CLI includes a built-in wiring doctor to catch misconfiguration—no more debugging silent auth failures.

macOS users: LibreFang now runs at boot.
The new service install --system command installs a LaunchDaemon so your daemon starts automatically at boot, before anyone logs in and without a user session.
Forget about manual restarts after reboot.

NixOS and additional Linux distros are now officially supported.
We've added first-class deployment support for NixOS with deepin and Debian distro awareness baked in, making it trivial to package and deploy across diverse Linux environments.

Fixes: Correctness & Data Integrity

Three correctness fixes ship with this release:

Audit logs are now WORM-protected. Audit entries persist even when an agent is purged, preventing accidental evidence loss in compliance-sensitive deployments.
Tool results are no longer lossy. We fixed a spill dead band that was truncating tool outputs. Results now round-trip without silent truncation.
Context windows from agent.toml are now honored everywhere. Previously some turn-execution paths ignored the configured context_window, leading to inconsistent behavior. This is fixed across all paths.

Under the Hood

Security dependency bumps clear high-severity advisories in libvips (via sharp >=0.35.0) and Next.js App Router.
We've also hardened credential-pattern detection to reduce false positives, improved test reliability with connection pool timeouts, and fixed callback message ID resolution for MCP OAuth flows.

The TUI now runs on a process-lifetime runtime, preventing startup panics and silent session-summary loss during shutdown.

33 PRs from 2 contributors since v2026.7.21.

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.7.21 Released

涼風羽月 — Mon, 27 Jul 2026 11:33:15 +0000

LibreFang 2026.7.21 Released

61 PRs from 4 contributors since v2026.7.11.

What's New

This release brings critical security improvements, multi-user isolation fixes, and powerful credential management — all while expanding MCP integration and shipping quality-of-life wins across the dashboard.

🔐 Security & Multi-User Data Isolation

If you're running LibreFang with multiple users or on shared infrastructure, pay close attention here.

Per-user LLM provider credentials — Users can now bring their own API keys with transparent per-owner spend tracking. Operators set org-wide provider allowlists and enforce per-user budgets directly at the API level.
Knowledge graph per-user scoping — Fixed a cross-user data leak: the knowledge graph is now partitioned by user on multi-user agents, ensuring shared agents don't expose one user's memory to another.
Cross-account channel guards — Enforced through the MCP bridge to prevent unauthorized agent-to-channel sends.
Session-owned compacted summaries — Prevents prompt leaks across user sessions.
Four-pass security audit — Caught and fixed 15+ bugs ranging from authorization gaps to token-quota races.

🚀 Better Developer Experience

MCP resources primitive — Agents can now access MCP-exposed resources, completing the MCP integration beyond tools alone.
Live Slack progress for long tasks — Long-running agent tasks now post real-time phase updates in Slack using Block Kit message edits, so users see progress instead of waiting for a single final reply.
HAND.toml online editing — Edit hand manifests directly from the Hands panel in the dashboard — no file editing required.
Expanded delivery-target channel presets — All sidecar adapters now support shortcut presets for common targets.

🛠️ Infrastructure & Provider Robustness

Multi-provider improvements — Added response_format support for Gemini and Vertex AI; prefer live model catalog with build-time fallback.
Token quota safety — Release reservations on drop to prevent self-imposed quota DoS.
Provider alias safety — Canonicalize providers before per-user key lookup to block chargeback leaks.
Better error visibility — Surface mid-stream provider errors instead of garbled or empty turns.

Added

Env opt-out (TELEGRAM_STREAMING) for the streaming path (#6482) (@houko)
Per-user LLM provider credentials with per-owner usage attribution (initial) (#6483) (@houko)
Org-wide LLM provider allowlist (fail-closed at driver resolution) (#6484) (@houko)
Slack multi-step progress display via AgentPhase-driven Block Kit updates (#6487) (@houko)
Per-user attribution survey + API-level user filtering of audit queries (#6488) (@houko)
Process_start completion notification via the async task tracker (#6489) (@houko)
Edit HAND.toml online from the Hands panel (#6490) (@houko)
Scope the knowledge graph per user (peer_id) on multi-user agents (#6494) (#6502) (@houko)
Expand delivery-target channel presets to all sidecar adapters (#6506) (@houko)
Owner-gated CRUD for per-user provider credentials (#6460) (#6509) (@houko)
Implement the MCP resources primitive (#6501) (#6532) (@houko)

