v2.7.12: Guardrails Go Instance-Wide With Their Own Judge, History Stops Hiding Your Sessions, and Employees Build Their Own Webhooks

The headline in this one is a safety feature that used to be somebody else's problem and is now available to every instance. Underneath it sits a cluster of History fixes that quietly fixed the most annoying thing about switching models, and a new skill that lets your employees wire up their own webhooks.

Guardrails, on any instance, with their own judge

The guardrail started life as a narrow feature for one deployment. It is now a first-class, instance-wide capability that runs on any instance, and it went through a long build and audit loop to get there. External review took the rule set from 8.5 to 9.8 out of 10.

It is off by default. Nothing changes on your instance until an admin turns it on, which is the only sensible default for something that can stop a message.

The design decision worth explaining is the judge model. The guardrail runs its own model, deliberately separate from the one your employees use. The reasoning is failure-mode independence: a jailbreak that fools your agent should not automatically fool the thing checking your agent. If both run the same model, you have one failure mode wearing two hats. Choosing independence costs you a little availability and buys you a lot of resilience, and we would make that trade again.

Two behaviours worth knowing. Enabled but with no model selected fails open, because a forgotten dropdown should never freeze an entire chat. A genuine judge error with a model configured fails closed. Those are opposite choices on purpose: the first protects you from your own misconfiguration, the second protects you from a silent bypass.

Detection handles obfuscation. The judge runs without chain-of-thought by default, at around 900 milliseconds, and switches reasoning on only when a message carries encoded content, at which point it decodes and judges actual intent rather than surface text. Base64, hex, URL encoding, unicode escapes, HTML entities, binary, Morse, decimal sequences. Text goes to the judge model, images go through vision. We built a 100-case adversarial evaluation harness to keep ourselves honest, weighted heavily toward false-positive traps: devops vocabulary, security education, translation, fiction, authorized penetration testing. Best run was 100 out of 100 with zero false positives and zero false negatives at a p50 of 927 milliseconds.

There is a proper editor now, at Settings, Admin, Guardrails. Structured read-only cards by default, with a pencil per rule to flip that line into inline edit. Categories are titled in the file itself, so you can rename them, add them and delete them. The rules file is volume-mounted the same way hooks are, so an edit applies within a minute with no rebuild.

History stopped hiding half your conversations

Three separate bugs here, and together they made History feel unreliable if you ever changed an employee's model.

Your sessions were being filtered by your current model. History picked which source to read based on the employee's current CLI type. Run an agent on Claude and the recent DeepSeek conversations simply were not listed. Switch to a custom model and the reverse happened. Now all four sources are merged every time, whatever the employee is running today, deduplicated by session id. One real employee went from showing a partial list to showing all 44 sessions, correctly badged as 16 Claude, 9 harness and 19 opencode.

Resuming across model families produced a blank page. You could pick a conversation recorded under one model and resume it on an agent now running a different one. The request went out carrying the old session's CLI type, the terminal could not honour it, and you got nothing. There is now a backend guard that normalises model families and refuses mismatches with an actual explanation: Cannot resume this conversation: it was recorded under X but this agent is currently Y. Switch the agent's model first. The frontend had a check already, but it was bypassable on first render, which is exactly the kind of guard that needs to live on the server.

Resuming a Claude session needed a small ritual to work. Send a prompt, refresh, stop, send again. Two bugs stacked. The respawn was re-injecting a stale conversation id from the database, so the conversation you actually picked never loaded. And messages sent during the respawn hit a dead terminal reference and crashed instead of waiting. The first is fixed by repointing the stored id before the request goes out; the second by resolving the live terminal on every attempt and retrying rather than throwing.

System messages no longer vanish on custom models

If an employee running a custom model had no active session, an incoming system message could disappear. Telegram, mail, Nova, scheduled tasks. On Claude it worked, which made it look like a channel problem rather than a startup problem.

It was three causes stacked. A freshly spawned container runs its plugin auto-hooks after the websocket opens, so a message arriving three seconds in was accepted by the socket and then ignored by a process that had not started yet; the fallback window is now long enough to cover a cold start. A configuration stub was missing two fields, which meant the agent started with no provider at all and returned empty responses with no tool calls. And an early session listing could fail while the local database was still migrating, so that read now retries.

The visible result: an employee on a custom model now answers Telegram messages that arrived while its session was cleared.

A new skill: webhook-manager

Employees can now create and manage their own webhooks. List, create, update, regenerate the secret, delete. The create command returns the public URL and the secret, shown once.

The interesting part is the authentication. The internal endpoints derive the employee from its token rather than accepting an employee id as a parameter, so there is no way to address somebody else's webhooks by guessing a number. Incoming payloads are forwarded to the employee as a tagged message.

Containers that go idle now close on your schedule

The idle sweeper stops containers that have been inactive too long and respawns them lazily with context preserved. It used to be configured through environment variables and restricted to Enterprise. It is now admin-configurable on every instance, from Admin Settings, with an enable switch, an inactivity threshold and a sweep cadence. Configuration is re-read on every pass, so a change applies on the next sweep with no restart.

While making it configurable we found it had been largely inert during working hours. The sweep excluded any employee with an active heartbeat window, and a 09:00 to 22:00 window is a default that exists on essentially every employee, while almost none of them have a real heartbeat interval set. So the exclusion was matching everybody. It now applies only to employees with an actual heartbeat configured.

Smaller things

Catalog hires get the same skills as guided hires. Resyncing a catalog employee rebuilt its skill list from an agent-specific template rather than the general one, which could leave a fresh hire with a mismatched set. Agent-specific templates are gone from resync, recreate and custom creation. A resync repairs any employee affected by this.

Panel headers are consistent. Eleven side panels had headers that were taller and darker than the reference. Three separate causes, found one at a time: a missing background, a button component 12 pixels too tall, and four pixels of padding. They now all match.

Mobile chat input stopped overflowing. Once the context badge appeared on a narrow screen, the toolbar ran out of room. The three left-hand actions collapse into a single overflow menu on mobile and stay inline on desktop, all on one aligned row.

Deleting a task asks properly. Task deletion used a native browser confirm. It now uses the same dialog as everything else.

Manage Users has a search bar, by name or email, with a filtered and total counter.

The Getting Started tour is gone. The dashboard had no live launcher for it and the entry was orphaned, so the button, the reset option and their handlers have been removed.

The LLM API Error badge finished getting quieter. We disabled terminal output scanning entirely rather than tuning it further. An agent working in a codebase inevitably echoes strings that look like API errors, and the only reliable signal is the wrapper's dedicated error channel. Real failures now render as a compact tool badge you can click, instead of a wall of text.

Want to test the most advanced AI employees? Try it here: https://Geta.Team