Merge feature/next-release into main (pre-2.2.0)

[asdek]

Description of the Change

This PR merges the accumulated feature/next-release branch into main, forming the 2.2.0 release: 559 commits, 730 files, +81649 / −27334 since v2.1.0. The summary is organized by theme rather than by commit.

On the commit count. 559 = 533 non-merge + 26 merges, but only 25 non-merge commits were authored directly on this branch. feature/frontend was merged twice without squashing (123 commits) and a staging branch integrate/open-prs-v2 brought 344 more, so 436 of the 533 (82%) are frontend commits from one author. A further 26 commit subjects appear twice — that staging branch cherry-picked the open external PRs, which were then merged again from their own fork branches — leaving 507 unique subjects.

Problem

After 2.1.0, PentAGI could only ever be one installation per set of backing services — two instances sharing a PostgreSQL, a worker node or a Graphiti would collide on flow ids, container names, host ports and sessions. Agents chose their own search engine from seven separate tools, each of which swallowed its failures into a prose string the LLM could not distinguish from a result — and Google Custom Search had been sending unauthenticated requests for every deployment. Sandbox containers inherited Docker's implicit default capability set with the host socket mounted by default. The prompt/template/knowledge editor corrupted the very documents the backend parses as Go templates. The web UI had no automated end-to-end coverage at all, its CI was almost entirely advisory, and a backend that was down rendered as a pristine empty account. Several fail-fast paths — an unreachable telemetry collector, one unreadable directory entry, a deadlocking work queue — could take down startup or a whole request.

Solution

Multi-instance deployment — TENANT_ID (new) Several installations can now share one PostgreSQL, one worker-node Docker daemon, one Neo4j/Graphiti and one Langfuse. A single helper module namespaces the PostgreSQL schema, worker container/volume names and labels, Graphiti group ids, auth key derivation and cookie names, and telemetry identity. Empty value is a strict no-op — every helper degrades to an identity function and created objects are byte-identical to 2.1.0, enforced in one place and covered by a backward-compatibility contract test. The tenant schema is created at boot, the DSN is rewritten once so sqlc/GORM/goose/pgvector all follow, and startup refuses to boot if current_schema() is not the tenant's. DATABASE_EXTENSIONS_SCHEMA and DATABASE_SEARCH_PATH_VIA_OPTIONS cover managed Postgres and poolers (Supabase, PgBouncer, Supavisor). Migrations now run under an advisory lock against a schema-qualified goose version table — which also fixes a pre-existing race between two single-instance deployments booting against one database.

Graphiti/Neo4j resource limits and LLM presets (new) Both containers gain explicit sizing (GRAPHITI_CPUS/_MEMORY, NEO4J_CPUS/_MEMORY/_SHM_SIZE/_NOFILE) instead of running unbounded. Graphiti's own LLM client is now a selectable preset (GRAPHITI_LLM_CLIENT_TYPE: openai/gemini/custom/litellm) loaded from examples/graphiti/<provider>.yaml, replacing the single GRAPHITI_MODEL_NAME variable, and gains explicit ingestion-policy, worker-pool and extraction/taxonomy tuning knobs. Neo4j ships a user-editable examples/neo4j/conf/ (neo4j.conf, apoc.conf) plus a bundled APOC plugin, mounted read-only via docker-compose-graphiti.yml; the installer wizard's Graphiti step was rewritten to configure all of it.

One web_search tool replacing seven engine tools Agents now supply a query plus an intent mode (links / answer / research / exploit) and never name an engine; a per-mode fallback table is the single source of priority. Engines moved into a neutral searchers package behind a Searcher interface returning typed retryable/fatal errors, so the orchestrator can retry, fall back, or degrade. Previously every engine returned its failure as a result string with a nil error, and its Langfuse event was literally named "search engine error swallowed". Two new engines: Firecrawl (external contribution) and an opt-in internal analytics engine that scrapes and summarizes pages with no paid API. Search-log rows are now written once per call, attributed to the engine that actually served the result.

