本次发布提供 CLI、Runtime Host、Docker Compose 和 Kubernetes 安装包。组件镜像版本均为 2.1.0-BETA1，镜像仓库为 sca-registry.cn-hangzhou.cr.aliyuncs.com/agentscope。

下载后先核对文件的 SHA-256，再解压。Linux 使用 sha256sum，macOS 使用 shasum -a 256。如果下载了全部附件，可执行 sha256sum -c SHA256SUMS 或 shasum -a 256 -c SHA256SUMS。

根据机器选择 linux / darwin 和 amd64 / arm64。例如 macOS Apple Silicon：

mkdir -p agentscope-cli "$HOME/.local/bin"
tar -xzf agentscope-cli-2.1.0-BETA1-darwin-arm64.tar.gz -C agentscope-cli
install -m 0755 agentscope-cli/as agentscope-cli/agentscope-runtime-host "$HOME/.local/bin/"
export PATH="$HOME/.local/bin:$PATH"
as version
agentscope-runtime-host -help
as connect https://YOUR-SERVICE
as runtime status

将 PATH 配置写入 shell 配置文件。接入前另行安装并登录至少一个 Coding Agent provider；as connect 会提示登录或 enrollment 并启动 Runtime Host。as install 当前为占位命令，部署平台请使用下面的安装包。

tar -xzf agentscope-service-2.1.0-BETA1-compose.tar.gz
cd agentscope-service
./init-env.sh 2.1.0-BETA1 sca-registry.cn-hangzhou.cr.aliyuncs.com/agentscope
docker compose pull
docker compose up -d --wait --wait-timeout 600

打开 http://localhost:18080，使用本地 .env 中的初始管理员密码登录 admin。保留 .env 和数据库、Workspace、Artifact 卷作为备份。模型凭据、执行环境和第三方 Coding Agent 由用户配置。

tar -xzf agentscope-service-2.1.0-BETA1-kubernetes.tar.gz
cd agentscope-service-kubernetes

按包内 README 准备外部 PostgreSQL（cp、rt、dp schema）、Workspace RWX 存储、Artifact RWO 存储，并填写私有 Secret 配置。随后安装：

helm upgrade --install service ./agentscope-service-2.1.0-BETA1.tgz \
  --namespace agentscope \
  --set imageRepository=sca-registry.cn-hangzhou.cr.aliyuncs.com/agentscope \
  --set existingSecret=agentscope-service --wait --timeout 10m

Chart 采用每组件单副本与 Recreate 更新，并以 standalone HTTP 模式运行。数据库、存储 provisioner、入口 TLS 和模型凭据需要用户准备；升级前备份数据库、文件及原 Vault 密钥。本版本不承诺 HA 或数据库无停机升级。此 Chart 不提供 Kubernetes-native 控制器或 ASDP gRPC。

Maven/npm SDK 独立发布，PyPI 待发布工作流合入默认分支后运行。本次安装包使用独立的 agentscope-service-dist-v2.1.0-BETA1 tag。Homebrew tap 和 Helm OCI 尚未配置，本次可通过 GitHub 附件直接下载安装。

安装包从干净且已提交的 release 分支源码构建。现有 ACR 镜像来自此前验证过、与 7b606902 内容一致的源码快照；镜像既有 revision 标记保持不变，详细记录见 images.json。本次复用这些镜像。

This prerelease ships paired CLI/Runtime Host archives for Linux/macOS amd64/arm64, a Compose bundle, a Kubernetes bundle with the Chart and configuration/schema templates, and the standalone Helm Chart. Verify SHA-256 before extraction. Each bundle includes installation instructions. Images are available from sca-registry.cn-hangzhou.cr.aliyuncs.com/agentscope at tag 2.1.0-BETA1; immutable digests and validation scope are attached.

Install both CLI executables together on PATH, install and authenticate a supported coding provider separately, then run as connect SERVICE_URL. Compose includes PostgreSQL; Kubernetes requires external PostgreSQL, shared RWX Workspaces, RWO Artifacts and configuration Secrets. The Chart uses one replica per component and Recreate updates in standalone HTTP mode. Model credentials and infrastructure are user supplied. Homebrew and Helm OCI distribution are not yet configured.

AgentScope Java 2.0.4 adds OpenAI Responses API support, a redesigned AgentScope Service, new channel and storage integrations, and stronger isolation for concurrent agent runs, tools, and skills.

Core / Models

• Add the OpenAI Responses API module (#3078).
• Support returnDirect tool results to short-circuit the reasoning loop (#2891).
• Expose detailed chat usage token metrics and model-fallback failover listeners (#3215, #3145).
• Support Anthropic bearer token authentication (#3038).
• Add a type-safe Jev System One client, Spring Boot starter, and example middlewares (#3240).

