The AI Toolchain — issue 015, September 3, 2026

Adds scan_source_sinks command that sweeps an attached source tree for dangerous sinks — RCE/command injection, SQLi, SSRF, file I/O→LFI, template→SSTI, deserialization, open redirect — using the same curated patterns as code_search. Each hit is seeded into the shared ledger as a source-sink: data-flow hypothesis tagged with file:line, the first automated populator of Hypothesis.DataFlow; sink classes map to canonical vuln classes (cmdi→rce, fileio→lfi, template→ssti), with each sweep bounded to a maximum of 40 seeds and idempotent dedup by class + file:line. Seeded hypotheses feed into claim_next_hypothesis so specialists can trace a sink back to a reachable route on the live target; it degrades to a black-box fallback message when no source tree is configured, and discovery-only classes (secrets, auth, crypto) are deliberately excluded from seeding.

Adds scan_source_routes tool that extracts HTTP route declarations from source across Flask/FastAPI, Django, Express, Spring, Go routers, and Rails, seeding each as a hypothesis with a real, reachable path — including internal/admin routes a black-box crawler never reaches. Routes are correlated with dangerous sinks by handler-file co-location — a route whose file contains a sink is seeded class-typed (by worst sink class present) at higher confidence with a data-flow note (e.g. 'POST /admin/exec reaches an RCE sink') — while uncorrelated routes are seeded as idor authz/attack-surface leads; seeding is bounded to 40 hypotheses per sweep with idempotent dedup by vuln class and path, and degrades to a black-box fallback when no source is configured. This route↔sink correlation now also runs automatically at scan start (matching the behaviour already provided by uploaded OpenAPI/HAR context) — deterministic, bounded by per-sweep caps, idempotent via ledger dedup, and a no-op when no source is configured.

Adds probe_hypothesis tool that resolves a source-route hypothesis (or ingested/authenticated endpoint) against the scan target, issues a baseline HTTP request, and records the response as evidence — promoting confirmed routes to testing, flagging 401/403 responses as authz_matrix candidates, and marking 404/connection failures as blocked. It automatically uses the scan session's auth, honors the configured request-rate policy and cancellation, and refuses to probe the operator's own machine/listener via a self-scope check; it skips file:line source-location endpoints, does not follow redirects (treating a 3xx redirect to /login as a meaningful signal), and is disabled entirely in passive mode.

Adds -timeout flag to xalgorix-bench (and the bench.RunWithTimeout API) to bound each challenge scan with a configurable wall-clock limit, defaulting to 8 minutes; timeouts are marked on the scorecard while partial findings gathered before the deadline are still scored.

Adds SourceFiles source tree support to Challenge, letting the benchmark harness materialize a real source repo to a temp directory and wire it to a scan via SetSourceRepo for end-to-end whitebox testing. Ships the whitebox-cmdi challenge — an app with a command-injectable route unreachable by black-box crawling — requiring the full bridge (scan_source_sinks, scan_source_routes, probe_hypothesis, and auto-seeding) to discover the hidden route, identify the os.popen sink, probe it live, and achieve RCE class exploitation.

Adds four new challenge classes to xalgorix-bench: SSRF (cloud-metadata-like secret returned from an internal fetch), SSTI ({{7*7}} evaluates to 49), LFI/path traversal (../../etc/passwd returns passwd-like content), and command injection (a shell metacharacter yields uid=0(root)).

Adds test_thread_id and session_id parameters to POST /runs/rules/validate so a multi-turn thread evaluator can be tested against a real conversation before it is saved, catching misconfiguration early.

$ curl -X POST 'https://<your-langsmith-host>/runs/rules/validate' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: <your-api-key>' \
  -d '{"test_thread_id": "<thread-uuid>", "session_id": "<session-uuid>"}'

Adds FF_BULK_EXPORT_DEFAULT_COMPRESSION environment variable to control bulk export compression on self-hosted deployments; self-hosted retains a gzip default while cloud deployments now default to zstd for improved performance.

