OpenFang v0.3.0 is out! here's everything since v0.2.5:
- GPT-5 and o-series models now use max_completion_tokens with automatic retry detection
- web_fetch now supports POST/PUT/PATCH/DELETE with headers and body
- X-API-Key header support, auth middleware now accepts X-API-Key as fallback alongside Authorization: Bearer
- per-agent tool allowlist and blocklist with GET/PUT /api/agents/{id}/tools endpoints
- model switch now clears canonical session to prevent memory poisoning across providers
-
SOUL.md code blocks stripped before system prompt injection to prevent LLM copying raw code
- default_model hot-reloadable without restart, add catalog dropdowns
- Visual Builder SVG drag-drop rendering with manual createElementNS
- WebUI model switch button, clear history button, and tool filters panel added to agent detail modal
- Discord intents default changed from 33280 to 37376 to include DIRECT_MESSAGES
- ClawHub install now returns 429 instead of masking rate limits as 500, plus response caching to prevent 429s
- static assets (logo, favicon, agent.json) no longer return 401 when API key is set
- schedule POST now validates agent_id and rejects empty values instead of silently falling back
- cron create CLI sends proper nested schedule/action JSON structure with required name field
- provider_urls from config.toml now flow through to all LLM driver creation paths
- fix context_budget panic on out-of-bounds message/block indices with char boundary validation
- fix SSE streaming parsing to handle both "data: " and "data:" prefixes across all 3 LLM drivers
- fix FallbackDriver to switch model names when falling back across providers
- fix TOML spawn overrides so explicit model/provider in manifest is not replaced by config.toml defaults
- inject current date into agent system prompt so LLMs know today's date
- remove phantom gemini-3-flash model, point flash aliases to gemini-2.5-flash
- serde aliases for exec_policy mode, "allow"/"all"/"unrestricted" for Full, "restricted" for Allowlist, "none"/"disabled" for Deny
- fix Unicode byte offset panic in HTML to Markdown conversion
- fix dashboard hands status badge, all 4 status variants now show correct badge colors
- fix hand deactivation orphan agent cleanup
- improve shell_exec error messages, blocked commands now show current exec_policy mode and how to fix it
- fix Telegram 409 conflict on restart by calling deleteWebhook first
- workspace paths use agent name only instead of name-UUID format
- fix schedule runner single-turn, tools never called in cron/schedule agent turns
- fix schedule runner ignores per-agent model override
- add hand check-deps, install-deps, pause, and resume CLI commands
- change Discord allowed_guilds from Vec to Vec to handle large guild IDs without overflow
github.com/RightNow-AI/openf…