v1.2.0

rnwood/smtp4devv1.2.0Feb 25, 2026by asdek

AI Summary

PentAGI 1.2 introduces major AI capabilities including support for the latest reasoning models, token caching for cost optimization, comprehensive usage analytics via REST API, JWT-based API token management, Sploitus integration, and a full migration to Langfuse v3 observability.

Key Highlights

Support for latest reasoning models (Gemini 2.5/3.0, Claude Sonnet 4+, DeepSeek R1, OpenAI o-series).
Token caching and cost optimization with 40-70% savings in multi-turn conversations.
REST API endpoints for detailed resource utilization tracking and JWT authentication.
Langfuse v3 observability with enhanced LLM operations tracking and message chain visualization.
Sploitus integration for vulnerability search engine support.

New Features

Reasoning Content Preservation for message chain summarization.
Tool Call ID Templates for configurable enforcement.
User Preferences System with persistent storage.
GraphQL Subscriptions for real-time flow updates.
Docker Build Versioning with embedded version information.
Enhanced Error Diagnostics with stop reason reporting.
PDF Report Generation using @react-pdf/renderer.
Podman Support for rootless mode.

Full Release Notes

---

<div align="center">

> 🚀 **PentAGI 1.2 - Enhanced AI Capabilities!** Major upgrade bringing latest reasoning models, token caching, comprehensive analytics, and REST API access for seamless integration with automation platforms.

[![Discord](https://img.shields.io/badge/Discord-7289DA?logo=discord&logoColor=white)](https://discord.gg/2xrMh7qX6m)⠀[![Telegram](https://img.shields.io/badge/Telegram-2CA5E0?logo=telegram&logoColor=white)](https://t.me/+Ka9i6CNwe71hMWQy)

</div>

---

### 🎯 Major Features

**🧠 Latest Reasoning Models Support** - Complete integration of cutting-edge AI models with native reasoning capabilities:
- Gemini 2.5/3.0 family with thinking tokens support
- Anthropic Claude Sonnet 4+ with extended reasoning
- DeepSeek R1 and Kimi K2.5 in reasoning mode
- OpenAI o-series models with signature thoughts
- OpenRouter and OpenAI-compatible endpoints with reasoning content preservation

**💰 Token Caching & Cost Optimization** - Intelligent prompt caching reduces input token costs by 40-70% in multi-turn agent conversations:
- Native caching support for Anthropic (ephemeral cache controls) and Gemini (pre-created content caching)
- Automatic cache hit tracking with detailed analytics
- Particularly effective for long-context penetration testing sessions
- Standardized cache token reporting across all providers

**📊 Usage Analytics & Monitoring** - Comprehensive REST API endpoints for detailed resource utilization tracking:
- Token usage breakdown by agent type (researcher/developer/executor)
- Cost analysis with cache read/write separation
- Execution time metrics per flow and subtask
- Tool call frequency statistics
- Foundation for visual analytics dashboard (coming in v1.3)

**🔑 API Token Management** - JWT-based API authentication enables programmatic access to PentAGI:
- Generate and manage API tokens through web interface
- Full REST and GraphQL API access for automation
- OpenAPI specifications for client code generation in any language
- Integration-ready for n8n, OpenClaw, Claude Desktop, and custom solutions
- Foundation for official MCP server (planned for future releases)

**🔍 Sploitus Integration** - Experimental support for vulnerability search engine:
- Cloudflare-protected service requires IP reputation verification
- Use built-in `ftester` utility to check your IP reputation before enabling
- Configure via `SPLOITUS_ENABLED` environment variable

**📡 Langfuse v3 Observability** - Complete migration to Langfuse v3 standard with enhanced LLM operations tracking:
- Observation type separation: Spans, Generations, Agents, Tools, Chains, Retrievers, Evaluators, Embeddings, Guardrails
- Enhanced message chain visualization with Playground mode navigation
- Detailed Score metrics and execution time logging
- Improved variable and metadata tracking across all observation types

### 🚀 New Features

- **Reasoning Content Preservation**: Smart message chain summarization that maintains reasoning signatures for models requiring strict conversation structure
- **Tool Call ID Templates**: Configurable tool call ID format enforcement for LLM backends with strict validation requirements
- **User Preferences System**: Favorite flows management with persistent preferences storage
- **GraphQL Subscriptions**: Real-time flow updates with user-specific event publishing
- **Docker Build Versioning**: Embedded version and revision information in container images with dedicated build scripts for Linux/macOS/Windows
- **Enhanced Error Diagnostics**: Stop reason included in error messages (e.g., `length` indicates need to increase `max_tokens`)
- **PDF Report Generation**: Export flow results to PDF using `@react-pdf/renderer` library
- **User Favorites**: Add and manage favorite flows with dedicated GraphQL mutations
- **Podman Support**: Official documentation for running PentAGI with Podman in rootless mode