$ export FF_BULK_EXPORT_DEFAULT_COMPRESSION=gzip

OpenTelemetry resource attributes set via OTEL_RESOURCE_ATTRIBUTES now appear on traces as metadata namespaced under otel.resource.*, letting teams attach details like user IDs without changing span emission.

$ export OTEL_RESOURCE_ATTRIBUTES="user.id=u_123,deployment.environment=production"

Adds a reorderable 'Splits (latest)' column to the experiment comparison view showing each example's current dataset split assignments as chips reflecting live membership; each split chip is now interactive with an 'Edit splits' action that opens the single-example split picker.

Opening a receipt inside agentacct tui shows its sessions and steps, the checks timeline behind the verdict, and files touched, plus a 'Needs attention' section for currently-failing checks, a / filter, status tabs on Work, an Evidence Sources pane, and a ? help overlay.

A task with open steps, nothing recorded as finished, and a newer session active elsewhere for 48h past that session's start is downgraded to an 'Inactive' state, computed from stored timestamps rather than the wall clock, with provenance marked inferred and kept out of the review queue.

Rebuilds agentacct tui into a four-tab (Dashboard / Work / Usage / Sources) keyboard-native terminal dashboard with light and dark themes mirroring the macOS app, and adds a T keybinding inside agentacct tui to toggle between light and dark themes.

$ agentacct tui

Adds DELETE /projects/{project_identifier}/traces API endpoint to programmatically delete traces for a given project, e.g. curl -X DELETE 'http://localhost:6006/projects/my-project/traces' to reset trace state between CI test runs.

$ curl -X DELETE 'http://localhost:6006/projects/my-project/traces'

targets[].timeout bounds a single physical attempt against a target, independent of the overall request_timeout; a timed-out attempt triggers failover, and an all-timeouts outcome returns 504 gateway_timeout.

targets:
  - virtual_key: openai-primary
    timeout: "10s"
  - virtual_key: openai-fallback
    timeout: "10s"
strategy:
  mode: failover

target_keys: [a, b] on conditions[] and content_conditions[] specifies an ordered failover chain per rule (target_key remains valid as the single-entry form). Four new conditional routing predicates were added: key: user, key: stream, key: has_tools (values "true"/"false"), and key: metadata with field: <entry>. The new X-Gateway-Metadata request header on /v1/chat/completions and /v1/completions carries a JSON object of up to 32 scalar values within 4 KiB, is never forwarded to providers, and is readable via the key: metadata predicate.

$ curl https://gateway.example.com/v1/chat/completions \
  -H 'Authorization: Bearer <key>' \
  -H 'X-Gateway-Metadata: {"tenant": "acme", "tier": "enterprise"}' \
  -d '{"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello"}]}'

strategy.sticky: { on: user, ttl: "1h" } under loadbalance and ab-test strategies pins each user field to the same target or A/B variant for a configurable TTL, using a stateless hash with no shared state.

strategy:
  mode: loadbalance
  sticky:
    on: user
    ttl: "1h"

cost-optimized scoring now covers input plus output cost for chat (using max_tokens / max_completion_tokens, defaulting to 256), per-token for embeddings, per-image, and per-minute or per-character for audio, replacing the previous chat-input-only formula; equal-cost targets break ties by targets[].weight.

Every routed surface (chat, streaming chat, legacy completions, embeddings, images, rerank, moderations, transcriptions, translations, speech) now returns X-Gateway-Provider, X-Gateway-Target, X-Gateway-Model, and X-Gateway-Attempts response headers, accessible to Go embedders via aigateway.WithRoutingAttribution. The ferro.routing.attempt span attribute, declared since v1.1.0 but never emitted, now actually fires on every routed request span with a count matching X-Gateway-Attempts.

strategy.failover_on_status_codes: [409] (or any operator-chosen status) extends the built-in failover-safe classes with provider-specific upstream codes; 400, 401, 403, 404, and 422 are refused.

aigateway.WithCatalog(models.Catalog) option on aigateway.New supplies a custom model catalog for cost-optimized routing and request pricing, replacing the embedded or remote catalog; usage is reported as source="supplied" in the gateway_catalog_loads_total metric.