Harness / Tools / Storage

• Add per-run execution control with AgentRun / RunControl and explicit runtime context propagation (#3279).
• Add request-scoped tool configuration and isolate tool visibility, streaming callbacks, and session skill resources (#3283).
• Add opt-in sharedLocalWorkspace to filesystem specs (#3247).
• Allow disabling built-in web tools and injecting an HTTP client into them (#3075, #3103).
• Add configurable MCP metadata propagation per server and tool (#3255).
• Add MongoDB storage extension (#2698).
• Automatically prune old E2B native snapshots per sandbox (#2555).

Service / Channels

• Introduce the redesigned AgentScope Service implementation (#3080).
• Add Personal Weixin iLink channel integration (#3184).
• Add DingTalk HTTP callback receive mode alongside Stream mode (#3177).
• Add pluggable channel access-token storage and inbound-event deduplication, with idle eviction for bot-loop guards (#3182, #3175).
• Expose inbound channel media messages as neutral metadata (#3180).

• Remove the unused message role parameter (#3045).
• Pass Gemini tool parameter schemas directly as native JSON Schema (#3051).
• Derive Version.VERSION from the Maven project version (#3087).
• Migrate the documentation site to Mintlify while preserving legacy URLs and restoring hosted language switching (#3081, #3082, #3276).

Core / State / Concurrency

• Isolate concurrent invocation contexts and cancellation of individual running or queued executions (#3279); prevent cross-session tool and skill interference (#3283).
• Fix version-0 state migration CAS conflicts, atomically return JDBC unconditional-write versions, and cache versions after unconditional writes (#3165, #3220, #3236).
• Evict slot versions with the state cache, avoid deserializing the State marker interface, and persist state after empty agent results (#3074, #3048, #3049).
• Preserve failed summary termination state and handle synchronous model-fallback failures (#2757, #3149).
• Emit tool-result events for denied HITL calls and support custom denial reasons (#3104, #2546).
• Make JSON Schema generation thread-safe (#2796).

Model Providers

• Default plaintext HTTP requests to HTTP/1.1 to prevent h2c upgrades from losing POST bodies with vLLM / uvicorn (#3214).
• Preserve reasoning details from all streaming chunks and thought signatures across JSON persistence round-trips; remove redundant OpenAI tool metadata (#3128, #2910, #2914).
• Move cache control to content blocks (#2878).
• Decouple DashScope streaming from thinking mode, allow custom multimodal endpoint detection, and offload blocking embedding SDK calls (#3137, #3163, #3265).
• Correct Gemini token usage accounting (#3034).
• Serialize Ollama tool-result names as tool_name and expose thinking output as ThinkingBlock (#3093, #3146).

Harness / Sandbox / Integrations

• Preserve non-UTF-8 file uploads and expose session workspace paths in prompts (#2456, #3020).
• Rebind Kubernetes remote snapshots on state resume and preserve wrapping newlines in commands (#3025, #3204).
• Improve Docker sandbox native file transfer and reject truncated downloads (#2923).
• Keep MCP connections open for AgentRun sandboxes that are not owned by the caller; preserve image URLs in MCP tool results (#2302, #3053).
• Allow path separators in JDBC sandbox-shaped slot IDs (#3233).
• Preserve AG-UI tool results after permission resume, assign unique IDs to discontinuous text segments, and clear active-run markers before terminal signals (#3100, #3010, #3109).
• Propagate WeCom send rejections as stream errors (#3173).
• Use modular core and AG-UI dependencies in Spring Boot starters (#3156).
• Normalize Milvus L2 retrieval scores and escape WordReader Markdown table cells (#3070, #3169).

• Add bilingual Agent Harness building guides and rebuild AgentScope Service product guides (#3139, #3136).
• Document Jev structured decision integration and correct the documented CompactionConfig.keepTokens default (#3274, #3144).

Full changelog: v2.0.3...v2.0.4

This release introduces Anthropic prompt caching, a deliver_artifact tool for sandboxed agents, a FinalAnswerFilterMiddleware for ReAct streams, state versioning and optimistic concurrency primitives for agent state stores, an AgentProtocolEventBus for pluggable SSE event handling, and a console transcript overhaul, and includes a broad set of reliability fixes across the core reasoning loop, harness, sandbox, and AG-UI protocol layers.

