LibreFang 2026.7.21 Released

LibreFang 2026.7.21 has been released with critical security improvements, multi-user isolation fixes, and credential management. The release includes per-user LLM provider credentials, knowledge graph scoping, cross-account channel guards, and a four-pass security audit that fixed 15+ bugs.

LibreFang 2026.7.21 Released 61 PRs from 4 contributors since v2026.7.11. What's New This release brings critical security improvements , multi-user isolation fixes , and powerful credential management — all while expanding MCP integration and shipping quality-of-life wins across the dashboard. 🔐 Security & Multi-User Data Isolation If you're running LibreFang with multiple users or on shared infrastructure, pay close attention here. - Per-user LLM provider credentials — Users can now bring their own API keys with transparent per-owner spend tracking. Operators set org-wide provider allowlists and enforce per-user budgets directly at the API level. - Knowledge graph per-user scoping — Fixed a cross-user data leak: the knowledge graph is now partitioned by user on multi-user agents, ensuring shared agents don't expose one user's memory to another. - Cross-account channel guards — Enforced through the MCP bridge to prevent unauthorized agent-to-channel sends. - Session-owned compacted summaries — Prevents prompt leaks across user sessions. - Four-pass security audit — Caught and fixed 15+ bugs ranging from authorization gaps to token-quota races. 🚀 Better Developer Experience - MCP resources primitive — Agents can now access MCP-exposed resources, completing the MCP integration beyond tools alone. - Live Slack progress for long tasks — Long-running agent tasks now post real-time phase updates in Slack using Block Kit message edits, so users see progress instead of waiting for a single final reply. - HAND.toml online editing — Edit hand manifests directly from the Hands panel in the dashboard — no file editing required. - Expanded delivery-target channel presets — All sidecar adapters now support shortcut presets for common targets. 🛠️ Infrastructure & Provider Robustness - Multi-provider improvements — Added response format support for Gemini and Vertex AI; prefer live model catalog with build-time fallback. - Token quota safety — Release reservations on drop to prevent self-imposed quota DoS. - Provider alias safety — Canonicalize providers before per-user key lookup to block chargeback leaks. - Better error visibility — Surface mid-stream provider errors instead of garbled or empty turns. Added - Env opt-out TELEGRAM STREAMING for the streaming path 6482 @houko - Per-user LLM provider credentials with per-owner usage attribution initial 6483 @houko - Org-wide LLM provider allowlist fail-closed at driver resolution 6484 @houko - Slack multi-step progress display via AgentPhase-driven Block Kit updates 6487 @houko - Per-user attribution survey + API-level user filtering of audit queries 6488 @houko - Process start completion notification via the async task tracker 6489 @houko - Edit HAND.toml online from the Hands panel 6490 @houko - Scope the knowledge graph per user peer id on multi-user agents 6494 6502 @houko - Expand delivery-target channel presets to all sidecar adapters 6506 @houko - Owner-gated CRUD for per-user provider credentials 6460 6509 @houko - Implement the MCP resources primitive 6501 6532 @houko Fixed - Prefer the live model catalog with a build fallback 6384 @pavver - Security and correctness hardening from repo-wide audit 6438 @houko - Second-pass security and correctness hardening from repo-wide audit 6439 @houko - Third-pass security and correctness hardening from repo-wide audit 6441 @houko - Fourth-pass security and correctness hardening from repo-wide audit 6446 @houko - Resolve four reported bugs 6423, 6442, 6443, 6444 6449 @houko - Enforce cross-account channel send guard through the /mcp bridge 6443 6455 @houko - Trust operator env allowlist in sandbox command 6465 @houko - Treat retired pnpm audit endpoint as skip, not a dependency issue 6466 @houko - Field-scope dm policy/group policy so a partial override stops silently gating groups, and expose them on sidecar channels 6468 @houko - Distinguish context and budget limits 6479 @houko - Allow dashboard login script under CSP 6480 @houko - Treat auto dream fork tool calls as system-internal so RBAC does not gate them 6485 @houko - Login page unreadable in light theme CSS cascade source-order bug 6486 @houko - Pin login page.html to LF so the CSP-hash test passes on Windows 6481 6496 @houko - Gate compacted summary by owning session to stop cross-user prompt leak 6493 6497 @houko - Honour glob patterns in per-agent tool allowlist/tool blocklist 6495 6498 @houko - Approvals approve 415 false-success + status column in approvals list 6492 6500 @houko - Stop over-blocking MCP arguments that carry a long numeric id 6499 6503 @houko - Route post-approval reply through account-qualified outbound 6492 6511 @houko - Surface mid-stream provider errors instead of empty/garbled turns 6512 @houko - Release the token reservation on drop to stop a quota self-DoS 6513 @houko - Attribute owner-key spend and enforce per-user budget on authenticated API turns 6514 @houko - Honor response format in the Gemini and Vertex AI drivers 6515 @houko - Treat browser config-reload as restart-required, not a false hot-reload 6516 @houko - Canonicalize provider before the per-user key lookup to stop an alias chargeback leak 6517 @houko - Serialize a canonical-session override on the per-agent lock to stop a lost-update race 6518 @houko - Scope MCP knowledge add writes to the calling agent, not agent id="" 6519 @houko - Recognize CHANGELOG attribution on a bullet's continuation lines 6520 @houko - Don't orphan another agent's relations when deleting a shared entity's first-writer 6522 @houko - Honor auto approve and return 409 on double-resolve 6492 6528 @houko - Surface on-disk upload path to agents for every file type 6531 @neo-wanderer Changed - Normalize on-disk upload naming to . 6530 6536 @houko Documentation, maintenance, and other internal changes Documentation - Explain trusted senders vs users RBAC composition 6492 6507 @houko - Document per-user key precedence over operator rotation 6460 6510 @houko Maintenance - Bump the cargo-minor-patch group with 10 updates 6452 @app/dependabot - Bump tokio-tungstenite from 0.29.0 to 0.30.0 6453 @app/dependabot - Update yanked spin 0.9.8 to 0.9.9 6454 @houko - Bump the actions-minor-patch group with 3 updates 6456 @app/dependabot - Bump actions/setup-node from 6.4.0 to 7.0.0 6457 @app/dependabot - Lock in env trust split across defer→approve→resume follow-up to 6465 6467 @houko - Bump the web-minor-patch group in /web with 5 updates 6472 @app/dependabot - Bump the dashboard-minor-patch group in /crates/librefang-api/dashboard with 6 updates 6473 @app/dependabot - Bump @eslint/js from 9.39.4 to 9.39.5 in /crates/librefang-api/dashboard 6474 @app/dependabot - Bump serde with from 3.18.0 to 3.21.0 6475 @app/dependabot - Bump the docs-minor-patch group in /docs with 4 updates 6491 @app/dependabot - Update model snapshot 6523 @houko - Bump wasmtime from 46.0.1 to 47.0.1 6527 @app/dependabot - Bump the cargo-minor-patch group across 1 directory with 17 updates 6533 @app/dependabot - Migrate librefang-acp to agent-client-protocol 1.3.0 supersedes 6526 6534 @houko Install / Upgrade Links