{"slug": "librefang-2026-7-21-released", "title": "LibreFang 2026.7.21 Released", "summary": "LibreFang 2026.7.21 has been released with critical security improvements, multi-user isolation fixes, and credential management. The release includes per-user LLM provider credentials, knowledge graph scoping, cross-account channel guards, and a four-pass security audit that fixed 15+ bugs.", "body_md": "#\nLibreFang 2026.7.21 Released\n\n61 PRs from 4 contributors since v2026.7.11.\n\n##\nWhat's New\n\nThis release brings **critical security improvements**, **multi-user isolation fixes**, and **powerful credential management** — all while expanding MCP integration and shipping quality-of-life wins across the dashboard.\n\n###\n🔐 Security & Multi-User Data Isolation\n\nIf you're running LibreFang with multiple users or on shared infrastructure, pay close attention here.\n\n-\n**Per-user LLM provider credentials** — Users can now bring their own API keys with transparent per-owner spend tracking. Operators set org-wide provider allowlists and enforce per-user budgets directly at the API level.\n-\n**Knowledge graph per-user scoping** — Fixed a cross-user data leak: the knowledge graph is now partitioned by user on multi-user agents, ensuring shared agents don't expose one user's memory to another.\n-\n**Cross-account channel guards** — Enforced through the MCP bridge to prevent unauthorized agent-to-channel sends.\n-\n**Session-owned compacted summaries** — Prevents prompt leaks across user sessions.\n-\n**Four-pass security audit** — Caught and fixed 15+ bugs ranging from authorization gaps to token-quota races.\n\n###\n🚀 Better Developer Experience\n\n-\n**MCP resources primitive** — Agents can now access MCP-exposed resources, completing the MCP integration beyond tools alone.\n-\n**Live Slack progress for long tasks** — Long-running agent tasks now post real-time phase updates in Slack using Block Kit message edits, so users see progress instead of waiting for a single final reply.\n-\n**HAND.toml online editing** — Edit hand manifests directly from the Hands panel in the dashboard — no file editing required.\n-\n**Expanded delivery-target channel presets** — All sidecar adapters now support shortcut presets for common targets.\n\n###\n🛠️ Infrastructure & Provider Robustness\n\n-\n**Multi-provider improvements** — Added response_format support for Gemini and Vertex AI; prefer live model catalog with build-time fallback.\n-\n**Token quota safety** — Release reservations on drop to prevent self-imposed quota DoS.\n-\n**Provider alias safety** — Canonicalize providers before per-user key lookup to block chargeback leaks.\n-\n**Better error visibility** — Surface mid-stream provider errors instead of garbled or empty turns.\n\n###\nAdded\n\n- Env opt-out (TELEGRAM_STREAMING) for the streaming path (#6482) (@houko)\n- Per-user LLM provider credentials with per-owner usage attribution (initial) (#6483) (@houko)\n- Org-wide LLM provider allowlist (fail-closed at driver resolution) (#6484) (@houko)\n- Slack multi-step progress display via AgentPhase-driven Block Kit updates (#6487) (@houko)\n- Per-user attribution survey + API-level user filtering of audit queries (#6488) (@houko)\n- Process_start completion notification via the async task tracker (#6489) (@houko)\n- Edit HAND.toml online from the Hands panel (#6490) (@houko)\n- Scope the knowledge graph per user (peer_id) on multi-user agents (#6494) (#6502) (@houko)\n- Expand delivery-target channel presets to all sidecar adapters (#6506) (@houko)\n- Owner-gated CRUD for per-user provider credentials (#6460) (#6509) (@houko)\n- Implement the MCP resources primitive (#6501) (#6532) (@houko)\n\n###\nFixed\n\n- Prefer the live model catalog with a build fallback (#6384) (@pavver)\n- Security and correctness hardening from repo-wide audit (#6438) (@houko)\n- Second-pass security and correctness hardening from repo-wide audit (#6439) (@houko)\n- Third-pass security and correctness hardening from repo-wide audit (#6441) (@houko)\n- Fourth-pass security and correctness hardening from repo-wide audit (#6446) (@houko)\n- Resolve four reported bugs (#6423, #6442, #6443, #6444) (#6449) (@houko)\n- Enforce cross-account channel_send guard through the /mcp bridge (#6443) (#6455) (@houko)\n- Trust operator env allowlist in sandbox_command (#6465) (@houko)\n- Treat retired pnpm audit endpoint as skip, not a