Quick links: Quickstart | V1 Migration Guide | Going to Production

Core / Agent

• Propagate ToolResultBlock.metadata through fine-grained v2 tool-result events (ToolResultTextDeltaEvent / ToolResultDataDeltaEvent / ToolResultEndEvent) so event-stream consumers can access tool-specific context (#2315)
• Introduce AgentProtocolEventBus for pluggable SSE event handling in the agent-protocol layer (#2634)
• State versioning and optimistic concurrency primitives — VersionedState, ConflictPolicy, and ConcurrentSessionModificationException — enabling AgentStateStore implementations to detect and reject stale writes

Middleware

• FinalAnswerFilterMiddleware — an opt-in filter that buffers text events per model call, suppresses intermediate reasoning-round text when a tool call is produced, and emits only the final user-facing answer (#2926, #2872)

Model Providers

• Anthropic prompt caching: set cache_control breakpoints on tools, system, and the last message; surface cache_read_input_tokens and cache_creation_input_tokens in usage (#2350, #2223)
• Anthropic + Gemini ResponseParser read cachedTokens into usage (#2568)
• Explicit no-cache semantics: CACHE_CONTROL=false metadata maps to {"type":"no_cache"} for OpenAI and DashScope converters, so a single message can opt out of caching (#2685, #2684)

Harness / Tools

• deliver_artifact tool for sandboxed agents — an ArtifactDeliveryTarget SPI + tool that lets an agent inside a sandbox hand out produced files; the workspace prompt now references it when a target is configured, and states plainly that no cross-boundary mechanism exists otherwise (#2667, #2663)
• MCP server registration results — an optional McpServerRegistrationListener with SUCCESS / FAILED / SKIPPED terminal states, so host services can identify and retire unhealthy MCP configurations (#2877, #2875)
• description field on SubagentFactoryEntry so the orchestrator gets useful subagent selection context instead of a bare name (#1506, #1504)
• Public Toolkit API to assign an already-registered tool to an additional group (#2836, #2835)
• Stream ranged file reads in ReadFileTool — positive line ranges are read incrementally and stop at the requested end line, avoiding loading the full file into memory (#2402)

AG-UI

• CopilotKit + AG-UI full-stack example covering threads, shared state, generative UI, A2UI workbench, and HITL flows end-to-end (#2554)
• Configure agent interruption on AG-UI disconnect (#2719, #2715)

Console

• Transcript overhaul — one bubble per user question, with text and tool calls rendered as ordered content blocks in chronological order; react-markdown rendering, syntax-highlighted tool I/O cards, SSE auto-reconnect with exponential backoff, and session.error rendering (#2640)

Examples

• User binding preferences CRUD API for the DataAgent example (#2711)
• v2 application-layer RAG example (#2794)

• Move AguiRuntimeContextRequest / AguiRuntimeContextResolver / AguiRequestBodyParser down from the example layer into the extensions-agui protocol layer (#2822)
• Replace the Java service control plane with the Go aistiod control plane, keeping the Java gateway, data, and scheduler planes; the agentscope-builder example is promoted to the top-level agentscope-service module
• Isolate HITL sessions by user — key ThreadSessionManager / AgentResolver by (userId, threadId) so hasMemory and agent reuse no longer mix tenants, and unwrap harness/stop interrupts via AguiUtil.asReActAgent so demo stopThread and processor interrupts target the live session (#2856, #2855)

Core / Agent

• Propagate ChatResponse.metadata to Msg.metadata in ReasoningContext (#2931)
• Propagate agent state load failures instead of silently replacing conversation state with a fresh session on backend / I/O / decoding errors (#2760)
• Preserve caller-supplied permission context when loading legacy v1 session state, so 1.x → 2.0 migration does not silently downgrade to DEFAULT permission mode (#2769, #2768)
• Retry empty final responses instead of finishing silently when a reasoning model emits its answer into reasoning_content with empty content (#2755, #2750)
• Persist the current turn's user input and safe context on model call failure so a resumed session can see the last question (#2799)
• Reconcile dangling tool_use blocks on interrupt before persisting AgentState, fixing a window between reasoning and acting where pending tool calls were left unmatched (#2410, #2409)
• Return suspended results for external tools instead of converting them to generic errors; emit RequireExternalExecutionEvent for suspended tool calls (#1668, #1582)
• Emit ExternalExecutionResultEvent when external tool results resume (#2605)
• Restore event emitter for detached tool calls (#2483)
• Include field path in tool validation error messages (#2718)
• Simplify ReActAgent pending tool and error result handling (#2666)
• Normalize model-call tools in middleware to avoid duplicate or malformed tool definitions (#2756)
• Avoid event-loop blocking in WorkspaceContextMiddleware#onSystemPrompt (#2632)
• Use call-scoped AgentState for ReActAgent shutdown retry recovery so the shutdownInterrupted flag is checked and cleared against the per-session state for the current (userId, sessionId) call, instead of the default session state (#2712, #2708)

Model Providers

• Gemini: apply ModelUtils.applyTimeoutAndRetry to response streams so configured timeout and retry settings take effect (#2356)
• RAGFlow: preserve final retry response body so callers can read error details (#2631)
• RAGFlow: type rerankId as String to match the RAGFlow API (#2776)