### 🎨 UI/UX Improvements

- **Enhanced Theme Handling**: Improved dark/light/system theme switching with automatic system preference detection
- **Better Authentication Flow**: Safe return URL handling with validation to prevent open redirect vulnerabilities
- **Google OAuth Fix**: Resolved CORS issues and improved cookie handling for Google OAuth integration
- **Flow Subscriptions**: Real-time flow updates in UI via GraphQL subscriptions with user-scoped events
- **Settings Form Validation**: Stronger password requirements with visibility toggles
- **Enhanced Report Generation**: Fixed markdown rendering issues in flow reports

### 🐛 Key Fixes

- **Resource Leak Prevention**: Fixed response body leaks in browser tool, added tar header size validation in terminal operations, properly close tarWriter to prevent incomplete archives (#101)
- **Security Hardening**: 
  - OAuth state parameter validation with explicit CSRF checks (#101)
  - Session expiry enforcement in authentication middleware
  - SameSite cookie attributes for CSRF protection
  - Browser tool HTTP client timeout (30s) to prevent indefinite hangs
  - Authorization string typos fixed (trailing quotes causing ACL failures)
- **TLS Configuration**: Respect `EXTERNAL_SSL_INSECURE` config in Langfuse client, load custom CA certificates from `EXTERNAL_SSL_CA_PATH`, use system cert pool as base (#132)
- **Terminal Command Logic**: Corrected terminal command handling logic (#124)
- **Swagger Documentation**: Fixed missing closing quotes in OpenAPI annotations
- **Code Quality**: Removed debug console.log statements from production code
- **Traversaal API**: Updated integration after vendor-side API specification changes
- **Nil Pointer Checks**: Added nil checks for Langfuse client before ForceFlush operations

### 🔧 Infrastructure Improvements

- **LangChainGo v0.1.14-update.1**: Major dependency update with 6 months of accumulated improvements:
  - Signature thoughts support for Anthropic, Gemini, OpenAI providers
  - Message chain caching for Gemini and Anthropic with token savings tracking
  - Standardized usage format across all providers with unified field names
  - Comprehensive test coverage for LLM scenarios including multi-turn conversations, function calling, caching validation
  - Migrated Google AI provider to `google.golang.org/genai` from deprecated SDK
  - Bedrock Converse API support for Anthropic Claude models
  - Enhanced streaming with proper resource cleanup (memory leak fixes)
- **Alpine 3.23.3**: Updated base Docker image with latest security patches
- **Model Updates**: Switched from deprecated gemini-2.0-flash-lite to gemini-2.5-flash-lite with adjusted pricing
- **GitHub Actions Modernization**: Upgraded all workflows for Node 24 compatibility
- **Dependency Security Updates**:
  - axios 1.13.2 → 1.13.5
  - lodash 4.17.21 → 4.17.23
  - diff 5.2.0 → 5.2.2
  - jspdf 4.1.0 → 4.2.0
- **External Network Access**: Comprehensive documentation for configuring PentAGI accessibility from other machines with firewall setup instructions
- **Entrypoint Script**: SSL certificate generation management for enhanced security setup

### 🔄 Performance & Architecture

- **Standardized Token Usage**: All LLM providers now return consistent token fields (`PromptTokens`, `CompletionTokens`, `TotalTokens`, `CacheCreationTokens`, `CacheReadTokens`)
- **Enhanced Logging**: Enriched log fields with flow/task/subtask IDs for better traceability
- **Observation Framework**: Refactored observability with W3C Trace Context compliance (newSpanID/newTraceID functions)
- **Chain Summarization**: Enhanced algorithm with critical guarantees preserving last N QA sections even if exceeding size limits, ensuring reasoning signatures retention
- **Improved Metadata Handling**: Stop reason tracking in generation metadata for better observability

### 📚 Documentation

- **Typo Fixes**: Comprehensive typo corrections across documentation and code comments (#121):
  - "PegtAGI" → "PentAGI" in frontend README
  - "Depp Infra" → "Deep Infra", "Traversal" → "Traversaal" in EULA
  - OAuth environment variable names aligned with `.env.example`
  - Fixed filename typos (sreenshots.go → screenshots.go, wizard-integation → wizard-integration)
- **External Access Guide**: Step-by-step instructions for PENTAGI_LISTEN_IP, PUBLIC_URL, CORS_ORIGINS configuration
- **Podman Documentation**: Running PentAGI with Podman in rootless mode with non-privileged ports

---

📖 **Documentation**: For detailed setup instructions, visit the [README](https://github.com/vxcontrol/pentagi#readme) and [Quick Start Guide](https://pentagi.com/get-started)

---

## New Contributors
* @mason5052 made their first contribution in https://github.com/vxcontrol/pentagi/pull/120
* @Priyanka-2725 made their first contribution in https://github.com/vxcontrol/pentagi/pull/124
* @SkyFlyingMouse made their first contribution in https://github.com/vxcontrol/pentagi/pull/128
* @Vaibhavee Singh made their first contribution (documentation for external network access)
* @salmanmkc made their first contribution in https://github.com/vxcontrol/pentagi/pull/111
* @s-b-repo made their first contribution in https://github.com/vxcontrol/pentagi/pull/83

---

**Full Changelog**: https://github.com/vxcontrol/pentagi/compare/v1.1.0...v1.2.0