Pool modes now fail over on context-window-exceeded errors from OpenAI-compatible (code: context_length_exceeded), Anthropic (prompt is too long), and Gemini (INVALID_ARGUMENT token-count) providers, unified under a single classifier, core.IsContextLengthError.

A target that returns 429 is now parked for its Retry-After duration (bounded to 1 minute; 5 seconds when absent), so subsequent requests skip it without paying another 429; park state is process-local.

least-latency samples are now keyed by target AND upstream model, expire after 5 minutes, and one request in ten probes a non-leader target; streaming samples measure time-to-first-chunk rather than full drain.

A conditional or content-based rule that names a single target now returns 503 when that target's circuit is open, rather than borrowing a healthy sibling as v1.5.1 did; add target_keys to name a stand-in explicitly.

Configuration loading now refuses an ab_variants[] entry without a label; a v1.5.1 config with an unlabelled variant will not load until a label is added.

Python SDK v0.36.0 adds eval instrumentation for Agno via auto_instrument(): AccuracyEval, AgentAsJudgeEval, ReliabilityEval, and PerformanceEval, plus eval suites, are now traced automatically, with suite runs opening a Braintrust experiment automatically.

from braintrust import auto_instrument
from braintrust.agno import AccuracyEval, ReliabilityEval

auto_instrument()

# Eval suite runs are now traced and open a Braintrust experiment automatically

The braintrustdata/eval-action GitHub Action (v2.1.0) adds report_scores and report_metrics inputs to filter PR comments down to only the scores and metrics specified, e.g. report_scores: 'accuracy, relevance' and report_metrics: 'latency, cost'.

- uses: braintrustdata/[email protected]
  with:
    report_scores: 'accuracy, relevance'
    report_metrics: 'latency, cost'

Log alerts, environment alerts, time window alerts, scheduled Loop jobs, and online scoring rules can now be paused and resumed instead of deleted, preserving their configuration across incidents or noisy deploys; each automation shows an 'Active' or 'Paused' status and last-run time.

The Blind human reviews project setting hides peer scores, comments, and aggregates from reviewers for the entire review session, preserving independence even after a reviewer submits their own scores; users with the project Update permission are exempt and always see all reviews. Enable it via Settings > Human Review in the project, then save.

Updates the tvm backend to use TVM's relax frontend exclusively, replacing relay; the pipeline is now passed as options={'pipeline': ...} to torch.compile(..., backend='tvm'). The relay path is removed along with its scheduler/trials options and the tvm_meta_schedule/tvm_auto_scheduler entry points, and the backend now requires TVM >= 0.20.

torch.cholesky() and Tensor.cholesky() are removed and now raise RuntimeError; use torch.linalg.cholesky() (and .mH for upper-triangular results) instead. torch.qr() and Tensor.qr() are also removed and now raise RuntimeError; use torch.linalg.qr(mode='reduced') or torch.linalg.qr(mode='complete') instead.

The use_cuda argument is removed from torch.profiler.profile and torch.autograd.profiler.profile; passing it now raises TypeError. Use activities=[..., ProfilerActivity.CUDA] for torch.profiler.profile or use_device='cuda' for torch.autograd.profiler.profile.

Adds native linear algebra to Apple Silicon (MPS): Jacobi-kernel SVD, eigh, QR, and Cholesky, plus a five-part reduction rewrite and further MPSGraph-to-Metal kernel migration.

Adds a new nccl2 backend for PyTorch Distributed, implementing the full collective contract with nonblocking communicators and eager communicator splitting.

Brings CuTeDSL-generated CUTLASS kernels to Inductor via NVGEMM, with epilogue fusion, scaled and NVFP4 GEMM, and grouped-reduction epilogues autotuned alongside Triton and ATen.