Harness / Tools / Sandbox

• Stop skill-cache orphan GC from deleting live directories (#2840, #2787)
• Make Nacos skill source paths Windows-safe (#2921)
• Make memory flush fire-and-forget to unblock conversation completion; add HarnessBackgroundTaskQuiescenceExtension so tests drain background flush before @TempDir teardown (#2777, #2935)
• Handle SIGTERM in Docker keep-alive to avoid 30s stop delay (#2885)
• Bound filesystem search tool output size (#2832)
• Isolate sandbox binding per call to fix concurrent corruption (#2675)
• Make concurrent sandbox uploads safe — unique hydrate temp names and native transfer for relative paths (#2762)
• Fix Windows Docker sandbox session file upload via tar stream (#2557)
• E2B: preserve zero exit code in JSON stream (#2609); reject incomplete process streams without exit code (#2828); reset projection state when recreating sandbox (#2586)
• Kubernetes sandbox: bump fabric8 to 7.8.0 to fix watch NPE with Jackson 2.19+ (#2766); follow redirects so file API downloads survive gateway 307 (#2748)
• Keep persisted snapshot id when resume falls back to fresh create (#2775)
• Add reply IDs to subagent lifecycle events (#2680)
• Inherit memory config in subagents (#2611)
• Make orphan sweep timeout boundary inclusive (#2619)
• Do not downgrade a user-interrupted session to a compaction failure (#2659)

AG-UI

• Assign per-tool result message ids (#2908)
• Emit frontend tool args from fragment deltas (#2874)
• Isolate HITL sessions by user (#2856)
• Emit AG-UI interrupt for permission-type HITL tool confirmation (#2495, #2437)
• Parse request bodies with Jackson 2 codec for Boot 4 / multimodal MessageContent (#2638)
• Suppress ReActAgent handshake events in AG-UI converters (#2639)
• Stop emitting RUN_FINISHED after RUN_ERROR by default (#2646)
• Cancel MVC subscription on disconnect (#2786)

Protocol

• Clear task submit context before publishing terminal status to close an await race in AgentProtocolTaskStore (#2802)

Storage

• MySQL: remove path-separator check from MysqlAgentStateStore session id validation (#2022)

Console / Frontend

• Allow owners to edit agent settings and add model field (#2630)
• Render session.error events in managed session chat (#2598, #2596)
• Add cache-control headers to console static serving (#2607)

• feat(agent-protocol): route tasks through AgentFactory by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2590
• feat(harness): RuntimeContext force-sync for agent_spawn by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2592
• feat(harness): stamp parentSessionId on remote subagent events by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2593
• feat(agent-protocol): pass caller context attributes into task runs by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2595
• feat(channel): allow callers to pass RuntimeContext into Gateway by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2604
• feat(harness): forward the full remote subagent event stream by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2613
• feat(agent-protocol): decouple TaskStore from execution WorkspaceManager by @chickenlj in https://github.com/agentscope-ai/agentscope-java/pull/2615

AgentScope Java 2.0.1 is the first maintenance release after 2.0.0 GA. It expands the model-provider ecosystem, hardens Harness subagent / HITL / permission behavior, and fixes a set of production-critical issues. Quick links: Quickstart | V1 Migration Guide | Going to Production

Core / Agent

• Middleware execution ordering via MiddlewareBase.order() (higher values wrap outer); ReActAgent.Builder.build() stably sorts descending after all registrations (#2532, #2449)
• Session context clear API on ReActAgent / HarnessAgent to clear model-visible conversation context without creating a new session (#2499, #2496)
• Expose ReActAgent state-cache cleanup APIs for long-lived instances (#2572)
• Emit UserConfirmResultEvent when resuming permission HITL, correlatable with the prior RequireUserConfirmEvent via replyId (#2511)
• Anthropic: support configuring disable_parallel_tool_use (#2257)

Model Providers

• Add OpenAI-compatible extension package as a shared base for third-party compatible vendors (#2208)
• Add DeepSeek as a first-class model provider (deepseek:<model>, DEEPSEEK_API_KEY) (#2307, #2211)
• Add GLM (Zhipu AI) provider and dedicated formatters (#2316)
• Add Kimi (Moonshot AI) provider and dedicated formatters (#2320, #2213)
• Add MiniMax OpenAI-compatible provider (#2299)

Harness / Tools

• Remote subagent event streaming and HITL resume (#2559)
• Wait for async tool results by taskId (#2529)
• Default workspace via AGENTSCOPE_WORKSPACE env var for image packaging (#2310)

AG-UI

• Upgrade AG-UI module event mechanism (#2306, #2202)
• Introduce typed MessageContent / InputContent for multimodal AG-UI messages (#2518, #551)