Fixed

Prefer the live model catalog with a build fallback (#6384) (@pavver)
Security and correctness hardening from repo-wide audit (#6438) (@houko)
Second-pass security and correctness hardening from repo-wide audit (#6439) (@houko)
Third-pass security and correctness hardening from repo-wide audit (#6441) (@houko)
Fourth-pass security and correctness hardening from repo-wide audit (#6446) (@houko)
Resolve four reported bugs (#6423, #6442, #6443, #6444) (#6449) (@houko)
Enforce cross-account channel_send guard through the /mcp bridge (#6443) (#6455) (@houko)
Trust operator env allowlist in sandbox_command (#6465) (@houko)
Treat retired pnpm audit endpoint as skip, not a dependency issue (#6466) (@houko)
Field-scope dm_policy/group_policy so a partial override stops silently gating groups, and expose them on [sidecar_channels] (#6468) (@houko)
Distinguish context and budget limits (#6479) (@houko)
Allow dashboard login script under CSP (#6480) (@houko)
Treat auto_dream fork tool calls as system-internal so RBAC does not gate them (#6485) (@houko)
Login page unreadable in light theme (CSS cascade source-order bug) (#6486) (@houko)
Pin login_page.html to LF so the CSP-hash test passes on Windows (#6481) (#6496) (@houko)
Gate compacted summary by owning session to stop cross-user prompt leak (#6493) (#6497) (@houko)
Honour glob patterns in per-agent tool_allowlist/tool_blocklist (#6495) (#6498) (@houko)
Approvals approve 415 false-success + status column in approvals list (#6492) (#6500) (@houko)
Stop over-blocking MCP arguments that carry a long numeric id (#6499) (#6503) (@houko)
Route post-approval reply through account-qualified outbound (#6492) (#6511) (@houko)
Surface mid-stream provider errors instead of empty/garbled turns (#6512) (@houko)
Release the token reservation on drop to stop a quota self-DoS (#6513) (@houko)
Attribute owner-key spend and enforce per-user budget on authenticated API turns (#6514) (@houko)
Honor response_format in the Gemini and Vertex AI drivers (#6515) (@houko)
Treat [browser] config-reload as restart-required, not a false hot-reload (#6516) (@houko)
Canonicalize provider before the per-user key lookup to stop an alias chargeback leak (#6517) (@houko)
Serialize a canonical-session override on the per-agent lock to stop a lost-update race (#6518) (@houko)
Scope MCP knowledge_add_* writes to the calling agent, not agent_id="" (#6519) (@houko)
Recognize CHANGELOG attribution on a bullet's continuation lines (#6520) (@houko)
Don't orphan another agent's relations when deleting a shared entity's first-writer (#6522) (@houko)
Honor auto_approve and return 409 on double-resolve (#6492) (#6528) (@houko)
Surface on-disk upload path to agents for every file type (#6531) (@neo-wanderer)

Changed

Normalize on-disk upload naming to . (#6530) (#6536) (@houko)

Documentation, maintenance, and other internal changes

Documentation

Explain trusted_senders vs [[users]] RBAC composition (#6492) (#6507) (@houko)
Document per-user key precedence over operator rotation (#6460) (#6510) (@houko)

Maintenance

Bump the cargo-minor-patch group with 10 updates (#6452) (@app/dependabot)
Bump tokio-tungstenite from 0.29.0 to 0.30.0 (#6453) (@app/dependabot)
Update yanked spin 0.9.8 to 0.9.9 (#6454) (@houko)
Bump the actions-minor-patch group with 3 updates (#6456) (@app/dependabot)
Bump actions/setup-node from 6.4.0 to 7.0.0 (#6457) (@app/dependabot)
Lock in env trust split across defer→approve→resume (follow-up to #6465) (#6467) (@houko)
Bump the web-minor-patch group in /web with 5 updates (#6472) (@app/dependabot)
Bump the dashboard-minor-patch group in /crates/librefang-api/dashboard with 6 updates (#6473) (@app/dependabot)
Bump @eslint/js from 9.39.4 to 9.39.5 in /crates/librefang-api/dashboard (#6474) (@app/dependabot)
Bump serde_with from 3.18.0 to 3.21.0 (#6475) (@app/dependabot)
Bump the docs-minor-patch group in /docs with 4 updates (#6491) (@app/dependabot)
Update model snapshot (#6523) (@houko)
Bump wasmtime from 46.0.1 to 47.0.1 (#6527) (@app/dependabot)
Bump the cargo-minor-patch group across 1 directory with 17 updates (#6533) (@app/dependabot)
Migrate librefang-acp to agent-client-protocol 1.3.0 (supersedes #6526) (#6534) (@houko)

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.7.10 Released

涼風羽月 — Fri, 10 Jul 2026 10:39:58 +0000

LibreFang 2026.7.10 Released

This release unlocks extended thinking for reasoning models, improves Slack formatting, eliminates redundant artifact output, and expands international reach. Alongside that, we've locked down security advisories and made your test suites faster and more reliable.

39 PRs from 4 contributors since v2026.6.29.

What's New

🧠 Extended Thinking & Reasoning Support

The OpenAI-compatible driver now correctly forwards reasoning_effort to supported models, unlocking extended thinking and o1-style reasoning flows. If you're using Claude, o1, or other reasoning-enabled models, this is a substantial unlock for complex problem-solving agents that need to think deeply before acting.