NCCL symmetric-memory pools no longer automatically upgrade late-allocated segments to symmetric windows after register_mem_pool(..., symm=True); pools must be collectively deregistered and re-registered after new allocations.

Introduces declarative dynamic shapes via @dynamic_spec, shared across torch.compile, torch.export, and make_fx.

Promotes fault tolerance to a first-class c10d concept: in-place process-group reconfiguration, one-sided RMA windows, and a Flight Recorder that now works for any backend, not only NCCL.

torch.nn.LinearCrossEntropyOptions no longer accepts acc_policy='balanced'; use acc_policy='compact' instead, or a ValueError is raised.

Scalar clamp/clamp_min/clamp_max gradient at equality changes from 1 to 0; Tensor-bound clamp, clamp_min, clamp_max, fmin, and fmax now split the gradient evenly at ties instead of assigning it entirely to the input.

torch.distributed.split_group() now returns GroupMember.NON_GROUP_MEMBER instead of None for nonmember ranks; is None checks must be replaced with == torch.distributed.GroupMember.NON_GROUP_MEMBER.

C++ zero-argument overloads c10::Scalar::isIntegral() and c10::isIntegralType(ScalarType) are removed; pass includeBool explicitly, e.g. isIntegral(false).

Adds torch.switch to generalize torch.cond for multi-way branching in compiled and exported graphs.

Custom Python process groups whose new_group() method does not accept a backend keyword argument will now raise TypeError when torch.distributed.new_group() delegates subgroup creation to them.

Adds PreToolUse_ClineignoreGuard.sh, a hook script installable at .clinerules/hooks/PreToolUse (VS Code extension) or .cline/hooks/PreToolUse.sh (CLI, also discoverable via ~/.cline/hooks/ or a custom --hooks-dir) that cancels any read_files, editor, apply_patch, or run_commands tool call whose target matches a .clineignore pattern before the file is accessed. .clineignore uses .gitignore-style syntax (directories, globs, ! negations) evaluated via git check-ignore scoped to that file alone, so the workspace need not be a git repo; the agent is also blocked from modifying .clineignore itself. VS Code hooks require the 'Enable Hooks' setting; hooks are disabled in --yolo mode but active under --act and --plan. Cancellations return a structured JSON reason, e.g. {"cancel": true, "errorMessage": "Blocked read_files: .env matched a .clineignore pattern…"}.

$ mkdir -p .cline/hooks
curl -o .cline/hooks/PreToolUse.sh https://raw.githubusercontent.com/cline/cline/main/sdk/examples/hooks/PreToolUse_ClineignoreGuard.sh
chmod +x .cline/hooks/PreToolUse.sh

The features.context_management.experimental_mode config key (disabled by default) enables experimental context management—token-budget context, history notes, and the new_context tool—for eligible ChatGPT Plus, Pro, and Pro Lite sessions on the Codex backend.

[features.context_management]
experimental_mode = true

features:
  context_management:
    experimental_mode: true

A new tui.auto_recap = false config key disables automatic session recaps in the TUI while keeping the manual /recap command available on demand.

[tui]
auto_recap = false

Vim mode in the TUI composer now supports undo with u and redo with Ctrl+R, preserving complete drafts including pasted content and attachments.

App-server thread metadata now includes nullable model and reasoningEffort fields, and structured asynchronous questions are supported via request_user_input_async when enabled by the model catalog.

Adds managedMcpServers managed setting so organizations can push HTTP/SSE MCP servers, using the same entry shape as .mcp.json, to every user; entries that specify a command to run are skipped.

{
  "managedMcpServers": {
    "internal-tools": {
      "type": "sse",
      "url": "https://mcp.corp.example.com/sse"
    }
  }
}

Adds --permission-prompts none flag for unattended headless hosts: any action that would trigger a permission prompt is automatically denied while the active permission mode (including auto mode) continues to decide other actions.

