v2.7.18: Your Agent's Inbox Can Now Be Screened, Gmail Gets Attachments, and Long Tasks Stop Quitting Halfway

Up to now, the guardrail that screens what reaches your AI employee only ever looked at one thing: what you typed into the chat box. Email, Slack, Teams, Telegram, WhatsApp and webhook payloads all went straight through, unread by the classifier.

Which is backwards, when you think about it. The chat box is the one channel where the person on the other end is you. Everything else is where a stranger gets to write directly to your agent.

That is the headline of v2.7.18, and it comes with a deliberate caveat we want to be upfront about.

Your agent's inbox can now be screened before delivery

Inbound external messages are now judged before they reach the employee. Sender, subject and body across every external channel, plus image attachments on Gmail and Outlook, which go to the same image judge already used for images pasted into chat.

Internal traffic is exempt on purpose. Nova, employee-to-employee delegations and platform triggers like heartbeats or scheduled tasks are generated by us, not by an outsider, so spending an LLM call to judge them would be pure waste.

One detail that matters if you run a team: a blocked inbound message does not count a strike against you. Someone else wrote it. You should not be penalised because a stranger sent your agent something hostile.

This is off by default, and it is separate from the chat guardrail. Turning the chat guardrail on does not silently start withholding your mail. You have to enable it explicitly with a new toggle, "Also screen incoming messages," which sits under the guardrail switch in the Guardrails sheet.

Why so cautious about a security feature? Because a blocked message is dropped silently. Neither you nor the sender is told. And on the free tier, the judge is the employee's own small model, which we have watched return confidently wrong verdicts. Defaulting that combination to on would mean occasionally eating a real customer email with no trace anyone would notice. That trade is yours to make deliberately, not ours to make for you, so the toggle warns you about the silent-discard behaviour before you flip it.

What it does not cover yet

Documents are out of scope. PDFs, ZIPs and DOCX files pass through unjudged, because the classifier is explicitly instructed never to open them. A booby-trapped document gets through, and so does its content later, when your agent opens it with a tool. Image attachments on Slack, Teams and webhooks are also still text-only for now; only Gmail and Outlook forward images to the judge.

We would rather say that plainly than let anyone believe this closes the whole surface. It closes the biggest, most-used part of it.

Reasoning levels are open to everyone

Custom LLM reasoning controls now expose the full set of levels to every user on every tier: default, off, none, low, medium, high, xhigh and max.

There was also a detection bug worth mentioning. Models named openai/* but routed through OpenRouter were being restricted to the native OpenAI vocabulary, which is a narrower set. Detection now keys off the endpoint you actually configured rather than the model's namespace, so an OpenRouter-routed model gets OpenRouter's levels. Backend proxy, effort persistence and the model picker are all aligned on the same list.

Long tasks stop quitting halfway

If you have ever set an agent on a genuinely long job and watched it stop mid-work without finishing, this one is for you.

Custom LLM employees had an output ceiling of 8192 tokens. At high reasoning effort, particularly max, the reasoning alone could consume that budget before the agent got through its tool workflow. The symptom was distinctive and maddening: no error, no crash, just a task that stopped while the agent was clearly still working.

The ceiling is now 32768 for every custom LLM employee, applied automatically at spawn. It covers all modes and tiers. Existing sessions need a respawn to pick it up.

Gmail finally does attachments

Both directions, on every tier where the mail connector is available.

Outgoing: --attach now works on send, reply and draft, and accepts multiple files. Incoming: attachment IDs show up when your agent reads a message, and download-attachment pulls the file down. Nested MIME parts are searched recursively, so attachments buried inside forwarded threads are actually found rather than quietly missed.

Office365 already had most of this, and we audited it to confirm. One honest gap remains there: office365-mail reply still does not accept attachments. It is on the list.

The Chrome extension signs in with Google and Microsoft

The extension now supports the free-tier public authentication flow, without embedding any Google or Microsoft secrets in the extension itself.

Login is a two-step wizard now. Instance URL first, authentication method second. Once the instance is confirmed, the extension asks it what it supports: public free-tier instances offer Google and Microsoft sign-in buttons, while private instances keep the classic email and password form.

The handoff uses short-lived, hashed, single-use codes with a two-minute lifetime. We also removed chrome.identity and its permission entirely, which means Chrome no longer shows that alarming account-access banner during install. The buttons now match the web login styling, with proper logos, and the Google button follows your browser language.

One practical note: a fresh ZIP is not enough to update an extension you already loaded unpacked. You have to reload it from chrome://extensions.

Smaller things that were quietly annoying

Numbered lists that counted 1, 1, 1, 1, 1. Ask an agent to space out a numbered list and you get standard loose-list markdown with blank lines between items. Both of our markdown renderers treated every blank line as the end of the list, so each item became its own list and restarted at one. Blank lines now only close a list when what follows is not another item of the same list, and lists start at whatever number the author actually wrote.

File paths that looked like corrupted output. A path written by an agent was rendered as a link labelled with just the filename, so a full path mid-sentence showed as index.html with stray backticks around it. It read like a streaming glitch. Paths now display in full, in monospace.

The catalog that opened on a full dashboard. The employee catalog auto-opened whenever your account owned no employees, which fired for admins who could see every employee on the instance and for users who had one shared with them. It now opens only when the list you are actually looking at is empty, and only after loading finishes.

Task scheduler documentation that lied to paying customers. The skill documentation stated two limits as absolute platform rules: a maximum of two scheduled tasks per employee, and recurring tasks firing once per UTC day. Both are free tier only, and always were. But the documentation was a static file shipping those limits unconditionally, so agents on unlimited instances read it and told their owners about restrictions that did not apply to them. The limits text is now injected at install time only when the instance is actually on the free tier.

That last one is a variation on a theme we hit in v2.7.16, where a skill was installed but never documented, so the agent behaved as though it did not exist. Same lesson from the other direction: your agent believes its own documentation. If that documentation is wrong, the agent is confidently wrong, and it sounds exactly as certain as when it is right.

Update, and if you want inbound screening, go turn it on deliberately.