{"slug": "librefang-2026-11-11-released", "title": "LibreFang 2026.11.11 Released", "summary": "The LibreFang project released version 2026.11.11, adding per-message and per-session reasoning-effort controls across its chat UI, CLI, and agent editor, along with agent-manifest defaults for automated turns. The release also hardens agent memory with per-session compaction summaries, recording of iteration-capped turns as failed exchanges, and recall hints on memory misses, plus fixes for DeepSeek V4 reasoning echoes and RFC 9728-compliant MCP OAuth discovery. It spans 87 pull requests from 5 contributors since v2026.10.16.", "body_md": "# \n  \n  \n  LibreFang 2026.11.11 Released\n\n**LibreFang v2026.11.11 is out now** — a release focused on reasoning depth, memory reliability, and the kind of production hardening that keeps agents running smoothly at scale.\n\n*87 PRs from 5 contributors since v2026.10.16.*\n\n## \n  \n  \n  What's New\n\n### \n  \n  \n  Reasoning Depth Now Tunable Per Message\n\nSet how deep your agent thinks on each turn. The chat UI, CLI, and agent editor all gain reasoning-effort controls that let you pick from the levels your model supports (`none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`), with:\n\n- \n**Per-message override** : Click a level to arm it for the next message only, then it resets.\n- \n**Session pinning** : Lock a level for the whole conversation via a new`/think` command or dashboard toggle.\n- \n**Agent defaults** : Set`[thinking] reasoning_effort` in your agent manifest for all automated turns.\n\nThe backend's `offered_efforts` are mirrored in the UI so you only see what's actually available — no dead choices. Works with streaming and HTTP fallback. (#8616, #8617, #8618)\n\n### \n  \n  \n  Memory That Sticks\n\nTwo key fixes restore context across compaction and iteration limits:\n\n- \n**Trimmed messages now folded into summaries** : When a session compacts, messages older than the window are no longer dropped — they fold into that session's own summary, so later turns can still reconstruct what happened. Other sessions on the same agent no longer lose their history. (#8736, #8646, #8730)\n- \n**Capped turns record themselves** : If your agent hits the iteration limit mid-turn, that attempt is now saved to memory as a failed exchange with a clear`[Unfinished — this turn reached the iteration limit]` marker, so the next turn knows it happened. (#8688)\n- \n**Memory misses are now hints, not dead ends** : When`memory_recall` finds no match, it surfaces similar keys that do exist in your namespace, so agents can correct typos or try variations. (#8628)\n\n### \n  \n  \n  Session Stability and Correctness\n\nThree subtle but high-impact fixes prevent silent data loss:\n\n- \n**Compaction mirrors are per-session** (#8646): The old agent-level canonical summary is now also tracked per session, so multiple conversations on the same agent no longer clobber each other's compressed history.\n- \n**History fold respects turn boundaries** (#8653, #8731): A single long agent turn no longer compacts its own tool results mid-loop. The fold now stops at the running turn's start, and the boundary is found by tool ID so it survives session repair and compression.\n- \n**Injections stay out of long-term storage** (#8737): Ephemeral context (current time, recalled memory, search results) is no longer persisted when inline compression merges it into adjacent messages, so it doesn't replay forever.\n\nCombined, these mean your agent's memory is accurate, and compacting sessions doesn't accidentally erase history across the workspace.\n\n### \n  \n  \n  DeepSeek V4 and MCP OAuth Work Reliably\n\nTwo integration suites are now solid:\n\n- \n**DeepSeek reasoning echoes correctly** (#8639, #8652): The runtime now sends full reasoning content on every historical turn with a thinking block (as DeepSeek's API requires), and recognizes DeepSeek's native DSML markup as text so it doesn't leak into the transcript.\n- \n**OAuth discovery follows RFC 9728** (#8670, #8728): MCP servers behind path prefixes, self-hosted gateways, and services with dynamic client registration all work now. Discovery probes authorization-server metadata and handles both header-based and headerless variants.\n\n### \n  \n  \n  API and Routing Consistency\n\nReasoning effort now flows through all dispatch paths identically:\n\n- \n**Channel, cron, trigger, and `agent_send` turns** now use the routed model's reasoning policy, not a pre-routing downgrade. (#8729)\n- \n**Streaming turns apply agent routing** ,`pinned_model` , and tier/cost routing the same way scheduled turns do. (#8591)\n- \n**Session model picks win everywhere** via`/model` override.\n\n### \n  \n  \n  Security and Isolation\n\nFrom a comprehensive workspace audit:\n\n- \n`/api/sessions` and transcripts are now**owner-scoped** — non-admin roles can no longer read every user's conversations. (#8588)\n- \n**`web_fetch` cache is per-agent** — one agent can't read another's authenticated response. (#8591)\n- \n**MCP credentials never leak** in config endpoints or sidecar environment. (#8591)\n- \n**Shell flags in exec allowlists** are now validated individually (`-lc` can't slip through as one token). (#8588)\n- Three critical RustSec advisories closed: `lru` 0.18.2 (unsound eviction),`wasmtime` 48.0.8 (Cranelift jump bug on aarch64),`rmcp` 3.9 (OAuth SSRF, tool schema cache). (#8610, #8722)\n\n### \n  \n  \n  Developer Experience Improvements\n\n- \n**Form lists are now chips** in the dashboard: paste a comma or newline-separated list and each value becomes a removable chip. (#8657)\n- \n**Manifest history is readable** : The TUI and dashboard now show human labels (`Model change` ,`Suspended` ,`Pre-restore snapshot` ) instead of wire tokens. (#8603, #8604, #8607, #8609)\n- \n**Tab accessibility fixed** : The dashboard's tab strips now carry proper`aria-controls` ,`aria-labelledby` , and keyboard semantics (Arrow/Home/End navigation, roving tabindex). (#8608)\n- \n**Identity file locks don't deadlock** in parallel tests anymore. (#8620)\n- \n**Telegram sidecar has a poll deadline** (50s) — no more wedged workers after a 502. (#8662)\n\n### \n  \n  \n  Under the Hood\n\n- \n**`apply_patch` anchoring** : Hunks that match multiple locations are now rejected; use`@@ <line>` scope headers or add context to disambiguate. (#8588)\n- \n**Sidecar SDK MSRV raised to Rust 1.85** to track tokio 1.54. (#8695)\n- \n**Per-agent config overrides** now live in`agent.toml` (not`config.toml` ) — the kernel emits a targeted warning if it finds them in the wrong place. (#5476)\n- \n**Session mode resolution** is documented in`docs/architecture/session-mode-resolution.md` for triggers, cron, and channels. (#8736)\n\n## \n  \n  \n  Install / Upgrade\n\n## \n  \n  \n  Links", "url": "https://wpnews.pro/news/librefang-2026-11-11-released", "canonical_source": "https://dev.to/suzukazehaduki/librefang-20261111-released-18f2", "published_at": "2026-11-11 03:04:04+00:00", "updated_at": "2026-11-11 03:21:39.541518+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "large-language-models", "agent-protocols", "developer-tools"], "entities": ["LibreFang", "DeepSeek", "DeepSeek V4", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/librefang-2026-11-11-released", "markdown": "https://wpnews.pro/news/librefang-2026-11-11-released.md", "text": "https://wpnews.pro/news/librefang-2026-11-11-released.txt", "jsonld": "https://wpnews.pro/news/librefang-2026-11-11-released.jsonld"}}