Adds deniedMcpServers as the correct mechanism to block a managed-mcp.json server. allowedMcpServers now governs only user-added servers and no longer filters managed servers — a server previously blocked by your allowlist will load on upgrade unless moved to deniedMcpServers.

Adds recognition of glab mr create/merge/close/reopen/note/update commands so GitLab merge requests appear as MR !N in the collapsed tool summary and update the footer MR badge.

Adds --json flag to claude plugin validate to emit a machine-readable validation report.

Adds the edit_predictions.<provider>.prediction_debounce setting to control inline completion debounce timing per provider, for example setting "prediction_debounce": 300 under "copilot" in settings.json to reduce completion flicker on slow connections.

"edit_predictions": {
  "copilot": {
    "prediction_debounce": 300
  }
}

Adds the git: toggle diff base action, run from the Command Palette, to switch the diff base between HEAD and the default branch.

Adds inline variable values for C and C++ when debugging with CodeLLDB or GDB, and adds separate 'Continue Program' and 'Continue Thread' controls for debug adapters that support single-thread execution.

Adds GPT-5.6 with a 1M-token context window on Amazon Bedrock, adds Gemini 3.5 Flash-Lite to the Google AI model list, and adds Grok 4.5 and Grok 4.6 to the xAI model list.

Adds mex graph status, mex graph refresh, and mex graph rebuild for explicit graph maintenance; the bare mex graph command remains a safe rebuild alias.

$ mex graph status

$ mex graph refresh

Adds a governed Team Inbox and Spec-authoring workflow supporting local drafts, portable canonical proposals, and explicit approval, rejection, withdrawal, stale detection, and repair — each bounded to a single Spec create or update.

graph get, graph query, and impact are now gated on fresh provenance-bound observations, using owner-token writer serialization and atomic snapshot publication to ensure reads reflect current state.

mex capabilities --json lists installed and currently available commands in machine-readable form, suitable for agent or script consumption.

$ mex capabilities --json

Adds bounded canonical Workstream CLI and Hub surfaces with signed preview/apply for create, update, and one-way archive operations; each successful canonical mutation emits exactly one immutable Activity event.

New fresh-project setup populates the scaffold with Claude Code or Codex, builds the Graph, completes Wiki migration and indexing, installs official skills, and validates the result before Hub starts.

Adds a disposable Wiki index with schema, discovery, rebuild, atomic publish, and refresh operations, plus a read layer covering get, list, search, and related operations over stable index snapshots.

Adds bounded Member workflows with signed preview/apply, local actor selection, exact revisions, and immutable Activity emission for accepted canonical mutations.

Activates the OpenTUI backend renderer, enabled via the QWEN_TUI_RENDERER environment variable, and adds a gated bun/OpenTUI preview flavor to standalone releases.

$ QWEN_TUI_RENDERER=1 qwen

Adds an /output-style slash command with an interactive picker to switch output style mid-session, available in both the standard and OpenTUI renderers.

$ qwen
# Inside the session:
/output-style

Team pools are named queues of self-hosted workers that scale capacity dynamically as requests arrive and shrink as workers disconnect, with no repository lock-in. Pool hibernation lets idle machines sleep and restores them within a reconnect window on follow-up requests, avoiding keeping idle capacity warm.

Adds computer use (click, type, screenshot, browser control) for self-hosted workers on Linux and Mac, with live desktop observation and takeover from the Cursor UI.

Introduces self-hosted machines that run tool execution entirely within your own network, keeping codebases, build outputs, and secrets on internal infrastructure. Adds 'My Machines' for connecting a single laptop or VM to a personal account for individual workflows.

Enables cloud agents to execute on AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B sandboxes.