Sandbox capability model The primary terminal container moved from Docker's implicit defaults to CapDrop: ALL plus an explicit 14-capability allow-list — MKNOD deliberately omitted (block-device mknod + debugfs is this project's own identified primary escape vector) and SYS_PTRACE deliberately added for exploit-development tooling. Every container gets PidsLimit=2048. New DOCKER_INSIDE_HOST / _TLS_VERIFY / _CERT_PATH separate which daemon a sandbox may reach from which daemon PentAGI uses, so an operator can point agents at a dedicated dind endpoint instead of bind-mounting the host socket; setting the host also stops autodetecting and mounting it. A 12-file hardened Docker-in-Docker kit (fail-closed OPA policy, seccomp profile blocking block-device mknod daemon-wide, cleanup timer, 1374-line isolation suite) ships under examples/guides/worker_node/ as operator-deployed guidance — not enforced by the application. The guide itself grew two new sections — deploying the browser scraper and Prometheus exporters (cAdvisor/node-exporter) on the worker node's host Docker — plus a clarified TCP-over-TLS failure-mode writeup for worker connections.

Providers, models and reasoning MiniMax is the tenth first-class provider. A capability model (ReasoningMode adaptive/budget/off plus per-model efforts / supported / cannotDisable / defaultOn, derived at runtime from the langchaingo reasoning tables rather than model-name regexes) lets the Settings UI offer only thinking controls a model actually honours, and xhigh/max now reach the wire. Adaptive-only models can no longer be sent budget thinking and get a 400. The Bedrock/Anthropic request-body rewriting middleware is deleted — langchaingo emits adaptive natively. Five near-duplicate OpenAI-compatible providers collapsed onto a shared base (~190 → ~78 lines each) and five per-type switches onto a table-driven registry, so a new provider can no longer return 422 from the REST API for want of a whitelist edit. A price audit against official sources corrected real overstatements (deepseek-v4-pro was 4× the official rate; one Bedrock Mistral model 8×), guarded by a new drift test. Gemini's default catalog was retuned too: coder/installer/pentester moved to gemini-3.6-flash and reflector/searcher/enricher to gemini-3.5-flash-lite, trading a little accuracy for cost — the refreshed ctester report still clears 94% overall.

Markdown editor rebuilt (Monaco removed) A 47-module subsystem on official @tiptap/markdown is now the single surface for the three places users author markdown the backend consumes. This matters because getMarkdown() output is the Go text/template that gets stored and server-validated: a table pipe inside a {{ … }} pipeline made prompts impossible to save at all, a code-fence detection bug cost one real knowledge document 556 words, and marked's default escaping corrupted regex/glob/UNC backslashes on first load. Four ReDoS paths on stored content were rewritten to linear form (one measured 4.9 s of frozen main thread at 250 KB, now 0.48 ms), and two perf fixes cut 1 MB document load 69 s → 4 s.

Web UI platform Self-healing recovery from the two SPA crashes reproduced live (stale hashed chunks after a redeploy; DOM desync from an extension or auto-translation). Route payloads cut by removing an unused ~198 KB gzip of recharts and highlight.js from every route including /login (/settings/account 502 → 305 KB). Row virtualization on /flows (41 657 → 1 121 DOM elements at 1116 rows). A failed load no longer renders as an empty account, and detail pages now distinguish not-found from an authorization denial, a partial error, and a failed background refetch. TypeScript now gates the build — 76 type errors had accumulated unnoticed because vite build strips types and the old bare tsc checked nothing. Accessibility was run as a program: focus return, accessible names, table/listbox semantics, and every coloured badge retuned to clear WCAG AA in both themes.

End-to-end suite and CI (new) Three tiers: a hermetic mock tier (cassette-driven mock of the whole API surface, run against the production bundle — no backend, no secrets, fork-safe, the PR gate), a local tier (branch-built image in an isolated compose stack driven by a mock LLM, exercising the real agent loop), and a stand tier (LLM-independent smoke against a live deployment behind a label gate plus a protected Environment). 39 spec files / 125 spec cases, 20 container-generated visual baselines, 8 e2e unit-test files. A second pass was explicitly about falsifiability — several gates were written so they could not fail and several CI signals reported green without reading anything; closing those holes is what surfaced most of the UI defects above.

