代理框架與 RAG
Agno 3.0.7/3.0.8 Publishes Agent Knowledge as Versioned Pages and Closes a Session Ownership Gap
Agno adds atomically publishable page knowledge with revision-pinned reads, alongside a PublicSurface that limits inputs and outputs for Agent, Team, Workflow, and MCP services. Version 3.0.8, released hours later, adds full-page reads and ownership checks for SQLite batch writes; upgrades must also account for changes to HNSW search semantics.
Agno 3.0.7 expands its knowledge base beyond a simple vector collection with `agno.knowledge.page`. A single publish operation coordinates directory metadata, filesystem text, and vectors, preserving the previous revision if an update fails. Agents can search, read, list, and grep through synchronous or asynchronous APIs. The new `PageFileSystem` permits only lazy reads against a pinned revision; it provides no shell access, write capabilities, or arbitrary filesystem permissions. This design makes RAG answers traceable to a consistent snapshot and prevents mixed states in which the index has been updated while the source text remains on an older version.
The same release introduces `PublicSurface`, which explicitly selects the Agent, Team, stateless MCP services, and durably synchronized Workflow to expose. They share quotas, request and output limits, CORS settings, and internal service authentication. Routes for Team members that were not selected are not exposed as a side effect. For teams turning internal agents into APIs, this makes the attack surface easier to define than exposing the complete AgentOS route set directly.
Released hours later, 3.0.8 adds `read_full_page` and `aread_full_page`, returning an entire page through a single bounded SQL read and a read-only snapshot. Calls can pin a revision and impose character-count and deadline limits; oversized pages return `None` immediately. These operations share eight workers with the existing read methods. The release also fixes SQLite `upsert_sessions()`: previously, if a batch contained a `session_id` belonging to another user, it could reassign and overwrite that row. Batch upserts now apply the same owner predicate as single-record upserts.
The upgrade risks should not be overlooked. The `Knowledge` constructor is now keyword-only, and page search no longer silently forces PgVector HNSW `ef_search` to 200. Deployments that depend on the old behavior must set the parameter explicitly, while indexes created by an interim release with an implicit `ef_construction=64` must be rebuilt manually. Engineering teams should prioritize testing revision consistency, the list of exposed routes, SQLite multi-tenant isolation, and recall and latency under the new HNSW settings.