Kiro Web's cloud configuration syncs personal Steering, custom agents, Skills, Powers, and Hooks to both the CLI and IDE. In CLI V3 sessions, after uploading a .kiro configuration file you enable 'Apply cloud configuration to local CLI sessions' in Kiro Web, which loads cloud Steering, custom agents, Skills, Powers, and Hooks into new local sessions without writing files to the local directory. In the IDE, synced items appear across their usual surfaces with cloud indicators; Steering, Skills, and Hooks sourced from cloud open as read-only previews with an 'Edit in web' action, and cloud-synced Powers appear in the installed Powers list where you can select 'Try power' to review bundled Skills and MCP configuration.

The /config command in V3 CLI sessions inspects all configured agents, MCP servers, Powers, Steering, Skills, and Hooks in one terminal view, labeling each item as local, cloud, or both.

$ /config

The kiro-cli chat --sessions flag and /sessions command open a V3 session dashboard to browse, search, resume, and delete both local and cloud sessions.

$ kiro-cli chat --sessions

Trusted Commands and Command Denylist are replaced by permissions.yaml shell rules, allowing allow and deny entries scoped to a workspace or globally, with defaults applying without any configuration. Existing trusted command prefixes must be translated to allow rules and denylist entries to deny rules, or shell commands other than read-only Git commands will prompt for approval.

Hooks now use a structured v1 JSON format stored in .kiro/hooks/, with triggers for file events, tool use interception, spec tasks, and prompt submission; legacy 0.x hooks can be migrated directly from the Agent Hooks panel. Manual hooks are replaced by manual steering files.

Custom Agents are defined in a Markdown file using read, write, shell, and web tags to declare tool access, can embed MCP servers and permission rules inline, and can be shared via version control; the agent appears in the agent selector on save.

Any chat session can be opened as a full-width editor tab via right-click > 'Open in Editor', with support for horizontal/vertical splits, dragging between editor groups, and multi-monitor setups; the panel and tab stay in sync.

Inline Chat is retired; selecting code and pressing Cmd+L (macOS) or Ctrl+L (Windows/Linux) brings it into the current chat, while Cmd+Shift+L / Ctrl+Shift+L starts a new session with the selection.

An experimental Agent Focus mode launches independent, parallel agent sessions from a chat-first layout with inline diffs, status-at-a-glance, and structured workflow starters (Spec, Plan, Bug Fix, Quick Spec); it is toggled from the top-right corner.

Adds a context_window field to ModelProfile and a context_window_used field to RunContext so agent code can inspect how much of the model's context window has been consumed during a run, e.g. to gate expensive downstream calls from inside a tool.

from pydantic_ai import Agent, RunContext

agent = Agent('openai:gpt-5.6-sol')

@agent.tool
def context_guard(ctx: RunContext[None]) -> str:
    used = ctx.context_window_used
    return f'Context used so far: {used} tokens'

Enables application code and capabilities to emit typed CustomEvents and CapabilityEvents into the run event stream, with @on_event for subscribing to them.

Adds ai-memory export-okf subcommand to stream a validated Open Knowledge Format v0.2 bundle importable anywhere. First start of v2.0 migrates the wiki to OKF in place, gated on a verified full backup written to your home directory or the path set via AI_MEMORY_BACKUP_DIR — the server refuses to start if the backup cannot be written and verified. Once migrated, pre-2.0 binaries refuse to open the data directory, shared stores require all machines to be upgraded simultaneously, and downgrading is not supported.

$ ai-memory export-okf

In-process sentence embeddings (pure Rust, no API key) now run by default, with existing pages automatically backfilled; add embedding_provider = "none" to opt out. First start downloads the ~87 MB model in the background and hybrid search activates on the next restart, while air-gapped installs remain FTS-only unless model files are placed manually.

embedding_provider = "none"

Adds ai-memory-eval retrieval subcommand to run the LongMemEval-S benchmark end-to-end against a live server; hit@5 improved from 0.617 to 0.823 in this release.

$ ai-memory-eval retrieval

Adds as_of parameter to memory_query to retrieve knowledge as it stood at a past point in time, including entries that have since been superseded.

Adds causes, fixes, and contradicts typed relation edges in page frontmatter; declared contradictions surface as lint findings with zero LLM cost.