Spring Boot Starters

• Add Ollama Spring Boot Starter (#2176, #2172)

• Change Toolkit default execution mode to parallel and improve related docs (#2558, follow-up of #2529)
• Abstract session metadata storage to decouple builders from concrete store implementations (#2258, #2068)
• Rebase Kubernetes sandbox store on agent-sandbox CRDs / controllers, with the cluster owning sandbox lifecycle and warm pools (#2308)

Core / Agent

• Prevent pending recovery from consuming HITL approvals (#2109, #2534)
• Apply transformed onModelCall text deltas to the final message so native structured-output parsing does not see stale text (#2469, #2385)
• Repair null streaming tool args from complete raw JSON (#2451, #768)
• Unbind state-saver on ReActAgent.close() to prevent graceful-shutdown registry growth / OOM (#2322, #2321)
• Unbind ShutdownStateSaver on ReActAgent.close() to fix a memory leak (#2384)
• Mark user interrupts with interrupted reason (#2260)
• Handle malformed Unicode when writing agent state files (UnmappableCharacterException) (#2255, #2204)
• Forward reasoning middleware events (e.g. InboxMiddleware HintBlockEvent) to streamEvents() (#2179, #2160)
• Mark ToolResultBlock.error as a structured error (#2174, #2157, #2111)

Model Providers

• DashScope: route qwen3.8-max to the multimodal endpoint (#2553)
• DashScope: preserve SSE error response body so callers can read request_id (#2278, #2197)
• OpenAI: wrap streaming branch in Flux.defer so retries re-issue HTTP requests (#2079)
• OpenAI: terminate stream on [DONE] sentinel (#2104)
• OpenAI: drop non-chunk summary event messages to avoid content duplication (#2367)
• OpenAI: sanitize name field in OpenAIMessageConverter (#2346)
• OpenAI AutoConfiguration: make api-key optional (#2175)
• DeepSeek formatter: preserve system role (#2189, #2168)
• Ollama: honor stream flag in OllamaChatModel (#2415)
• Anthropic: map ToolChoice.None to disable tools (previously incorrectly forced tool use) (#2232, #2221)
• Model provider optimizations and compatibility tweaks (#2474)

Harness / Tools / Sandbox

• Stamp taskId on remote subagent forwarded events (#2575)
• Gate memory prompt guidance on disable flags (#2565)
• Emit subagent end before parent completion to avoid dropped events (#2544)
• Close subagent event stream when the parent is cancelled (#2481, #2480)
• Enforce parent DENY rules for spawned subagents (#2477)
• Preserve RuntimeContext during skill promotion (#2465)
• Enforce Plan Mode for subagents (#2377)
• Reject workspace path traversal (e.g. ../) (#2358)
• Support Windows local shell execution (working-directory commands and charset decoding) (#2304, #2268)
• Isolate static subagent registries by runtime context to prevent multi-tenant crosstalk (#2371, #2328)
• Retain prior summaries in chained compaction to preserve user intent (#2360)
• Preserve skill isolation and tool result history (#2319)
• RemoteFilesystem recursive glob matches files at the search root (#2343)
• Mark optional FilesystemTool params as required=false (#2227)
• Optimize shell-execute working_directory parameter and tool usage hints (#2107)
• Declared subagents inherit parent modelExecutionConfig / toolExecutionConfig (#2252)
• Correct sessionId parameter description (#2195)

Storage / Transport

• PostgreSQL BaseStore schema support (#2273, #2192)
• Fix PostgreSQL upsert SQL syntax error (#2167, #2166)
• Fix JdkHttpTransport SSE stream being cut by absolute timeouts (#1322, #1302)

AgentScope Java 2.0.0 is now Generally Available. This is the first production-ready release of the 2.0 line, marking a milestone in AgentScope Java's evolution into an enterprise-grade harness framework.

Quick links: Quickstart | V1 Migration Guide | Going to Production

AgentScope Java 2.0 is a systematic upgrade centered on one goal: enabling agents to reliably complete tasks. Here is an overview of its core design:

Dual-Layer Agent Architecture

• ReActAgent: A stateless reasoning core providing the "reason → tool call → respond" ReAct loop. In 2.0, agent instances are fully stateless — all per-call mutable state is propagated via Reactor Context, allowing a single instance to safely serve multiple (userId, sessionId) combinations concurrently
• HarnessAgent: Extends ReActAgent through Middleware and Toolkit channels, adding workspace, memory, sandbox, subagents, skills, and plan mode as engineering infrastructure — the core reasoning loop is preserved, only augmented