Reliability A deadlocking work queue (found via a file-manager request that never returned) fixed three times and then deleted in favour of a bounded errgroup. An unreachable telemetry collector no longer blocks main() forever or kills the process, and telemetry is now actually flushed on SIGTERM. Container listings return partial success instead of a 500 that blanked the file browser — and were rewritten off ls parsing under a TTY, which made listings entirely unreadable on alpine/busybox images. ZIP downloads stream instead of buffering whole archives. A flow whose worker fails to start is no longer left visible in the listing. Graphiti's health check retries before permanently disabling the knowledge graph for the process lifetime, and its 5xx responses degrade to a soft result instead of burning tool-call retries. Error logging across controllers and providers was centralized behind obs.LogErrorOrCancel so context-cancellation noise no longer masks real failures, and task/subtask status updates now treat an already-missing database row as completed, making shutdown idempotent instead of erroring on a stale reference.

A first-deployment guide, six troubleshooting sections written against real user issues, deep operational docs for the three deployment-affecting features, and five docs-only design RFCs (Kubernetes, Vertex AI, BrowserOS MCP, tool/model fallback, headless crawler) — none of which ship runtime code, env vars or migrations.

Closes #61, #335, #338

Refs #249, #268, #279, #288, #309, #310, #313, #321, #322, #324, #336, #337, #341, #342, #344, #380

No commit in this range pairs a closing keyword with an issue number, so the Closes list is deliberately limited to the three where code or the specifically requested artifact shipped. #309 and #313 are documented here but their code fixes landed in main before this branch; #321/#324/#336/#341/#342 received docs-only RFCs; #337 is only partially addressed; #279 must not be claimed (see Additional Notes).

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🔧 Configuration change
• 🧪 Test update
• 🛡️ Security update

Areas Affected

• Core Services (Frontend UI/Backend API)
• AI Agents (Researcher/Developer/Executor)
• Security Tools Integration
• Memory System (Vector Store/Knowledge Base)
• Monitoring Stack (Grafana/OpenTelemetry)
• Analytics Platform (Langfuse)
• External Integrations (LLM/Search APIs)
• Documentation
• Infrastructure/DevOps

Testing and Verification

Test Configuration

PentAGI Version: 2.2.0 (feature/next-release)
Docker Version: 24.0.x+
Host OS: macOS / Linux
LLM Provider: OpenAI, Anthropic, Bedrock, DeepSeek, GLM, Kimi, Qwen, MiniMax, vLLM, Ollama
Search Engines: Google, DuckDuckGo, Tavily, Firecrawl, Searxng, Perplexity, Traversaal, Sploitus, Internal
Node Version: 24.17.0 (pinned via frontend/.nvmrc)
pnpm Version: 11.8.0 (pinned via packageManager)
Enabled Features: Core, Graphiti, Langfuse, observability

Test Steps

1. cd backend && go build ./... && go vet ./... && go test ./...
2. cd frontend && pnpm install && pnpm run lint && pnpm typescript && pnpm run test
3. docker compose up -d on a clean database; confirm both migrations apply and the startup Instance identity line reports the expected tenant_id / data_dir / schema / installation_id.
4. Single-instance regression (the important one): with TENANT_ID empty, confirm container names, the PostgreSQL schema, Graphiti group ids and the session cookie are unchanged from 2.1.0.
5. Multi-instance: two instances with distinct TENANT_ID, DATA_DIR and DOCKER_PORTS_BASE against one PostgreSQL and one worker node; run a flow in each and confirm no collision on flow ids, container names, host ports or sessions, and that a session from one is rejected by the other.
6. Run a flow and exercise web_search in each of the four modes; verify one searchlogs row per call attributed to the winning engine, and that an unconfigured engine is skipped rather than failing the chain.
7. Author a prompt containing a markdown table with a {{ .Var | urlquery }} pipeline, an indented code fence and regex backslashes; save through rich mode, reload, save again — confirm it converges and passes server-side template validation.
8. pnpm run e2e (mock tier), then the local tier against a branch-built image.
9. Verify the sandbox capability set on a running flow container (docker inspect) and that PidsLimit is 2048.

