Changelog

1.4.0

Core and tools

• The bash tool set was redesigned: a background-command tool set lets an agent start, wait for, kill and inspect long-running commands; output is split into log files and results carry the elapsed time.
• Command risk assessment was redesigned: verdicts are made per structural element of the command line, dangerous patterns are rejected outright instead of entering confirmation; a rejection reason can be supplied during confirmation and is passed back to the agent, and verdicts carry a brief rationale.
• The default command allowlist was tightened: risky commands such as curl / wget / sed were removed and now go through risk assessment and confirmation.
• apply_patch was rewritten on top of git apply: consistent behaviour across platforms and clearer error output (requires Git to be installed).
• Sub-agents support background execution: agent_run_parallel was replaced by an asynchronous agent interface, so several sub-agents can be dispatched in parallel and their results collected on demand.
• Cancellation errors now carry the cancellation reason.

Extension system

• New xune command: an extension can declare its own CLI (cli=(parser, handler)) and run it directly via xune <name> ....
• Extensions can declare data_version; the framework provides a uniform, version-isolated data directory (ExtensionContext.data_dir).
• New completion_token_update hook: reports the token usage of every model call, including cache hits.
• New stat extension: records token and tool-call usage, registers a command that presents reports in the session, and manages reports plus per-user day/week/month budgets through xune stat.
• Bundled extensions declare the minimum core API version they need: MCP ≥ 1.3.0, Skills / stat ≥ 1.4.0.

API changes

• Agent.state became the typed container AgentState: persistent and runtime entries are distinguished, and retrieval now goes through get_entry(key, factory).
• Lifecycle type annotations moved into agent_lifecycle.py.
• cancellable_execution() was renamed to run_scope().
• set_persistent_section was renamed to set_system_persistent_section.
• to_json / from_json now use structured JSON as their interface; the ToJson / FromJson protocols are exported.
• The default event buffer capacity became 0 (the consumer sets it), and the setter is the chainable with_buffer_size().
• The sub-agent tool set was redesigned: agent_run_parallel was replaced by the asynchronous agent interface.

CLI and containers

• Interactive CLI display styling improved; file-related commands are registered uniformly on every interactive entrypoint.
• Fixed argument forwarding from xunc into the container.
• New xunx shell <user>: enter a user container's shell, with --exec / --cwd to choose the program and working directory.

Web service and frontend

• Agent join / leave events only show a preview in the last batch; the auto-confirm marker is merged into the active batch display.

1.3.0

Extension system

• New MCP extension: acts as an MCP client connecting to servers (stdio supported) and exposes their tools as xun tools.
• New Skills extension: supports Agent Skills packages, discovers them automatically and injects a compact catalogue that is activated on demand, keeping the catalogue and tools in sync.
• New extension setting extension_settings: bucketed per extension name, read by extensions through ExtensionContext.settings.
• The toolbox supports disabled-state queries, pop removal and registration of native functions, which is what MCP and similar extensions need.

Core and tools

• Session messages were refactored into typed message classes, with system prompt, user message and raw message each having its own type.
• Structured output became a soft constraint: response_format is no longer forced when tools are registered, so tool calls are not skipped.
• Retries and backoff for completion requests were strengthened; a new user instruction regains the backoff window.
• The risk-assessment sub-agent has iteration and tool-call budgets (at most 3 tool calls).
• New sleep tool; browser's evaluate supports a timeout.
• New /handoff command: packages the current task into a zip handoff bundle.
• /config can edit configuration, /revise accepts new content, /compact parsing improved, /render validates paths and is lenient about suffixes.
• The write-file built-in commands were split out of the default commands and are registered only on interactive entrypoints.

CLI

• The command line moved to prompt_toolkit: history search, / slash-command and @file completion; confirmation prompts can interrupt the current input and restore it verbatim.
• Fixed garbled output under multithreading.

Configuration and prompts

• AGENTS.md is loaded as its own system prompt section, with a new load_project_instructions switch.

Web service and frontend

• HTML / Markdown previews: relative image paths, multi-file HTML, and default previews for renderable files.
• Previews can edit and create text files; nested directories can be created.
• The settings menu shows the build version and commit.
• The display layer was refactored: the event store is separate, events and rendering are decoupled; medium-width layout controls, table column widths, prompt cards and the spectrum animation were polished.

Containers and multi-user

• The user name is passed to user containers as an environment variable at startup.