Message & Event Stream

A unified ContentBlock message model (TextBlock / DataBlock / ToolUseBlock / ToolResultBlock / HintBlock, etc.) paired with streamEvents() emitting 28 typed AgentEvent types, making agent execution observable, interactive, and interruptible. Front-end UIs can follow text deltas, tool calls, user confirmations, and other lifecycle events in real time

Permission System

A new PermissionEngine establishes a three-state decision mechanism for tool calls: allow / require user approval / deny. Decisions are based on static rules, tool type, and input content analysis. Sensitive operations automatically enter a HITL approval flow

Middleware Extension Mechanism

A five-stage onion + pipeline hybrid model (onAgent / onReasoning / onActing / onModelCall / onSystemPrompt), providing flexible extension points for logging, tracing, security checks, business policies, and context injection while keeping the core framework stable

Context Engineering

Structured compaction preserves task objectives, current state, key findings, and next steps. Oversized tool results are automatically offloaded to disk with only placeholders in the context. File tools enforce a "read before edit" policy with built-in caching to reduce redundant IO

Workspace Abstraction

Decouples "what the agent does" from "where it executes." Local filesystem, Docker, Kubernetes, and E2B cloud sandbox backends are unified behind a single interface. A built-in warm-up pool supports parallel RL rollout scenarios

Model Fault Tolerance

A unified Credential + ModelRegistry abstraction covering Qwen / OpenAI / Anthropic / Gemini / DeepSeek / Ollama. Configurable max retries and fallback model — automatic failover when the primary model is unavailable

Enterprise Distributed Deployment

One-line DistributedBackend configuration (Redis / OSS / MySQL / PostgreSQL / COS). AgentStateStore auto-partitions by (userId, sessionId). Cross-replica session recovery, sandbox state snapshots, and subagent cross-replica routing

Protocol Interoperability

Built-in A2A (Agent-to-Agent) and MCP (Model Context Protocol) support, plus AG-UI protocol adaptation, covering standardized inter-agent communication and front-end rendering needs

Multi-Agent Orchestration

Declarative subagent specs (YAML / Markdown), runtime agent_spawn / agent_send with synchronous blocking and background delegation modes. Subagent event streams can be forwarded to the parent's streamEvents() in real time

Skill System

Four-layer skill composition (Classpath / FileSystem / Nacos / Marketplace) + SkillFilter fine-grained filtering + self-learning closed loop (propose → curate → promote)

The following are incremental changes between 2.0.0-RC5 (2026-07-07) and the GA release.

• Fire AllToolsDeniedEvent hook when HITL denies all tool calls, enabling application-level handling of full-denial scenarios (#2083)
• Add guardrails for wait_async_results to prevent repeated long blocking waits (#2093)
• Add PostgresDistributedStore for PostgreSQL-backed distributed HarnessAgent state (#2054)
• Add builder customizers for OpenAI, DashScope, and Anthropic models in Spring Boot starters (#2045)

Core / Agent

• Make seedSystemMsg reactive to avoid block() on NIO threads (#2086)
• Include ASKING ToolUseBlocks in PERMISSION_ASKING result message (#2082)
• Activate SkillToolGroup via activateOnSkill field (#2057)
• Save agent state on user interrupt to prevent session loss (#1970)

Model Providers

• Anthropic: split parallel tool calls into alternating messages to comply with API requirements (#2090)
• OpenAI: make nativeStructuredOutput configurable (#2069)

Harness / Tools / Sandbox

• External tool execution now correctly produces a suspended result (#2071)
• Allow SkillLoadTool in Plan Mode by promoting isReadOnly to the AgentTool interface (#2067)
• Interrupt orphan subagents when AgentSpawnTool parent subscription cancels (#2064)
• Remove unnecessary ReActAgent type restriction in MemoryFlushMiddleware (#2078)
• Resolve leading / paths relative to workspace in ROOTED mode (#2049)
• Pre-stage marketplace skills before workspace projection (#2059)
• Treat null exit code as success in Kubernetes hydrateWithArchive (#1915)
• Use updated WorkspaceSpec when resuming from persisted state (#1928)
• Support nested JSON and banner prefix in AgentRun MCP response (#1930)
• Use resolved workingDir for Docker workspaceRoot (#2033)

Channel

• Include PeerKind in OutboundAddress to fix group message routing (#2060)

A2A

• Merge streaming text chunks to avoid fragmentation (#2058)

This release completes the model-provider modularization (all providers extracted from agentscope-core into independent agentscope-extensions-model-* modules), adds unified multimodal DataBlock support across all providers, introduces native structured output for tool calls, and includes 30+ bug fixes spanning agent lifecycle, sandbox, tracing, A2A, and subagent propagation.