Test Results

• Backend: go build ./..., go vet ./... clean; gofmt clean on every touched file; go test ./... — 40 packages ok, 0 failures.
• Frontend: 1363/1363 Vitest tests pass (77 files); pnpm run lint clean at --max-warnings 0.
• E2E: 39 spec files / 125 spec cases on the mock tier, 20 visual baselines, 8 e2e unit-test files — run in CI on this PR. Playwright was not run locally for this write-up; the counts are static and independently confirmed.
• Migrations: both read in full and applied on a clean database.
• Provider capability matrix: 18 ctester reports regenerated against the new default catalogs and committed under examples/tests/ — 14 refreshed (OpenAI goes 281/281 on o3/o4-mini/gpt-4.1-mini → 303/304 on gpt-5.6-terra/gpt-5.4-mini/gpt-5.4-nano) and 4 new (hcnsec 283/295, minimax 275/295, vllm-mixed 295/295, vllm-qwen3.6-27b-fp8 295/295). These are the empirical backing for the provider and model-catalog claims.
• Known coverage gap: the integrate/open-prs-v2 merge silently dropped 13 test files covering code that does ship (docker container listing/stat fan-out, graph validation, observability shutdown drain, provider build/get/price consistency, openai-compat adaptive thinking, pconfig reasoning effort/off, static serving). Those areas ship with their regression suites deleted — see Additional Notes.

Security Considerations

Sandbox containment. The primary terminal container now runs CapDrop: ALL with an explicit allow-list rather than inheriting Docker's implicit defaults, with MKNOD withheld to close the block-device mknod + debugfs host-disk read path, and PidsLimit=2048 as a fork-bomb guard on every container. DOCKER_INSIDE now defaults to false in .env.example with the risk spelled out: true bind-mounts the host Docker socket into every sandbox, which prompt injection can use to escape to the host (issue #337). DOCKER_INSIDE_HOST lets an operator designate a dedicated daemon and stops the host socket being mounted at all.

Be accurate about what did not ship: the no-new-privileges:true half of PR #355 was deliberately reverted — the capability bounding set already caps what any process can gain, while the flag unconditionally broke SUID/SGID privilege-escalation testing and sudo/su from a non-root shell, both routine pentest workflows. The shipped mitigation is the capability allow-list plus PidsLimit. Everything stronger (OPA authz, custom seccomp, no host bind-mounts) is operator-deployed guidance under examples/guides/worker_node/ and is not enforced, verified, or even detectable by the application.

OAuth account linking — audit before enabling. OAuth login now matches users by email alone (the type = oauth filter was removed) and issues the session with the matched account's actual role privileges (previously hardcoded RoleUser). This fixes a 500 when an OAuth email collided with a local account, but it means if a local admin account's email address can be registered or controlled at the configured IdP, that is a privilege-escalation path. Audit local account emails before enabling Google/GitHub OAuth. Two properties bound the risk: logins are rejected when the provider reports the email unverified (the resolver now returns (email, verified, err), so a provider that forgets to report fails closed), and the match is exact-case, so a case-mismatched IdP address creates a second account rather than linking into the local one.

Email case sensitivity. Emails are now deliberately case-sensitive on every path against UNIQUE(mail), and the shared validator was widened (case-insensitive, TLD {2,}), so Admin@x.com and admin@x.com are distinct accounts — newly reachable. A fully case-insensitive scheme (citext / UNIQUE(lower(mail))) is an explicit open follow-up.

Multi-tenant isolation. With TENANT_ID set, cookie and API-token signing keys derive from COOKIE_SIGNING_SALT plus the tenant and three cookies are renamed (session plus the OAuth CSRF pair), so a session or token minted by one instance is cryptographically rejected by another even with an identical salt. An invalid tenant id aborts startup rather than being normalized, because collapsing two tenants onto one namespace is precisely the collision tenancy exists to prevent.

Other hardening. Passwords are capped at the 72 bytes bcrypt can actually hash (previously 73–100 characters passed validation and then 500'd inside the hash call). Four ReDoS paths in editor regexes running synchronously over stored, LLM-influenceable content were rewritten to linear form. Authoring-time URL/image protocol allowlists prevent javascript: / data:text/html / data:image/svg+xml being persisted into a document. Container-listing responses no longer leak raw Docker-layer text (container ids, daemon address) in a 200 body, and the request path count is bounded at 128 so an attacker-chosen count cannot multiply the per-path entry cap into a large fan-out. pprof no longer listens on a hardcoded :7777 in every deployment. .env.* files are excluded from the Docker build context, and stand e2e reports are redacted before their public artifact upload.