💬 Native Slack Message Formatting

Markdown messages sent to Slack are now automatically converted to Slack's native mrkdwn format in the Slack sidecar. Your Slack agents now produce properly-formatted, native-looking messages instead of raw Markdown syntax — a small change that makes a big difference in readability.

🎯 Smarter Output Deduplication

Artifact read results are no longer re-spilled at the post-tool chokepoint, eliminating redundant output and keeping agent conversations cleaner. This is especially valuable in longer runs where output verbosity can distract from the actual work.

🔍 Dashboard Model Transparency

The Codex CLI now exposes which model it's configured to run, visible directly in the dashboard. No more mystery about what's powering your agents.

🌍 Internationalization

Dashboard and website translations have been completed and proofread across multiple languages, opening LibreFang to a global community of developers.

🛡️ Security & Reliability Hardening

Tests can now run offline with LIBREFANG_REGISTRY_OFFLINE, removing network dependencies and accelerating your CI pipelines
Multiple security advisories cleared: quick-xml, crossbeam-epoch, and cargo-deny all updated
WS terminal frames now correctly correlate with chat turns, improving observability and debugging
Fixed edge cases in media handling and TUI formatting for smoother operation

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.6.29 Released

涼風羽月 — Mon, 29 Jun 2026 07:00:20 +0000

LibreFang 2026.6.29 Released

This release marks three major engineering priorities: bringing LibreFang to global audiences, expanding hardware support, and squashing critical reliability edge cases. 14 PRs from 4 contributors landed since v2026.6.26-beta.24.

What's New

🌍 Full Korean Language Support

We've shipped complete Korean translations across the entire stack:

UI: 233 language keys translated
CLI/TUI: Commands and help text in Korean
Error messages: Expanded from 43 to 233 localized keys

Korean-speaking developers and teams can now use LibreFang entirely in their language.

🏗️ Multiplatform: ARM64 Linux & Android Ready

aarch64 Linux is now fully supported:

Official ARM64 binaries published to AUR and the project-maintained pacman repository alongside x86_64
Android NDK cross-compilation fixed (legacy binutils symlink + PATH resolution)

Deploy confidently on Raspberry Pi, Apple Silicon Linux containers, cloud ARM instances, and Android environments.

🛡️ Reliability Fixes & Security

Mixed-media message batches — edge case fixed where coalesced batches with mixed content types weren't enriched on the debounced path
Telegram setup form resilience — stays available even if the describe call times out, preventing users from getting stuck mid-setup
Security patch — bumped pdf-extract to 0.12 to patch RUSTSEC-2026-0187 (lopdf vulnerability)

⚡ Developer Experience

Codex CLI now works outside Git repositories — remove the requirement to run inside a .git tree. Perfect for standalone scripts, CI pipelines, and one-off analysis.

Changes at a Glance

Category	Changes
Internationalization	Korean UI (#6349), Korean errors (#6353), Korean CLI/TUI (#6356)
Multiplatform	aarch64 packages (#6358), NDK binutils fix (#6335), NDK PATH fix (#6338)
Reliability	Telegram setup (#6345), mixed-media enrichment (#6351), security patch (#6339)
Developer Tools	Codex CLI outside Git (#6347)
Operations	AUR automation (#6341), pacman repo to R2 (#6352), CI improvements (#6340, #6346)

Detailed changelog

Added

UI Korean translation (#6349) (@seungjin)
Complete Korean error translations (43 → 233 keys) (#6353) (@houko)
Add Korean (ko) translation for the CLI/TUI (#6356) (@houko)
Publish aarch64 packages alongside x86_64 (#6334) (#6358) (@houko)

Fixed

Bump pdf-extract 0.10→0.12 to patch lopdf RUSTSEC-2026-0187 (#6339) (@houko)
Keep Telegram setup form available after describe timeout (#6345) (@pavver)
Allow Codex CLI outside Git repositories (#6347) (@pavver)
Enrich coalesced mixed-media batches on the debounced path (#6348) (#6351) (@houko)

Maintenance

Symlink legacy NDK binutils so vendored OpenSSL cross-compiles for Android (#6335) (@houko)
Put NDK bin on PATH so openssl-src finds the legacy ranlib symlink (#6338) (@houko)
Enable auto-merge instead of forcing --admin (#6340) (@houko)
Publish AUR packages on release (#6334) (#6341) (@houko)
Publish project-maintained pacman repo to R2 (#6334) (#6352) (@houko)
Fix[flake.nix]: Add perl to nativeBuildInputs (#6346) (@FrantaNautilus)

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

LibreFang 2026.4.27 Released

涼風羽月 — Mon, 04 May 2026 13:14:41 +0000

LibreFang 2026.4.27 Released

LibreFang v2026.4.27 ships the changes below. See the full changelog for the complete list.