• Model provider modularization: OpenAI, Gemini, Anthropic, DashScope, and Ollama model providers have been moved from agentscope-core into separate agentscope-extensions-model-* extension modules. Applications must add the corresponding extension dependency. (#1890, #1916, #1947, #1972)

• Unified DataBlock support in all provider message converters (OpenAI, DashScope, Gemini, Anthropic), covering single-agent, multi-agent, and tool-result paths (#1933)
• Native structured output handling with tools — models that support structured output can now enforce JSON schema constraints alongside tool calls (#1904)
• Native structured output support for DashScope models (#1935)
• httpRequestCustomizer support in McpClientBuilder for dynamic token injection (e.g. OAuth refresh) (#1992)
• Align AguiEvent with the AG-UI protocol spec — add missing event types (#1862)
• Optional skill allowlist filter for subagents (#1873)
• knownSkillNames support in NacosSkillRepository (#1853)
• CosAgentStateStore, CosBaseStore and CosDistributedStore for Tencent Cloud COS-backed state persistence (#1857)
• Expose cached prompt tokens in ChatUsage (#1868)

• Persist agent state on user interrupt recovery (#2008)
• Wire fallback model into ReActAgent (#1851)
• Fix ReActAgent stream event block end ordering (#1829)
• Update ToolResultBlock state before adding to agent context (#1886)
• Reuse classpath skill JAR file systems to avoid resource leaks (#1981)
• Resolve serializeOnKey gate leak in Flux.create callbacks (#1796)

• Map thinkingBudget to OpenAI-compatible API request (#2028)
• Fix Anthropic stream thinking event handling (#1943)
• Preserve executionConfig in OllamaOptions fromOptions/toBuilder (#2011)
• Degrade forced tool choice in DashScope thinking mode (#1882)

• Restore remote snapshot state deserialization — re-inject RemoteSnapshotClient after Jackson round-trip (#2013)
• Fix THROTTLED memory save mode losing state when recreating instances per request (#1788)
• Propagate userId through wakeup dispatch (#2001)
• Run message bus heartbeat on boundedElastic instead of parallel scheduler (#1974)
• Avoid duplicating GracefulShutdownMiddleware in fromAgent (#1952)
• Escape spaces in skill paths returned by ShellPathPolicy (#2031)
• Fallback to simple key-value extraction when YAML parsing fails (#2027)
• Report sandbox file sizes in ls (#1838)
• Normalize Windows list_files paths (#1892)
• Normalize \r\n to \n for file content in LocalFilesystem.edit() (#2020)
• Treat "." as root equivalent in CompositeFilesystem (#1830)
• Validate working_directory to prevent namespace escape (#1834)
• Fall back to LocalFilesystemSpec when no distributed AgentStateStore is configured (#1841)
• Fix WebSocket race in Kubernetes hydrateWithArchive causing exit=null (#1903)
• Tolerate wrapped sandbox base64 downloads (#1866)
• Remove AgentRun sandbox API version prefix (#1891)
• Add connect JSON codec support for E2B sandbox (#1844)

• Fix orphan spans in OtelTracingMiddleware by reading parent OTel Context from Reactor ContextView (#1940)
• Fix child spans not seeing correct parent spans in OtelTracingMiddleware (#1909)
• Propagate Reactor context to chunk event hooks (#1923)

• Propagate parent RuntimeContext to child agents (#1833)
• Propagate parent middleware to subagents (#1843)

• Handle streaming backpressure (#1734)
• Preserve AgentScope message roles across A2A conversion (#1995)

• Propagate run input and frontend tools (#1895)

• Wrap doFlush in Mono.defer to prevent premature evaluation (#1880)

• Nacos auto-configurations should be opt-in (matchIfMissing=false) and fix A2A server-addr override (#1709)
• Add ObjectMapper bean for MarketContributionService in DataAgent (#1993)

• Clarify stream event blockId semantics (#2016)
• Improve model provider documentation (#1986)
• Remove invalid ChatResponse.isLast references (#1921)
• Fix multi-replica Redis example — declare jedis dependency and add stateStore (#1869)
• Fix MemoryCompactionExample to show memory files and fire compaction (#1978)

This release introduces async tool execution and notification support for the agent harness, adds a persistent spawn registry for subagent session recovery, and includes some critical bugfixes.