Performance Impact

Measured improvements:

• Markdown editor: 1 MB document load 69 s → 4 s; the variable-panel ReDoS path 250 KB 4.9 s → 0.48 ms (~10 000×); a paste cue 120 k tokens 33 s → <1 ms.
• Route payloads: /settings/account 502 KB → 305 KB, /dashboard 474 → 378 KB, by removing ~198 KB gzip of recharts and highlight.js that every route — /login included — was downloading unused.
• /flows at 1116 rows: DOM elements 41 657 → 1 121, tbody rows 1116 → 22, a11y tree ~485 KB → ~80 KB. Detail-navigation sheet ~1800 → ~32 nodes.
• Per-keystroke work on the edit pages: provider form 152 ms → ~5 ms (it was re-running the zod resolver over 13 agent accordions on every keystroke), knowledge form 58 → 21 ms.
• PDF report: CJK font (8.1 MB) registered only when the report contains CJK — one flow's download traffic 22.6 MB → 13.8 MB.
• ZIP downloads stream instead of buffering whole archives, so memory is proportional to one file's copy buffer.
• RAM growth removed: a TTL-eviction goroutine was being spawned per short-lived flow/assistant provider; the embedded prompts FS was re-read and re-mapped on every call; the anonymizer was recompiled per flow executor.

Costs to be aware of:

• Per-result raw search content 3000 → 8192 bytes — ~2.7× more source text to the summarizer and, on the non-summarized path, to the agent.
• PERPLEXITY_MODEL default moved to the more expensive sonar-pro tier.
• The summarizer cache shrank 1000 → 100 entries, so expect more summarization calls per flow.
• Adaptive-only models assigned to a cheap utility role silently get effort=high on the wire; the only escape is an explicit reasoning: {mode: off}.
• Graphiti enabled but unreachable adds ~4 s to startup (3 health-check attempts).

Documentation Updates

• README.md updates (TENANT_ID, worker Docker access, MiniMax, Firecrawl, internal engine, model catalogs)
• API documentation updates (Swagger regenerated for the container-files response shape)
• Configuration documentation updates (backend/docs/config.md multi-instance, worker Docker access, new engines, Graphiti/Neo4j resource limits and LLM presets)
• GraphQL schema updates (reasoning capability types, Map scalar, renameKnowledgeDocument, minimax)
• Other: examples/guides/installation_configuration.md; a 12-file hardened dind kit under examples/guides/worker_node/; frontend/docs/e2e.md; frontend/docs/list_detail_pages.md; rewritten backend/docs/{database,docker,flow_execution}.md; five docs-only RFCs under examples/proposals/; CLAUDE.md password policy and search-engine contributor guide; examples/neo4j/conf/ reference configs

Deployment Notes

Deployment steps

1. Pull the merged main.
2. docker compose build (requires Node 24.17.0 / pnpm 11.8.0 — both pinned; pnpm build is now tsc -b && vite build, so a TypeScript error fails the image build).
3. docker compose up -d — both migrations apply on boot.

Leave TENANT_ID empty when upgrading. Setting it points the instance at a new, empty PostgreSQL schema; data in public is not migrated and will appear to be gone.

Migrations (2). 20260621_120000_add_minimax_provider.sql adds minimax to PROVIDER_TYPE — its down migration is destructive (DELETE FROM providers/flows/assistants WHERE type = 'minimax'). 20260716_120000_add_firecrawl_search_type.sql adds firecrawl to SEARCHENGINE_TYPE; its down migration is non-destructive but lossy (remaps firecrawl search logs to tavily before narrowing the enum).