dependency issue (#6466) (@houko)\n- Field-scope dm_policy/group_policy so a partial override stops silently gating groups, and expose them on [sidecar_channels] (#6468) (@houko)\n- Distinguish context and budget limits (#6479) (@houko)\n- Allow dashboard login script under CSP (#6480) (@houko)\n- Treat auto_dream fork tool calls as system-internal so RBAC does not gate them (#6485) (@houko)\n- Login page unreadable in light theme (CSS cascade source-order bug) (#6486) (@houko)\n- Pin login_page.html to LF so the CSP-hash test passes on Windows (#6481) (#6496) (@houko)\n- Gate compacted summary by owning session to stop cross-user prompt leak (#6493) (#6497) (@houko)\n- Honour glob patterns in per-agent tool_allowlist/tool_blocklist (#6495) (#6498) (@houko)\n- Approvals approve 415 false-success + status column in approvals list (#6492) (#6500) (@houko)\n- Stop over-blocking MCP arguments that carry a long numeric id (#6499) (#6503) (@houko)\n- Route post-approval reply through account-qualified outbound (#6492) (#6511) (@houko)\n- Surface mid-stream provider errors instead of empty/garbled turns (#6512) (@houko)\n- Release the token reservation on drop to stop a quota self-DoS (#6513) (@houko)\n- Attribute owner-key spend and enforce per-user budget on authenticated API turns (#6514) (@houko)\n- Honor response_format in the Gemini and Vertex AI drivers (#6515) (@houko)\n- Treat [browser] config-reload as restart-required, not a false hot-reload (#6516) (@houko)\n- Canonicalize provider before the per-user key lookup to stop an alias chargeback leak (#6517) (@houko)\n- Serialize a canonical-session override on the per-agent lock to stop a lost-update race (#6518) (@houko)\n- Scope MCP knowledge_add_* writes to the calling agent, not agent_id=\"\" (#6519) (@houko)\n- Recognize CHANGELOG attribution on a bullet's continuation lines (#6520) (@houko)\n- Don't orphan another agent's relations when deleting a shared entity's first-writer (#6522) (@houko)\n- Honor auto_approve and return 409 on double-resolve (#6492) (#6528) (@houko)\n- Surface on-disk upload path to agents for every file type (#6531) (@neo-wanderer)\n\n###\nChanged\n\n- Normalize on-disk upload naming to . (#6530) (#6536) (@houko)\n\nDocumentation, maintenance, and other internal changes\n\n###\nDocumentation\n\n- Explain trusted_senders vs [[users]] RBAC composition (#6492) (#6507) (@houko)\n- Document per-user key precedence over operator rotation (#6460) (#6510) (@houko)\n\n###\nMaintenance\n\n- Bump the cargo-minor-patch group with 10 updates (#6452) (@app/dependabot)\n- Bump tokio-tungstenite from 0.29.0 to 0.30.0 (#6453) (@app/dependabot)\n- Update yanked spin 0.9.8 to 0.9.9 (#6454) (@houko)\n- Bump the actions-minor-patch group with 3 updates (#6456) (@app/dependabot)\n- Bump actions/setup-node from 6.4.0 to 7.0.0 (#6457) (@app/dependabot)\n- Lock in env trust split across defer→approve→resume (follow-up to #6465) (#6467) (@houko)\n- Bump the web-minor-patch group in /web with 5 updates (#6472) (@app/dependabot)\n- Bump the dashboard-minor-patch group in /crates/librefang-api/dashboard with 6 updates (#6473) (@app/dependabot)\n- Bump @eslint/js from 9.39.4 to 9.39.5 in /crates/librefang-api/dashboard (#6474) (@app/dependabot)\n- Bump serde_with from 3.18.0 to 3.21.0 (#6475) (@app/dependabot)\n- Bump the docs-minor-patch group in /docs with 4 updates (#6491) (@app/dependabot)\n- Update model snapshot (#6523) (@houko)\n- Bump wasmtime from 46.0.1 to 47.0.1 (#6527) (@app/dependabot)\n- Bump the cargo-minor-patch group across 1 directory with 17 updates (#6533) (@app/dependabot)\n- Migrate librefang-acp to agent-client-protocol 1.3.0 (supersedes #6526) (#6534) (@houko)\n\n##\nInstall / Upgrade\n\n##\nLinks", "url": "https://wpnews.pro/news/librefang-2026-7-21-released", "canonical_source": "https://dev.to/suzukazehaduki/librefang-2026721-released-1g3h", "published_at": "2026-07-27 11:33:15+00:00", "updated_at": "2026-07-27 12:05:49.378882+00:00", "lang": "en", "topics": ["developer-tools", "ai-infrastructure", "ai-safety"], "entities": ["LibreFang", "Gemini", "Vertex AI", "Slack", "MCP"], "alternates": {"html": "https://wpnews.pro/news/librefang-2026-7-21-released", "markdown": "https://wpnews.pro/news/librefang-2026-7-21-released.md", "text": "https://wpnews.pro/news/librefang-2026-7-21-released.txt", "jsonld": "https://wpnews.pro/news/librefang-2026-7-21-released.jsonld"}}