Added

TUI setup wizard now offers microsoft, zai, zai_coding, volcengine, volcengine_coding, byteplus, byteplus_coding alongside the existing first-run options. The wizard's PROVIDERS list had drifted from PROVIDER_REGISTRY and silently hid these from new installs; a unit test now pins these entries against future regressions. (@houko)
Treat CLI logins as first-class default providers (#3061) (@houko)
Grafana Tempo + business-level span instrumentation (#3064) (@houko)
/new creates a new session instead of resetting the current one (#3071) (@neo-wanderer)
Support image-generation models (registry modality field) (#3074) (@houko)
Wire chat attachment uploads in ChatPage (#3075) (@houko)
Add Novita AI as OpenAI-compatible provider (#3076) (@houko)
Agent name prefix on outbound + Signal plain-text default (#3077) (@houko)
SSE attach endpoint for multi-client session co-watching (#3078) (@houko)
Add SearXNG self-hosted search provider (#3079) (@houko)
Add AWS Bedrock provider with Bearer token auth (#3080) (@houko)
AuditCheck framework + first 3 CLAUDE.md gotcha checks (#3082) (@houko)
Add LlmFamily enum + LlmDriver::family() (#3083) (@houko)
SSE attach hook for multi-client session co-watching (#3087) (@houko)
Add ToolApprovalClass + tool_classifier (no behavior change yet) (#3092) (@houko)
Session lifecycle event bus (additive, no subscribers yet) (#3093) (@houko)
Support PDF and text/code file attachments end-to-end (#3094) (@houko)
Trajectory export endpoint with privacy redaction (#3097) (@houko)
Extend detect_embedding_provider with vLLM + LM Studio fallback (#3099) (@houko)
Cron multi-destination delivery with failure isolation (#3102) (@houko)
UI for cron multi-destination delivery targets (#3103) (@houko)
Cache /config + reject pageno=0 + annotate truncation (#3108) (@houko)
Re-read agent context.md per turn (#3115) (@houko)
Central slash command registry (PR-1/3) (#3122) (@houko)
Slash command registry — CLI/TUI surface (PR-2/3) (#3123) (@houko)
Configurable max history messages (per-agent + global override) (#3125) (@neo-wanderer)
System_and_3 prompt cache stamping for Anthropic (M1) (#3126) (@houko)
ParallelSafety projection for batch tool dispatch (PR-1/6) (#3127) (@houko)
Plan_batch + path-overlap planner for tool dispatch (PR-2/6) (#3129) (@houko)
Model metadata lookup pipeline (PR-1/3, layers 1+2+5) (#3133) (@houko)
Model metadata L3 cache + L4 Ollama probe (PR-2/3) (#3134) (@houko)
Model metadata L4 Anthropic + OpenAI-compat probes (PR-2.5/3) (#3140) (@houko)
KernelConfig.parallel_tools section (PR-3/6) (#3144) (@houko)
Cron pre_script + silent_marker schema (PR-1/3) (#3145) (@houko)
Cache_hit_ratio metric + trajectory field (M2/2) (#3149) (@houko)
Agent detail drawer + filter pill i18n (#3159) (@houko)
Right-side drawer pattern for inspect-detail surfaces (#3166) (@houko)
Convert hand detail panel to drawer variant (#3168) (@houko)
Roll out drawer/panel pattern across all page modals (#3175) (@houko)
Add Jaeger as second trace backend alongside Tempo (#3176) (@houko)
Granular MCP taint policy + dashboard tree editor (closes #3050) (#3193) (@houko)
Jaeger trace backend + Loki/Alloy logs + CLI wiring (#3194) (@houko)
Per-(agent, session) liveness tracking and session-scoped stop (#3195) (@houko)
RBAC M2 — audit user/channel attribution + stable UserId (#3054) (#3196) (@houko)
Hot-reload log_level via dashboard without daemon restart (#3200) (@houko)
RBAC M4 — channel-native role mapping (Telegram/Discord/Slack) (#3054) (#3202) (@houko)
RBAC M5 — audit query/export + per-user budget API (#3054) (#3203) (@houko)
RBAC M3 — per-user tool policy + memory namespace ACL (#3054) (#3205) (@houko)
RBAC M6 — dashboard (users, identity linking, simulator, CSV import + stubs) (#3054) (#3209) (@houko)
Per-agent + global lane caps for trigger dispatch (#3210) (@neo-wanderer)
Auto-download voice messages mirroring file path (#3212) (@neo-wanderer)
Wip (#3213) (@houko)
Hand agent runtime overrides with restart persistence (#3216) (@leszek3737)
Deliver HealthCheckFailed to notification.alert_channels (#3218) (@neo-wanderer)
Per-user budget write/clear endpoints + dashboard editor (#3224) (@houko)
Activate AuditPage now that M5 audit endpoints shipped (#3225) (@houko)
Per-action retention policy with chain-anchor trim (#3227) (@houko)
RBAC effective-permissions snapshot — wire simulator (#3054) (#3228) (@houko)
RBAC M3 — per-user policy GET/PUT + dashboard editor (#3229) (@houko)
RBAC — single-decision authz/check endpoint (#3054) (#3231) (@houko)
User-list summary flags + custom channel rule editor (#3229 follow-up) (#3232) (@houko)
Owner-only API key rotation with live session kill (#3233) (@houko)
External mount points in agent.toml (#3230) (#3234) (@houko)
Channel field as dynamic dropdown with custom fallback (#3248) (@houko)
URL-synced filters, JSON export, row detail modal (#3252) (@houko)
Move filters into right-docked drawer (#3254) (@houko)
BeforePromptBuild hook can contribute labeled DynamicSection injected into the system prompt, with 8KiB per-section / 32KiB total caps (closes #3326) (#3358) (@houko)