• Agent harness now supports async tool execution and notifications, including message bus, async tool registry, and scheduled wakeup dispatching (#1802)
• Added String/Message convenience overloads for agent calls; all formatters now support HintBlock (#1802)
• Persistent spawn registry in tool context state enables subagent cross-replica routing and session recovery (#1817)
• DynamicSkillMiddleware implements ToolkitAware to receive the resolved toolkit dynamically (#1828)
• Kubernetes sandbox now supports injecting environment variables into pods (#1789)

• Fixed SIGKILL race condition in Kubernetes file uploads by using two-phase archive strategy (#1826)
• Fixed resource leak where timed-out sub-agents were not interrupted on retry (#1784)
• Fixed typed attributes being lost when copying RuntimeContext (#1813)
• Fixed JdbcStore table initialization failure under MySQL utf8mb4 charset (#1781)
• Made session JSONL offload idempotent to prevent duplicate writes (#1774)
• Fixed OpenTelemetry context propagation in TelemetryTracer (#1799)
• Fixed NPE in OllamaChatModel when options are null during tool choice retrieval (#1803)
• Added missing Jackson annotations to LocalSandboxSnapshot for proper serialization (#1825)
• Fixed sandbox glob not supporting **/ recursive patterns (#1684)
• Fixed SkillFilter matching using composite ID instead of skill name (#1771)
• Allow custom default vision model in MultiModalTool (#1701)

• Fixed incorrect hook signatures in middleware docs (#1835)
• Fixed references to non-existent .sandboxContext() in doc examples (#1792)
• Fixed getToolName() → getToolCallName() in v2 docs (#1760)
• Added AI context menu to documentation site

Please check the documentation for more details.

• Agent result event — a new event is emitted with the final result immediately before agent-end, so streamEvents() consumers can obtain the result directly from the event stream
• Custom events — generic extensible event type for middleware to push application-level notifications (state changes, team updates, etc.) to front-end subscribers without modifying the core event enum
• Hint block events — one-shot event for delivering complete content such as team messages, background tool results, and user interruptions
• Workspace path normalizer — file paths are now automatically normalized to workspace-relative form based on the active filesystem mode, preventing cross-mode prefix collisions
• Tool name on all tool events — tool call delta, end, and result events now carry the tool name directly, so consumers no longer need to cache the name mapping from the start event

• Unified call / stream core — call() and streamEvents() now share a single implementation, ensuring the middleware chain fires consistently on all invocation paths. Legacy standalone call logic has been removed
• Distributed state always fresh — when a state store is configured, agent state and permissions are reloaded from the store at the start of every call, preventing stale cache reads when sessions drift across machines
• Tool result eviction timing — eviction middleware moved to the correct lifecycle phase where tool results are already persisted, fixing a no-op issue in the previous phase
• Simplified file path resolution logic in local filesystem

Please check the documentation for more details.

• Qwen 3.7 model support — added support for Qwen 3.7 series models (e.g. qwen3.7-plus)
• Direct subagent messaging — send messages directly to a spawned subagent and receive its response without going through the parent agent's reasoning loop
• Subagent event stream forwarding — child agent intermediate events (text deltas, tool calls, etc.) are now forwarded in real time, each carrying a source path identifying the originating agent
• Event source tracking — all agent events now carry a source field to distinguish main vs. subagent events within the same stream, enabling consumer-side demuxing
• Custom model and prompt for Compaction / Memory — compaction and memory extraction now support dedicated lightweight models and custom prompts, independent of the agent's primary model
• Channel integration — new extension module family for IM platform integration (DingTalk, Feishu/Lark, WeCom, GitHub, GitLab), with a built-in ChatUI for an out-of-the-box conversational interface
• Unified distributed backend — new single-point configuration that consolidates all distributed storage components (state store, base store, sandbox snapshot) into one setup call. Built-in implementations for Redis, OSS, and MySQL
• Project-writable mode — when enabled, agent file writes are routed by path: workspace metadata goes to the workspace directory; everything else (code, configs) lands in the project directory. Designed for code-generation agents
• Runtime permission mode switching — dynamically adjust the permission mode per session at runtime
• Plan Mode improvements — improved plan file persistence and recovery, smoother tool-chain interaction, more robust approval flow
• Skill self-evolution enhancements — refined the propose → curate → promote closed loop, improved skill matching accuracy and cross-session reuse
• HTTP client timeout and retry policy adjustments
• Model resolution logic improvements
• Agent state records more running statuses

• Agent fully stateless — agents no longer hold mutable per-session state, a single agent instance can safely serve multiple concurrent sessions
• Unified state store — removed legacy session interfaces; unified on a new AgentStateStore abstraction with built-in in-memory, JSON file, Redis, and MySQL implementations, auto-partitioned by user and session
• Base store package renamed — base store interfaces for RemoteFilesystem moved to a new package; update your import paths accordingly
• Extension module coordinates refactored — several extension Maven coordinates have been reorganized by capability (e.g. agentscope-extensions-session-redis → agentscope-extensions-redis). Update <artifactId> in your POM
• Sandbox implementations extracted — concrete sandbox backends (Docker, Kubernetes, E2B, Daytona, AgentRun) moved from harness core into standalone extension modules. Add the corresponding extension explicitly if you need sandbox support

• Fixed permission state losing context during cross-session restoration
• Fixed agentscope-all missing 4 sandbox extension modules