Actions an existing deployment may need to take

1. Docker-in-Docker: a fresh copy of .env.example now sets DOCKER_INSIDE=false. Existing .env files are unaffected, but a newly bootstrapped install gives agents no nested Docker until explicitly enabled.
2. pprof: set PPROF_ADDR=:7777 to restore the previously always-on listener. Any scrape job assuming :7777 breaks without it.
3. Custom prompt overrides referencing {{.GoogleToolName}}, {{.TavilyToolName}}, {{.DuckDuckGoToolName}}, {{.TraversaalToolName}} or {{.PerplexityToolName}} now fail validation and must be edited to {{.WebSearchToolName}}.
4. LLM access: the shipped Anthropic defaults moved to claude-sonnet-5 / claude-opus-4-8 and OpenAI to the GPT-5.4/5.6 families. An API key without access to those tiers fails on the default config. Eight model ids were removed from the catalogs (existing pinned agent configs keep their stored string).
5. BEDROCK_CONFIG_PATH: with it set and Bedrock credentials present, startup upserts the Bedrock provider row for every user from the YAML — any per-agent config edited in the Settings UI is replaced on every restart. With this variable set, the YAML is authoritative.
6. PERPLEXITY_MODEL: the application default moved to sonar-pro, but docker-compose.yml still pins ${PERPLEXITY_MODEL:-sonar} — Docker and bare-metal defaults now disagree. Set the variable explicitly.
7. Reverse proxy / CDN: a missing /assets/* must return 404, not a rewrite to index.html, or the stale-chunk recovery re-breaks after a redeploy.
8. OAuth: audit local account emails before enabling Google/GitHub (see Security Considerations).
9. Passwords longer than 72 bytes are now rejected at validation time. No stored credential is affected — such a password could never have been hashed successfully.
10. Monitoring: telemetry init failure is no longer fatal, so alert on the langfuse telemetry disabled / opentelemetry disabled warnings instead of relying on a boot failure.
11. CI/repo configuration: ci.yml now triggers on pull_request plus push to main/tags, not every branch push. The stand e2e tier needs a protected e2e-stand Environment with required reviewers, three E2E_STAND_* secrets and an e2e:stand label. Branch protection should require e2e-mock and lint-and-test; e2e-visual is advisory by design and must not be required.
12. GRAPHITI_MODEL_NAME was removed — an existing .env that still sets it is harmless (ignored), but the model is now selected via GRAPHITI_LLM_CLIENT_TYPE plus examples/graphiti/<provider>.yaml; set GRAPHITI_CPUS/GRAPHITI_MEMORY/NEO4J_CPUS/NEO4J_MEMORY explicitly if the previous unbounded resource usage was relied upon.

One environment variable was removed: GRAPHITI_MODEL_NAME, superseded by the GRAPHITI_LLM_CLIENT_TYPE / GRAPHITI_CONFIG_PATH provider-preset system above. New: TENANT_ID, DATABASE_EXTENSIONS_SCHEMA, DATABASE_SEARCH_PATH_VIA_OPTIONS, DOCKER_PORTS_BASE, PPROF_ADDR, DOCKER_INSIDE_HOST, DOCKER_INSIDE_TLS_VERIFY, DOCKER_INSIDE_CERT_PATH, BEDROCK_CONFIG_PATH, PENTAGI_BEDROCK_CONFIG_PATH, MINIMAX_*, FIRECRAWL_*, WEB_SEARCH_INTERNAL_*, GRAPHITI_CPUS, GRAPHITI_MEMORY, GRAPHITI_CONFIG_PATH, GRAPHITI_CONFIG_DIR, GRAPHITI_LLM_CLIENT_TYPE, GRAPHITI_SEPARATE_EMBEDDING, GRAPHITI_INGEST_*, GRAPHITI_ANCHOR_*, NEO4J_CPUS, NEO4J_MEMORY, NEO4J_SHM_SIZE, NEO4J_NOFILE.

Checklist

Code Quality

• My code follows the project's coding standards
• I have added/updated necessary documentation
• I have added tests to cover my changes
• All new and existing tests pass
• I have run go fmt and go vet (for Go code)
• I have run npm run lint (for TypeScript/JavaScript code)

Security

• I have considered security implications
• Changes maintain or improve the security model
• Sensitive information has been properly handled

Compatibility

• Changes are backward compatible
• Breaking changes are clearly marked and documented
• Dependencies are properly updated

Documentation

• Documentation is clear and complete
• Comments are added for non-obvious code
• API changes are documented

Additional Notes

External contributions

21 GitHub PRs from 9 external contributors were merged into this branch. Credits use git identities verbatim and they/them, since no contributor's pronouns or verified full name appear in the repository.