Fixed

Reconnect WhatsApp gateway after transient disconnects (#21) (@houko)
Render connection screen via custom URI scheme (closes #3052) (#3056) (@houko)
Create log dir + open log before stdout redirect (#3057) (@houko)
Surface CLI logins as their own providers, not API-provider fallbacks (#3059) (@houko)
Pre-create logs dir in entrypoint (defense for #3058) (#3060) (@houko)
Bundle compose stack in-binary, add OTLP collector (#3062) (@houko)
Create HTTP trace spans at INFO so OTel exporter sees them (#3063) (@houko)
Move env_filter to fmt layer so OTel sees INFO spans (#3065) (@houko)
Drop ingester/compactor from Tempo config (#3067) (@houko)
Boot-time TOML drift detection now reaches hand agents (#3068) (@neo-wanderer)
Reprobe local providers every 60s + refresh on test (#3069) (@houko)
Add missing files to src to fix librefang-cli build (#3073) (@FrantaNautilus)
Honor session_mode=new with per-fire isolated sessions (#3081) (@houko)
Copilot streaming empty tool calls + Claude assistant strip (#3084) (@houko)
Gemini array-items default + first-message-must-be-user (#3085) (@houko)
Safe UTF-8 boundary in three remaining truncation sites (#3086) (@houko)
PowerShell sandbox bypass + agent-config persistence + WS race + Revolt self-host (#3088) (@houko)
Cron preservation across hand reactivation + telegram startup timeout + token estimation includes ToolUse (#3090) (@houko)
Capture text from intermediate tool_use iterations (#3091) (@houko)
Percent-decode WS auth token to preserve base64 characters (#3095) (@houko)
Skip heartbeat timeout for agents in their idle grace window (#3096) (@houko)
Handle BrokenPipe gracefully in doctor --json (#3100) (@houko)
UTF-8-safe error truncation + 502/504 retry + response classify tests (#3104) (@houko)
Cap accumulated_text + document streaming non-redelivery contract (#3106) (@houko)
Cron dedupe + next_run + token_length annotation (#3109) (@houko)
Sticky has_processed_message replaces time-based grace (#3111) (@houko)
Use 127.0.0.1 instead of localhost for local LLM URLs (#3112) (@houko)
Pass agents_dir to hand route candidate scan to silence WARN flood (#3113) (@houko)
Close non-loopback auth bypass when api_key is empty (#3114) (@houko)
Downgrade pure-normalization to debug, keep WARN for real repair (#3117) (@houko)
Use "default" provider/model in custom-agent template (#3121) (@houko)
Forward api_key as Bearer in local provider probe (#3128) (@houko)
Degrade Memory page gracefully when proactive memory is disabled (#3131) (@houko)
Allow named workspaces in read-side path resolution (#3137) (@neo-wanderer)
Unbreak cron_delivery tests + move guards to input validation (#3139) (@houko)
Unbreak local provider config in GUI (#3141) (@houko)
Re-render hand [[settings]] tail after boot-time TOML drift (#3142) (@neo-wanderer)
Relax probe timeout for remote local-provider URLs (#3146) (@houko)
Preserve tool annotations for parallel safety classification (PR-6/6) (#3147) (@houko)
Include SearXNG in web_search_available check (#3152) (@houko)
Drop redundant runtime SSRF check in deliver_webhook (#3155) (@houko)
Add .desktop entry and install icon (#3157) (@FrantaNautilus)
Seed [[settings]] defaults into hand instance config on activation (#3160) (@houko)
Skip empty Blocks when stamping prompt cache markers (review fix for #3126) (#3161) (@houko)
Expose vLLM + LM Studio in embedding provider dropdown (refs #3138) (#3162) (@houko)
Re-render Reference Knowledge + Your Team tails after TOML drift (#3164) (@houko)
Provide .desktop entry and icon for librefang-desktop (#3156) (#3165) (@houko)
Regenerate config_schema golden after parallel_tools addition (#3167) (@houko)
Stop drawer scroll chaining into the page (#3169) (@houko)
Observability auto-start opt-in + home_dir isolation + RAII cleanup (#3170) (@houko)
Surface provider model list above the fold (#3179) (@houko)
Wire OS keyring (libsecret/Keychain/Credential Manager) (#3180) (@houko)
Wrap with wrapGAppsHook3 so tray icon resolves on NixOS (#3197) (@houko)
Probe OpenAI fallback for ollama-slot servers, hide non-discovered local models (#3204) (@houko)
Correct max_level_hint test assertions (#3206) (@houko)
Correct max_level_hint test assertions (#3207) (@houko)
Set sender_user_id metadata so RBAC works in groups (#3215) (@neo-wanderer)
Serialize channel config writes via toml_edit + lock (#3183) (#3223) (@houko)
Attribute loopback callers to user_api_keys when token provided (#3236) (@houko)
Invalidate effective-permissions on policy/budget mutations (#3228 follow-up) (#3237) (@houko)
Prefix sender_chat ids so they can't collide with user namespace (#3215 follow-up) (#3238) (@houko)
RBAC M3 follow-up — memory ACL fail-closed for anonymous callers (#3239) (@houko)
Include prev_hash so verifiers can replay the chain (#3203 follow-up) (#3240) (@houko)
RBAC M4 follow-up — role_cache reload + Telegram DM owner-escalation (#3241) (@houko)
Mark scope as user_policy_only to match implementation (#3231 follow-up) (#3242) (@houko)
Attribute admin actions to caller + log old->new diffs (#21 follow-up) (#3245) (@houko)
Harden CSV import + flag identity-link risk (#3209 follow-up) (#3246) (@houko)
RBAC M3 follow-up — namespace traversal + case-insensitive deny + memory audit emit (#3205) (#3249) (@houko)
Autonomous-loop tool calls bypass user gate (closes #3243) (#3251) (@houko)
Channel dropdown uses /api/channels for full 44-adapter list (#3253) (@houko)
Enforce deterministic ordering for LLM-bound MCP server / skill registries to stabilize provider prompt cache (closes #3298) (#3325) (@houko)

