v0.1.7

RightNow-AI/openfangv0.1.7Feb 27, 2026by jaberjaber23

AI Summary

Bugfix release addressing MCP tools visibility, cron scheduling, token quota handling, and security improvements including SSRF blocklist expansion and vault header updates.

Key Highlights

Fixed MCP tools not visible to agents (threshold fix)
Fixed cron scheduler firing every 60s (real cron parsing)
Expanded SSRF blocklist (Alibaba/Azure metadata, IPv6 localhost, 0.0.0.0)
Fixed token quota treating 0 as deny-all instead of unlimited
Added vault OFV1 magic byte header with legacy JSON backward compat

New Features

Zhipu Coding (CodeGeeX) provider + codegeex-4 model
Config-based OAuth client ID overrides (`[oauth]` section)

Full Release Notes

## Fixes
- Fix MCP tools not visible to agents (threshold was >= 3, now > 0)
- MCP tools now show in Settings -> Tools alongside built-in tools
- Fix cron scheduler firing every 60s (real cron parsing with `cron` crate)
- Fix token quota treating 0 as deny-all instead of unlimited
- Fix dashboard scheduler calling wrong API endpoint
- Fix base_url not propagated from config to LLM driver
- Fix Mastodon HTML sanitizer panic on emoji/CJK characters
- Expand SSRF blocklist (Alibaba/Azure metadata, IPv6 localhost, 0.0.0.0)
- Add vault OFV1 magic byte header with legacy JSON backward compat
- Add input length validation for agent fields (413 on overflow)

## New
- Zhipu Coding (CodeGeeX) provider + codegeex-4 model
- Config-based OAuth client ID overrides (`[oauth]` section)