GAIA v0.23.0 Release Notes
GAIA v0.23.0 makes the agents easier to get, safer to run, and easier to extend. You can now browse, install, and run agents straight from the terminal withgaia hub, and add new capabilities to an agent as signed, auditable skills. Under the surface it’s a security release: the local API and MCP bridge no longer expose themselves to the network by default, the confirmation prompt that pauses an agent before it sends mail, writes a file, or runs a command now works from the terminal and over the local API and MCP — not just inside the graphical app — and an agent can no longer quietly reach into your ~/.gaia config or slip crafted SQL into the database agent. Connecting a Microsoft account is now an explicit Personal-or-Work/School choice with a zero-setup sign-in.
Why upgrade:
- Get agents from the terminal —
gaia hubbrowses, installs (behind a trust prompt for unverified agents), runs, and removes agents without leaving the shell. - Every agent asks before it acts — the confirmation gate for sending mail, writing files, and running commands now works in the terminal, over the local API, and across MCP tools, not only in the Agent UI.
- Safer by default — the MCP bridge binds to localhost, the local API refuses credentialed cross-origin requests from arbitrary sites, MCP servers launch without a shell, and an agent can’t write into
~/.gaiaor reach the database with crafted SQL. - Build and share skills safely —
gaia skillmakes skills first-class: create, import, sign with trust tiers, and audit them before sharing. They’re opt-in — you add the ones you want. - Connect a Microsoft account without a secret — Personal and Work/School are now separate connectors with device-code sign-in and no client secret required.
The email agent is beta and CLI-first this release. It runs locally and never sends,
forwards, or deletes without your confirmation — that safety gate is verified. This cycle
was mostly robustness and correctness: sturdier Outlook and calendar handling, honest
reporting when a scan is truncated, and a long list of fixes (see Bug Fixes). It’s still
early — a full inbox triage can currently time out on larger mailboxes, and autonomy is
experimental and not yet wired up in the packaged sidecar. Treat its output as a draft to
review, and please report what you run into.
Breaking Changes
GAIA_MICROSOFT_TENANT is gone
The Microsoft connector was split into two explicit connectors — Personal and Work/School — each with its own hard-coded tenant, so the GAIA_MICROSOFT_TENANT environment variable no longer does anything and has been removed (PR #2729). If you set it to work around the old single-connector tenant guessing, drop it and pick the connector that matches your account instead (see Microsoft accounts below).
What’s New
Install and run agents from the terminal — gaia hub
Getting an agent used to mean the graphical app or a manual pip install. Now the hub is in your shell: gaia hub list shows the catalog, gaia hub install <agent> --trust installs one (the --trust is required for an unverified agent — it will not install silently), and gaia hub uninstall <agent> removes it. The install → run → uninstall round-trip works end to end against the live catalog, with the trust prompt actually enforced (PRs #2484, #2530, #2708). Try it: gaia hub list.
Every agent asks before it acts — beyond the Agent UI
The confirmation prompt that pauses an agent before a consequential action — sending or deleting mail, writing a file, running a shell command — used to work only inside the Agent UI; from a terminal, the local API, or an MCP tool call those actions could run unprompted. This release closes those paths: the gate now fires from a plain terminal, through thegaia api server, and across MCP tool calls, classifying a tool as read-only or mutating and failing closed when unsure. The agent stops and asks before the action, declining leaves nothing changed, and setting GAIA_AUTO_APPROVE_TOOLS=1 in your environment is the explicit way to opt out (PRs #2475, #2544, #2846, #2854).
Safer by default — a security-focused release
Several local exposures are closed this release. The MCP bridge binds to127.0.0.1 by default instead of every interface, so it isn’t reachable from other machines on your network unless you pass a bind-all host, and it can now require an --auth-token that is actually enforced rather than ignored. The local API server no longer echoes an arbitrary origin back with credentials allowed — a cross-origin request from a site that isn’t allow-listed is refused. MCP servers are launched without going through a shell, so a server name can’t smuggle shell metacharacters; an agent can no longer write into your ~/.gaia configuration; and SQL supplied by the model is blocked from reaching the database agent’s statements rather than being executed (PRs #2246, #2238, #2344, #2844, #2847, #2860).
Build and share skills — gaia skill
A skill gives an agent a new capability from a folder with a manifest — no new Python, no forking the agent. gaia skill create <name> scaffolds one, gaia skill import adds a skill so an agent can discover it, and gaia skill list / info show what’s installed and the permissions each one declares. Sharing is guarded: skills carry signatures with trust tiers — an unsigned or untrusted skill is capped at the lowest tier, and tampering is caught by checksum — a pre-publish audit rejects a skill that attempts prompt injection or shell=True/eval, and gaia skill migrate converts skills authored in other formats. Skills are opt-in: no agent loads them automatically yet, so you add the ones you want (PRs #2669, #2692, #2702, #2693). Try it: gaia skill list.
Microsoft accounts: Personal and Work/School, no secret required
Connecting a Microsoft account is now two clear choices instead of one connector guessing your tenant.gaia connectors list shows Microsoft as two distinct connectors — Personal and Work/School — each with a zero-setup device-code sign-in (a code and a URL to visit) and no client secret required for a public app registration (PRs #2718, #2364).
Lemonade Server 11.5.0
This release runs against Lemonade Server 11.5.0 — the version installed bygaia init and pinned across CI and the installer.
Bug Fixes
A selection of the user-visible fixes this release — the full list is in the changelog below.- Triage now paginates large inboxes and reports truncation honestly (PR #2646) — no more silently dropping mail past a hidden limit.
- Thread messages come back sorted and numbered (PR #2570) — “reply to 3” hits the message shown at position 3, not raw backend order.
- The inbox pre-scan stops reporting a guess as a verdict (PR #2587) — an uncertain classification is surfaced as uncertain.
- An email conversation survives its turns (PR #2837) — a follow-up question keeps the session context instead of starting over.
- A bare reconnect no longer guts a mailbox (PR #2733) — reconnecting an account keeps its existing grants instead of wiping them.
- Restore from Trash anytime (PR #2542) — undo an archive/trash without a narrow time window; the dead permanent-delete path was removed.
- A low-priority sender no longer forces a promotional label (PR #2774) — sender priority stops overriding the actual content classification.
- The agent survives an OpenMP double-init (PR #2508) — a mid-conversation native-library clash no longer kills the run.
- Large tool results are truncated to valid JSON (PR #2645) — an oversized result no longer produces unparseable output.
- A missing model surfaces as a real 404 (PR #2245) — the builder names the missing model instead of a generic placeholder.
- GPU is detected on all platforms and default_device is honoured (PR #2244).
- A sidecar that is alive but has stopped serving is now detected (PR #2707) — a wedged agent process is caught instead of hanging.
- The model-slot lease is held across inference, not just the load (PR #2394) — a second agent can’t evict the model mid-generation.
- A browser that never launched is surfaced (PR #2507) — a failed OAuth browser open reports an actionable error instead of hanging.
- Stop actually aborts in-flight streaming (PR #2166) — the Agent UI Stop button ends generation immediately.