Changed

Derive JSON Schema from KernelConfig via schemars (#3055) (@houko)
Extract SessionStore trait alongside SQLite substrate (#3089) (@houko)
Make bridge helpers crate-private (#3181) (@houko)
Remove unused public helpers (#3182) (@houko)
Tighten visibility of internal request structs (#3184) (@houko)
Merge duplicate type definitions across crates (#3185) (@houko)
Rename Action enums to disambiguate from domain types (#3188) (@houko)
BREAKING: Split coding-provider API keys onto dedicated env vars — byteplus_coding now reads BYTEPLUS_CODING_API_KEY (was BYTEPLUS_API_KEY), volcengine_coding reads VOLCENGINE_CODING_API_KEY (was VOLCENGINE_API_KEY), zai_coding reads ZAI_CODING_API_KEY (was ZHIPU_API_KEY), zhipu_coding reads ZHIPU_CODING_API_KEY (was ZHIPU_API_KEY). Per-token siblings (byteplus, volcengine, zai, zhipu) keep their original env vars. Set the new env var if you use any _coding provider. (#3279) (@houko)
BREAKING: Register microsoft (GitHub Models / Azure AI Inference) as an explicit driver-registry entry with its own GITHUB_MODELS_TOKEN env var, distinct from github-copilot's GITHUB_TOKEN. Same PAT works for both, but the env vars are now separate so configuring one product no longer auto-activates the other in the model picker. Set GITHUB_MODELS_TOKEN if you use the microsoft provider. (#3281) (@houko)
BREAKING: Split zai from sharing ZHIPU_API_KEY with zhipu — zai (api.z.ai) now reads ZAI_API_KEY while zhipu (open.bigmodel.cn) keeps ZHIPU_API_KEY. Same Zhipu credential value works for both, but the env vars are now separate so configuring one no longer auto-activates the other. Set ZAI_API_KEY if you use the zai provider. (#3285) (@houko)

Documentation

Add tool_timeouts configuration documentation (#3098) (@leszek3737)
Backfill reference for cron / config / providers / channels / api / observability (#3189) (@houko)
Clarify worktree continuation drives to PR (#3190) (@houko)
Align left nav with file tree (#3199) (@houko)
Backfill source-vs-doc gaps (providers / channels — config / API / CLI to follow) (#3201) (@houko)
Drop HTML comment that broke Deploy Docs on main (#3208) (@houko)
Align Chinese translations with English source (#3220) (@houko)