1.2.1

Web service and frontend

• New agent running-state display events, so the frontend can show exactly when an agent starts and stops running.
• Fixed the active preview flickering on update; the working-status icon still shows on narrow screens.
• A coloured spectrum line was added to the footer.

1.2.0

Extension system

• Extension status and display events: /extensions shows loading state, initialization errors are raised and presented clearly instead of a silent warning.
• Version compatibility gate: @extension_attr declares the supported version range; extensions outside it are marked skipped and not loaded.
• New xun_version() to query the running version.

Core and hooks

• Execution hooks can take over a run: setting takeover_result returns the result straight from the hook handler, skipping the execution step and not writing to session history.
• New html info event, rendered as rich text on the web.
• Images returned by tools are measured automatically and downscaled when too large; image URLs are downloaded before being uploaded.
• request_image gained a crop parameter.
• Tool call arguments tolerate a list passed as a string.
• Default maximum iterations 256 → 512.

Web service and frontend

• Sessions can be renamed.
• The event stream was reworked: messages show independently of turns, better collapsing, auto-expand for a single agent, running summary cards and active previews.
• Static hosting may now serve the workspace root directly.
• The slash-command cache refreshes with the session.

1.1.1

Containers and multi-user

• Fixed the workspace not matching the directory mounted with xunc <dir>.
• New xunx pause <user> / xunx resume <user>: pause or resume a user's container without discarding its state.
• Fixed tokens starting with - being parsed as options by xuns; container startup now passes --token=<token>.

Web service and frontend

• WebSocket sending was optimised: messages and commands carry a client_id, the input box and attachments clear only after the server's accepted acknowledgement, pending messages are resent after a reconnect, and the server deduplicates by client_id to avoid double execution.
• File sizes are shown with magnitude units (B / KiB / MiB ...).
• xuns supports --no-initial-agent, so the documentation can be browsed without configuring an LLM.

Extension system

• The Loaded extensions: notice is no longer printed at startup.

1.1.0

Extension system (new)

• Source files under $XUN_HOME/extensions/ load automatically on every agent initialization, in package form {name}/setup_extension.py or flat form {name}.py; the entry point is setup_extension(ctx).
• Import or initialization failures only warn and never block startup; the enable_extensions setting can turn extensions off.
• New display hooks before_display_info / before_display_warning / before_display_error intercept agent output; new /extensions command plus examples in the repository.

Core and tools

• Compaction is graded: old tool results are reclaimed first, only a still-oversized session is turned into a summary, and a session that remains oversized can be compacted again; summary text no longer mixes into info messages.
• The cancel event became a chained structure, so cancelling a parent agent cascades to its children; cancellation is honoured while the web UI waits for input.
• Lifecycle states were split into agent_state.py; display methods moved into AgentDisplayMixin and are covered by the type-state constraints.
• The sub-agent getter parameter became the dataclass AgentGetterParam.
• The shell tool was renamed to bash; copy onto an existing destination now requires confirmation.
• get_choice / get_confirm return a ChoiceOutcome (choice + source); auto-confirmation no longer writes to the command and path allowlists.
• Fixed tool call arguments drifting from history after JSON repair.

Configuration and prompts

• auto_confirm supports the XUN_AUTO_CONFIRM environment variable.
• The system prompt requires inspecting and following AGENTS.md in the working directory.

Web service and frontend

• File browsing: PDF and fullscreen previews, syntax highlighting and inline editing in the text preview; list and details split for faster scanning; panels are mutually exclusive on narrow screens.
• Uploads accept whole directories, the result notification lists every file and disappears automatically.
• New static directory hosting at /srv/, serving sites that live in the workspace (expires after 1 hour by default).
• Event list loading and transfer optimised; input content persists across sessions; interface copy in Chinese and English.

Containers and multi-user

• On container startup, the host xun home is copied into /.xun (only config.json and extensions).
• xunc --env / xunx serve --env support NAME=VALUE assignment and wildcard forwarding of host variables.
• xunx containers persist: serve re-adopts existing containers and keeps sessions after a restart, and containers of deleted users are cleaned up during reconciliation.
• New xunx upgrade, which the running serve turns into a container rebuild on its next reconciliation.

Documentation

• Added bilingual Chinese / English documentation (MkDocs); the web service exposes it at /docs without login.

1.0 — 2026-09-15

First release: the execution loop and structured output, functions-as-tools with 8 built-in tool sets, the display layer (console / web / null) and web frontend, sub-agent generation and session compaction, session commands and policy confirmations, the xun / xuns / xunc entrypoints and the xunx multi-user service.