MentorAgent 1.1.0 release notes

MentorAgent 1.1.0 was published on NuGet on 21 October 2026 (UTC). It is a minor version: it adds three features, fixes 31 defects, 12 of them in the documentation that ships with the packages, and closes one security advisory. It has no breaking changes, so code built against 1.0.0 builds and runs with 1.1.0.

The five packages require each other at exactly this version: upgrade them together. MentorAgent 1.1.0 runs on .NET 10.

• Your own text in the confirmation box. Write the question your users confirm, in their words and their language.
• Each call follows the rules of its own method. Two methods with the same tool name no longer share roles and confirmation.
• UI actions survive a page change. The actions of the new page are no longer removed by the page you leave.
• Team approval needs the final message. A "yes" followed by a "no" no longer approves.
• A patched SignalR client. The Blazor client no longer depends on a package with a high-severity advisory.

Before an action changes data, MentorAgent asks the user to confirm. Up to 1.0.0, the box always showed the description of the tool and its arguments, in the words that MentorAgent chose. Your users read that box just before they approve a change, so it should name the record in their words and in their language.

ConfirmationMessage lets you write that text. It receives the tool, its description, the arguments as the box shows them, the Language and the services of the conversation. Return null to keep the default text:

options.ConfirmationMessage = context =>
{
    // Any other tool keeps the default text: the description, then the arguments
    if (context.ToolName != "reopen_case")
        return null;

    var caseNumber = context.Arguments
        .FirstOrDefault(a => a.Name == "caseNumber")?.Value;
    var reason = context.Arguments.FirstOrDefault(a => a.Name == "reason")?.Value;
    return context.Language == MentorLanguage.Italian
        ? $"Riaprire la pratica {caseNumber}? Motivo: {reason}"
        : $"Reopen case {caseNumber}? Reason: {reason}";
};

When the function throws or returns only white space, the box shows the default text, and a warning goes to the log.

With RequireConfirmationForWrites on, an action that declares nothing asks for confirmation, and an action that declares RequiresConfirmation = false does not. RequiresConfirmation reads false for both, so a component that lists your actions could not tell them apart.

MentorActionAttribute.RequiresConfirmationDeclared is now public and read-only. It is true when the attribute writes RequiresConfirmation, as true or as false.

Security reviews ask what a package contains and what it was built from. Each .nupkg now contains an SPDX 2.2 file at _manifest/spdx_2.2/manifest.spdx.json, with its SHA-256 beside it. The file lists the files of the package and the packages restored to build it, build-time tools included.

• A check of the public API. At pack time, every package is checked against the public API of 1.0.0. So a 1.x version cannot break code built against 1.0.0 by accident. An intended break would be listed under Breaking changes.
• A trademark notice. The NOTICE file of every package now says that "MentorAgent" and its logo are trademarks, and that the Apache License 2.0 does not license them. It points to TRADEMARKS.md ↗ (external site). The license of the code does not change.

Each defect has a severity from S1, the most severe, to S4: see Versioning and support.

Severity S2 (BUG-188) and S4 (BUG-182). Two methods can have the same tool name, for example an action of the coordinator and an action of a specialist. Up to 1.0.0, a call took its roles, confirmation, confirmation text and page from the first method found with that name. So a level-1 method without roles opened a specialist's action that had RequiredRoles to every user. Now the checks apply the rules of the method that the call runs, at every level and in both HitlMode values.

A model still calls a tool by name, so an agent offered both methods reaches only one. Now a warning names every shared tool name and its methods, the first time MentorAgent reads your actions.

What to do. If the log shows tool name(s) are carried by more than one method, rename one of the methods, or expose only one. See A tool name is carried by more than one method.

Severity S2 (BUG-186). The box showed each argument whole, in the order of the model's JSON, control and bidirectional characters included. Now each value is cleaned and cut at 200 characters, and the arguments follow the order of the method's parameters.

Severity S2 (BUG-192) and S3 (BUG-194). Blazor disposes the previous page after it has initialized the next one. A page that called PageContext.Clear() in Dispose(), as the README taught, removed the actions that the next page had just registered. The agent then answered that the action did not exist.

IMentorPageContext.Clear(pageName) clears only what that page registered, or everything when it is still the current page. Clear() still clears everything.

What to do. In each page with UI actions, call SetPageName first, and pass the same name to Clear in Dispose():

@inject IMentorPageContext PageContext
@implements IDisposable

@code {
    protected override void OnInitialized() =>
        PageContext
            .SetPageName("Orders")
            .RegisterUIAction("highlight_row", "Highlights the row",
                id => HighlightRow((int)id!));

    public void Dispose() => PageContext.Clear("Orders");
}

Also, navigate_to to a page with HasUIActions now waits for the SignalReady() of the new page, not of the page being left (BUG-194). See [MentorPage].