Maintenance

Rename normalize_schema_recursive + warn on items fallback (#3105) (@houko)
Document apply_agent_prefix idempotency caveats (#3107) (@houko)
Timing-side-channel mitigation in percent_decode (#3110) (@houko)
Align localhost test expectations with #3112 default change (#3118) (@houko)
Ignore local .plans/ working notes directory (#3130) (@houko)
Sync librefang-types tracing dep into Cargo.lock (#3132) (@houko)
Unbreak main — cargo fmt for model_metadata.rs (#3150) (@houko)
Unbreak main — fix clippy manual_pattern_char_comparison (#3153) (@houko)
Hand-level skills propagation regression for #3135 (#3163) (@houko)
Pull librefang-api into selective lane on librefang-types changes (#3171) (@houko)
Drop LEGACY_TEAM_TAIL_MARKER fallback (#3177) (@houko)
Install libdbus-1-dev for OpenAPI Drift job (#3186) (@houko)
Remove unused dependencies across workspace (#3187) (@houko)
Pin push_notification routing for health_check_failed (#3222) (@houko)
Unbreak typecheck on sessions-stream test (#3235) (@houko)
Unbreak typecheck on UserBudgetPage + duplicate type export (#3244) (@houko)

Other

Unbreak main — use local user_api_keys snapshot (#3250) (@houko)

We just launched the new LibreFang website

涼風羽月 — Wed, 25 Mar 2026 08:13:52 +0000

We just shipped the new librefang.ai — a complete redesign of the official website for LibreFang, our open-source Agent Operating System built in Rust.

If you haven't heard of LibreFang: it's a production-grade runtime for autonomous AI agents. Single binary, 180ms cold start, 40MB memory. 15 built-in autonomous capability units ("Hands"), 44 channel adapters, 50 LLM providers. It runs agents 24/7 on a schedule — no user prompts needed.

Here's what we built for the new site.

7 languages, day one

The site ships with full translations in English, 简体中文, 繁體中文, 日本語, 한국어, Deutsch, and Español. Not machine-translated placeholders — every string was reviewed for grammar and natural phrasing.

Language detection is automatic based on your browser, and you can switch anytime from the nav.

Architecture visualized

The homepage walks through LibreFang's five-layer architecture:

Channels — 44 adapters: Telegram, Slack, Discord, WhatsApp, Signal, Matrix, Teams, and more
Hands — 15 autonomous units, each with its own model, tools, and workflow
Kernel — agent lifecycle, workflow orchestration, budget control, scheduling
Runtime — Tokio async, WASM sandbox, Merkle audit chain, SSRF protection
Hardware — runs everywhere: laptop, VPS, Raspberry Pi, bare metal

Each layer is interactive — click to explore the components inside.

Performance benchmarks, not marketing claims

We put a comparison table right on the homepage:

Metric	Others	LibreFang
Cold Start	2.5 ~ 4s	180ms
Idle Memory	180 ~ 250MB	40MB
Binary Size	100 ~ 200MB	32MB
Security Layers	2 ~ 3	16
Channel Adapters	8 ~ 15	44
Built-in Hands	0	15

Rust, not TypeScript. Production, not prototype.

One command install with OS detection

The install section detects your OS automatically and shows the right command:

macOS / Linux:

curl -fsSL https://librefang.ai/install | sh

Windows (PowerShell):

irm https://librefang.ai/install.ps1 | iex

Tabs let you switch between macOS, Windows, and Linux manually too.

Downloads & changelog

The downloads section pulls release data in real-time through our own API proxy. Desktop apps, CLI binaries, everything categorized by platform.

The changelog page shows a full timeline of releases with:

Category filters (features, fixes, etc.)
Download counts per asset
Auto-linked #issue references and @username mentions in release notes

Tech stack

React + TypeScript + Vite
Tailwind CSS for styling
Framer Motion for animations
TanStack Query for data fetching
Cloudflare Workers for the GitHub stats proxy

No heavy frameworks. No CMS. Just a fast SPA that gets out of your way.

What's next

LibreFang itself is moving fast — WhatsApp bidirectional routing just landed, prompt versioning and A/B experiments are in, and we're working toward the v1.0 milestone.

The website will keep evolving with the project. Docs are at docs.librefang.ai, and the deploy page at deploy.librefang.ai has one-click options for Fly.io and more.

If this sounds interesting, check out the repo: github.com/librefang/librefang

We're open source, merge-first PR policy, and all contributions are welcome. Drop a ⭐ if you like what you see.

LibreFang 2026.3.22 Released

涼風羽月 — Sat, 21 Mar 2026 16:32:36 +0000

LibreFang 2026.3.22 Released

We're thrilled to announce LibreFang v2026.3.22 — a massive release with expanded provider support, powerful new capabilities, and a completely overhauled dashboard. This release marks our evolution to Calendar Versioning and brings 50+ improvements across the entire platform.

What's New

📊 Major Architecture Update: Calendar Versioning

We've switched to CalVer (YYYY.M.DDHH) for more transparent and predictable release cycles. This change makes it easier to track what's fresh and plan your upgrades accordingly.