• @mason5052 — 13 PRs, the largest external contribution: the Kubernetes, Vertex AI, BrowserOS MCP, tool/model fallback and headless-crawler design RFCs; the first-deployment guide and troubleshooting guides for install/config, embedding stalls, tool-call parsers and Qwen long flows; plus unbuffered ZIP streaming and the XSStrike prompt guardrail. Two core follow-ups hardened the ZIP change after merge.
• @salecharohit (Feat/bedrock config path #233) — BEDROCK_CONFIG_PATH, following the existing LLM_SERVER_CONFIG_PATH / OLLAMA_SERVER_CONFIG_PATH pattern.
• @rramprakash (feat(tools): add Firecrawl web search provider #373) — the Firecrawl search engine, including its migration, installer entry and docs; they also self-reviewed two real defects in follow-ups (an un-interpolated summarizer query, and a down migration that would fail once the engine had been used).
• @octo-patch (feat: upgrade MiniMax default model to M3 #328) — the MiniMax provider core; extended by core to UI, installer, GraphQL and migration parity.
• @manus-pi (fix(sandbox): harden sandbox containers against privilege escalation #355) — sandbox hardening for [Bug]: PentAGI Container Escape via Prompt Injection #337: CapDrop ALL with an allow-list, PidsLimit, a boot warning and the corrected DOCKER_INSIDE default. The no-new-privileges half was deliberately reverted afterwards.
• @Akalanka1337 (Replace Change Password with My Profile (email and password update) #340) — the My Profile email/password dialog, reworked by core into /settings/account.
• @jinhaosong-source (Add OrcaRouter pre-configured provider #362) — the pre-configured OrcaRouter provider config.
• Priyanka Singh (Fix: Handle missing Graphiti compose file gracefully during restart #379) — the installer restart path when a compose file is absent, with 133 lines of tests.
• @Osamaali313 (fix(cast): delete pruned tool-call parts in reverse to avoid index shift #364) — the cast.NewBodyPair forward-order deletion bug that could drop a valid text part while keeping an invalid tool call in the message chain.

PR #332 (Atlas Cloud) was not merged; it was reimplemented as examples/configs/atlas.provider.yml, dropping the vendor banner and UTM links and correcting advice that would have broken /models discovery.

Core work by @asdek (multi-instance deployment, the search orchestrator, providers/registry, sandbox capabilities, reliability) and @sirozha (the markdown editor, the frontend platform and feature pages, the e2e suite and CI gates).

Not in this release — do not announce

• Evidence receipt hash chain (feat: add evidence receipt hash chain prototype #279). Seven commits exist in history and none of it is in the tree — the integrate/open-prs-v2 merge dropped backend/pkg/tools/evidence_receipts.go and EVIDENCE_RECEIPTS_ENABLED appears nowhere. examples/proposals/evidence_chain.md is pre-existing and unchanged.
• no-new-privileges sandbox hardening — reverted; it survives only as an explanatory comment.
• Kubernetes, Vertex AI, BrowserOS MCP, headless crawler, tool/model fallback — all five are docs-only RFCs. None of their candidate env vars, config shapes or the Vertex PROVIDER_TYPE migration ship.
• BEDROCK_MODELS_PATH — in-branch churn, absent at the tip.

Known issues to resolve before tagging

The merge topology cost us a few things that are worth fixing in this PR rather than after the tag:

1. README.md:1473 contradicts README.md:2866 and the code. Commit 2a4ff3d6 removed a bullet claiming image selection fails as a tool call (it is a plain text completion of the simple agent); re-merging PR docs: add tool-call parser troubleshooting for custom LLM backends #330 re-applied the original branch and put it back. Worth auditing the other 21 duplicated doc commits the same way.
2. CONTRIBUTORS.md has a zero diff across the whole range and still reads "370+ commits over 18 months" — none of the nine contributors credited above appear in it.
3. Bedrock docs are stale. The catalog ships 42 models; the README documents 24, still lists all four removed ids, and its "Tested but Incompatible Models" table declares eight models "not supported" that this release makes selectable. The Anthropic table documents 9 of 10 and omits claude-opus-5 entirely.
4. backend/docs/config.md documents three tool constructors this release deleted (NewFirecrawlTool / NewSploitusTool / NewSearxngTool), and backend/docs/flow_execution.md:231-234 documents fallback chains that omit Firecrawl from three of four modes — while its own prose names the code as the source of truth.
5. 13 test files for shipping code were dropped by the same merge (see Test Results).
6. The Bedrock seeding variant is a merge accident, not a decision — the tree contains exactly the two pieces the reworker documented as deliberately dropped and lacks the one he added. Worth an explicit call.
7. README.md:3190 has deepinfra.provider.ymll in a copy-pasteable config comment.

Review focus

• backend/pkg/config/tenant.go + backend/pkg/database/tenant.go — the no-op contract when TENANT_ID is empty is what protects every existing deployment; also confirm no code path opens a connection before EnsureTenantSchema.
• backend/pkg/providers/providers.go:673 — SeedDefaultProviders writing from a read-only resolver.
• backend/pkg/server/services/auth.go — OAuth link-by-email plus role-privilege inheritance.
• backend/pkg/tools/web_search.go:82-109 — the fallback table is the only place engine priority lives.
• frontend/src/components/shared/markdown-editor/markdown-editor-table-pipes.ts — hand-reimplements marked's GFM table grammar; its scope must match marked's row set exactly.
• backend/pkg/tools/file_diff.go — edit_file applies diffs through a fuzzy matcher; "every hunk applied" does not mean "applied where the model meant".
• Backend CI is still advisory — all four backend steps carry continue-on-error: true, including the linux/amd64 + linux/arm64 cross-compile, and golangci-lint runs with --issues-exit-code=0. A backend build break does not fail the gate. Worth deciding whether that changes with this release.

---

Note

High Risk
The release touches tenant isolation, OAuth linking, sandbox Docker exposure, auth/signing, and many breaking env/template defaults across a very large diff—misconfiguration or partial upgrades could cause data isolation failures or privilege issues.

Overview
This is the 2.2.0 integration of feature/next-release: a large cross-cutting release spanning backend, frontend, Docker, CI, and documentation.

Multi-instance and data plane. Optional TENANT_ID namespaces PostgreSQL schema, worker containers, Graphiti groups, auth cookies/tokens, and telemetry; empty tenant id stays a no-op for single-instance upgrades. Utility binaries (etester, ftester) now run the same tenant schema bootstrap and search_path verification as the main server. .env.example documents DATABASE_EXTENSIONS_SCHEMA, DATABASE_SEARCH_PATH_VIA_OPTIONS, DOCKER_PORTS_BASE, and related deployment knobs.

Search and integrations. Agents move to a single web_search tool with intent modes and orchestrated fallbacks (docs and env add Firecrawl, optional internal browser analytics, and expanded Graphiti/Neo4j/LLM preset configuration). MiniMax is wired into ctester with capability-gated test reporting (Unsupported no longer counts as failure).

Security and sandbox. DOCKER_INSIDE defaults to false in .env.example with explicit socket-risk notes; DOCKER_INSIDE_HOST / TLS cert paths separate sandbox Docker access from the worker daemon. PPROF_ADDR replaces an always-on debug listener.

CI and quality gates. ci.yml runs on pull requests, pins Node via .nvmrc, removes permissive continue-on-error on frontend steps, adds TypeScript check and a GraphQL codegen freshness gate (.github/scripts/codegen-inputs-changed.sh). New E2E workflows: fork-safe mock tier, visual snapshots (advisory), local nightly tier, label-gated stand tier with secret redaction, and e2e-report.yml sticky PR comments via workflow_run.

Build and packaging. Dockerfile bumps to Node 24.17.0, expands shipped provider YAMLs, and .dockerignore excludes e2e artifacts and local env files from the image context.

Documentation. README, CLAUDE.md, CONTRIBUTING, and Graphiti sections are rewritten for tenancy, worker Docker guidance, new providers/models, tool-call troubleshooting, and offline E2E contributor flow.

^{Reviewed by Cursor Bugbot for commit db68cde. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

There are 4 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5610cd9. Configure here.}