Severity S3 (BUG-175) and S4 (BUG-181). A [MentorTeam] with HandoffTo was approved when [TEAM:APPROVED] appeared anywhere in the discussion. Now:

• the team is approved only if its final message carries [TEAM:APPROVED] and no member wrote [TEAM:REJECTED];
• a discussion that ends without a verdict is not approved;
• without a [TeamTerminationCondition] method, the discussion ends at the first verdict instead of running all MaxIterations rounds.

The coordinator also receives each message of the discussion as a paragraph of its own, headed by its author (BUG-181). See Level 3: teams.

Severity S3 (BUG-187), a known issue since 1.0.0-rc.15. With HitlMode.Native, a session snapshot saved while a confirmation was still open made every later turn fail after a restore. Now the open requests and their answers travel with the snapshot, and the first turn after the restore answers them.

Severity S3 (BUG-167, BUG-174 and BUG-179). With a prebuilt Agent, MentorAgent now writes a warning when a feature cannot run:

• the safety checks without a ClassifierChatClient;
• the specialists, teams and RemoteAgents, which run on ChatClient.

With MemoryAutoCapture, memory now has one writer only.

Severity S3 (BUG-177 and BUG-178). These fixes concern the Model Context Protocol (MCP) server and the Agent-to-Agent (A2A) agent card:

• The A2A agent card lists only the actions that a turn can call, once per tool name, and leaves out a name when any action with it is gated.
• The warning about the actions withheld from the MCP server now comes at startup.

Severity S3 (BUG-183). With roles in a roles claim, as with Microsoft Entra ID, an action passed the role check while the model was told that the user had no role. Now the model is told the roles that IsInRole answers to, from every identity of the user.

Severity S3 (BUG-184 and BUG-185). These fixes concern retrieval-augmented generation (RAG):

• A citation such as [1, 2] or [1-2] now shows a chip for each document.
• The instruction that tells the model how to cite now follows Language.

• BUG-169 (S3): the flag of the client alone decides whether the onboarding tour is shown.
• BUG-180 (S4): the log lines of the action discovery are in English.
• BUG-193 (S4): numbers in a table inside a reply stay on one line, and a wide table scrolls inside the reply.

BUG-159, BUG-160, BUG-161, BUG-162, BUG-163, BUG-164, BUG-165, BUG-166, BUG-168, BUG-170, BUG-171 and BUG-176: the READMEs and the IntelliSense text now match the code. The full list of changes has each one.

Severity S2. Novior.MentorAgent.Blazor 1.0.0 depended on Microsoft.AspNetCore.SignalR.Client 10.0.3. Its Microsoft.AspNetCore.SignalR.Common is covered by the advisory GHSA-334f-vvp4-7g6p (CVE-2026-70159, high): a client that uses stateful reconnect can block the broadcasts of a server. 1.1.0 depends on 10.0.13, the patched version. Neither the hub nor the client of MentorAgent turns on stateful reconnect.

What to do. Upgrade to 1.1.0. If you stay on 1.0.0, add <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.13" /> to the client project.

The hub of Novior.MentorAgent.Server runs on the SignalR of the ASP.NET Core shared framework, so the host gets the fix from the ASP.NET Core runtime 10.0.13 or later.

From this version, a dependency with a high or critical advisory, direct or transitive, fails the Release build of the packages (NuGet audit NU1903 and NU1904).

This version has no breaking changes.

This version deprecates nothing.

At release, CHANGELOG.md listed no known issues for 1.1.0. Three defects of the model's behavior were still open:

• BUG-074 (S3): with MentorshipLevel.Proactive, the agent can suggest next steps that the application does not have. Closed by default from 1.2.0: see Known issues.
• BUG-118 (S2): without RequireActionForChangeRequests, the model can describe an action that it never performed. See Known issues.
• BUG-106 (S2): without RequireLookupForRecordQuestions, the model can offer to look up a value that a read action could give. See Known issues.

Found after the release:

• A2A 1.0.0-preview3. A 1.1.0 host that moves A2A or A2A.AspNetCore to 1.0.0-preview3 on its own cannot answer A2A tasks. Keep them at 1.0.0-preview2 with 1.1.0, or upgrade to 1.2.0: see A2A preview3 with MentorAgent 1.1.0.

1. Upgrade the five packages together.
2. Update the ASP.NET Core runtime of the host to 10.0.13 or later: see Security.
3. Remove the SignalR reference that you added by hand for BUG-173, if any.
4. Read the new warnings in the log: shared tool names, features that cannot run with a prebuilt Agent, and the MCP warning that now comes at startup.
5. Check your teams. A team without a [TeamTerminationCondition] method now stops at the first verdict, and a team with HandoffTo is approved only by its final message.
6. Pass the page name to Clear in the Dispose() of each page with UI actions: see UI actions survive a page change.

If you still use the MentorAgent.* packages, first read Move to the Novior.MentorAgent packages.

Every entry of this version is in the 1.1.0 section of CHANGELOG.md ↗ (external site), which is also the release notes on NuGet ↗ (external site).