🔌 Expanded Provider Ecosystem

Connect to virtually any LLM provider now:

New providers: DeepInfra, Azure OpenAI, Qwen International/US endpoints
ChatGPT device auth flow for seamless authentication
Custom model support with proper alias registration and provider routing
Embedding dimensions configurable per agent — fine-tune costs and quality

🤖 Agent & Workflow Superpowers

Pipeline runner agents let you orchestrate complex multi-step workflows
IMAP email reader script for email-triggered automation
WorkflowTemplate registry (in-memory) for reusable workflow definitions
Per-agent plugin scoping with granular allowed_plugins config
Graceful context reset via /reboot slash command

⚙️ Configuration & Persistence

Global workspace directory for cross-session state persistence
Custom log directory config — store logs anywhere you want
Config validation with tolerant mode — cleaner error messages, safer defaults
Arbitrary config keys in skills — unlimited flexibility for custom skill parameters
Configurable session reset prompt — personalize context resets
Knowledge query improvements — JOIN matches entities by name or ID, indexed by agent

💬 Chat Platform Enhancements

Slack: Unfurl links option, force-flat replies config for cleaner threads
Discord: Configurable mention patterns for smarter mentions
HAND.toml format now accepts flexible [hand] wrappers for better compatibility

🚀 Performance & Stability

Infinite retry guard — prevents runaway loops
Streaming safety — prevent interrupts during multi-tool sequences
Memory caching — workspace and skill metadata cached to reduce per-message overhead
Optimized KV operations — faster, more efficient state management
Migration tools — refresh param for cache bypassing, sparse chart data handling
Improved polling detection — replaced fragile heuristics with robust LoopGuard

🎨 Dashboard & UX

Complete React UI/UX overhaul — modern, responsive, beautiful
Japanese localization + comprehensive i18n coverage for goals/analytics
SVG branding banners — fresh promotional materials
Fixed navigation — better link structure and mobile indicators
Dev server integration — just api now starts dashboard + API together

🛠️ Developer Experience

Rustfmt.toml for consistent code formatting across the project
Version & git hash in startup logs — instant transparency on what's running
Desktop app .env support — easier local configuration
Homebrew Cask CI sync — streamlined distribution
Improved Qwen Code CLI detection — smoother integration

📚 Documentation

Comprehensive review — fixed errors, updated all numbers, filled missing gaps.

🔧 Infrastructure & CI/CD

GitHub Stats Worker integration for better analytics
Auto-update PR branches on main push
Docker Compose fixes for admin interface port binding
MCP server names now allow hyphens
Release.sh macOS compatibility — no more grep headaches
Cloudflare Pages SPA fallback — corrected _redirects format
PWA manifest & OG image fixes for better sharing

Install / Upgrade

# Binary
curl -fsSL https://get.librefang.ai | sh

# Rust SDK
cargo add librefang

# JavaScript SDK
npm install @librefang/sdk

# Python SDK
pip install librefang-sdk

DEV Community: 涼風羽月

LibreFang 2026.9.14 Released

LibreFang 2026.9.14 Released

Autonomous Goal Execution & Goals System

Agent Types: Manifests as First-Class Citizens

Channel Multi-Instance Support

Per-Agent Reasoning Mode & Extended Thinking

Configuration, Credentials & Vaults

Model Management & Parameters

Memory System Hardening

Dashboard & TUI Enhancements

Bug Fixes & Stability

Security Fixes

Performance

Migration Notes

Install / Upgrade

Links

LibreFang 2026.8.30 Released

LibreFang 2026.8.30 Released

What's New

Agents Can Now Think for Themselves

Workflows Are Now Composable, Portable, and Inspectable

Agents Can Spawn Ephemeral Workers

Identity and Access Control Are Now Group-Aware

Slack Channels Got Smarter

Backups Are Selective and Restorable

Kubernetes and Mounted Configuration Just Work

Under the Hood

Performance and Reliability

Developer Experience

Security and Hardening

Fixes

Install / Upgrade

Links

LibreFang 2026.10.16 Released

LibreFang 2026.10.16 Released

Agent Configuration & Identity

Knowledge Management & Chat

Model Control & Discovery

Terminal & Automation

Tasks & Approvals

Stability & Security

Behind the Scenes

Developer Experience

Install / Upgrade

Links

LibreFang 2026.8.19 Released

LibreFang 2026.8.19 Released

What's New

Security & Reliability

Managed Configuration

Long-Form Audio & Video

Async Agent Messaging & Task Waking

Localization Fixes

Performance

Bug Fixes

Install / Upgrade

Links

LibreFang 2026.7.31 Released

LibreFang 2026.7.31 Released

Core improvements

Added features

Fixed bugs & security issues

Changed

Security

Install / Upgrade

Links

LibreFang 2026.7.27 Released

LibreFang 2026.7.27 Released

New: Provider Integrations & Deployment

Fixes: Correctness & Data Integrity

Under the Hood

Install / Upgrade

Links

LibreFang 2026.7.21 Released

LibreFang 2026.7.21 Released

What's New

🔐 Security & Multi-User Data Isolation

🚀 Better Developer Experience

🛠️ Infrastructure & Provider Robustness