DocsGPT 0.19: Agents That Make Things (and Know When to Stop)
Agents now produce versioned files, run code in a sandbox and operate behind configurable guardrails, while the chat shows every step as it happens.
Pavel Torbin6 min readreleaseagentsguardrailsartifacts
Agents earned their place by answering questions well. Handing them real work is a different bargain: you want output you can actually ship, and rules the agent can’t talk its way around. DocsGPT 0.19 delivers both sides of that bargain. Agents now produce versioned files, run code in a sandbox, and operate behind configurable guardrails, while the chat finally shows you what’s happening as it happens.
Artifacts: Agents That Ship Files, Not Chat Bubbles
Ask an agent for a quarterly summary and until now you got markdown to copy-paste somewhere more useful. In 0.19, agents produce artifacts: real files that live alongside your conversation with full version history. Every artifact is versioned append-only, so an agent editing a document creates a new version instead of destroying the old one. You can preview them inline, download them, or restore any earlier version. Agents refer to them by short handles like A1 and A2, which keeps multi-file work legible.
Three new tools do the producing. code_executor runs agent-written Python in a sandbox and captures any output files as artifacts. artifact_generator builds presentations, documents, spreadsheets, and PDFs from structured specs. document_extractor goes the other direction, converting PDFs and Office files into structured JSON via Docling. Wire them into a workflow and artifacts pass between steps by reference, so an extract-transform-generate pipeline never stuffs file contents through the prompt.
The sandbox is pluggable: a self-hosted Jupyter Kernel Gateway container, or Daytona cloud VMs when you want per-session isolation. We treated it as the attack surface it is. The kernel environment is scrubbed of API keys and the DB URL, network egress to internal ranges is blocked, and the whole thing ships off by default.
Why it matters: the gap between “agent that chats about your data” and “agent that does your work” is whether you can hand its output to someone else. A file with version history is a deliverable. A chat bubble isn’t.
Guardrails: Rules the Agent Can’t Talk Its Way Around
More capable agents raise the obvious question: what stops one from saying or doing something it shouldn’t? Until now the honest answer was your system prompt, and hope. 0.19 adds guardrails: checks that run outside the model at four intervention points - user input, retrieved sources, tool results, and the final answer.
Seven checks ship built in, and they come in two flavors. The deterministic ones are pattern-based and fast, one to five milliseconds: personal information (emails, phone numbers, national IDs, card numbers with Luhn validation), credentials and secrets (AWS, GitHub, OpenAI, Slack key formats, JWTs, private keys), banned terms, link policy with host allow/block lists, and prompt-injection heuristics that pattern-match instruction-override phrasings like “ignore your previous instructions” and fake system turns. The LLM-judge check is the flexible one: write a custom policy in plain language (“never discuss pricing”, “stay off competitor products”, “hold a formal tone”) and a judge model decides whether content violates it, with a confidence threshold you control. The judge runs on your instance’s own model, so self-hosted deployments get semantic guardrails with no extra vendor and no extra account.
Every check binds to a stage with one of three actions: flag it in the event log, redact the matched spans, or block with a message you write. A monitor-only mode lets you trial a config against real traffic before enforcing anything, a fail-open/fail-closed policy decides what happens when a check itself can’t run, and a guardrail events panel records every trigger so you can see what your rules are actually catching.
One design choice we want to defend out loud: the UI tells you what each check can’t do. The groundedness check states that lexical overlap is a proxy, not entailment. The injection heuristic admits it catches unobfuscated payloads only. A guardrail you overtrust is worse than no guardrail, so the honest label is part of the feature.
Why it matters: a customer-facing agent needs its deny-list living outside the prompt, where a jailbreak can’t negotiate with it and an audit can see it.
A Chat That Shows Its Work
When an agent spends half a minute reasoning, calling tools, and reading results, a frozen typing indicator is not an acceptable interface. Chat now renders inline streaming steps: reasoning and tool calls appear live inside the conversation, in order, as the agent works through them. You can watch it decide to search a source, see the call go out, and see what came back, instead of staring at three dots and receiving a paragraph by fiat.
The conversation surface got a matching pass. A rebuilt message scroller kills the jitter that used to creep in during long streamed answers, message input and conversation bubbles picked up a round of fixes, and the avatar chrome around bubbles is gone in favor of a cleaner live-step state. Over in the workflow editor, undo/redo landed along with a set of UX refinements, so experimenting with a graph no longer feels irreversible.
Why it matters: trust in agents is mostly legibility. An agent whose steps you can watch is one you’ll actually delegate to.
Also in 0.19
A release this size carries a long tail of smaller wins:
- Agent key rotation, so you can cycle an agent’s API key without rebuilding the agent
- Chunks preview when managing sources, showing exactly how a document was split before an agent ever retrieves from it
- Accurate per-call token usage and oversized-context guards, so cost tracking matches reality
- More durable tool calling: long-running calls survive, multi-tool-call handling is fixed, and pause is more durable
- Agents now communicate their capabilities in both prompt and endpoint, so callers can discover what a given agent can do
- Source authorization hardening, and silent retrieval failures now surface instead of degrading answers quietly
Welcome to first-time contributors @mmustafasenoglu (Vite HMR polling fix for Docker on Windows), @roshanroy-lang (README cleanup), and @immuhammadfurqan (proper logging in the backend).
Hand It Real Work
0.19 is one idea shipped twice: give agents more power, and give you matching control. An agent that produces versioned files inside guardrails you wrote, while showing you every step, is an agent you can put in front of actual work.
- Try DocsGPT Cloud
- Explore the Repository
- Join our Community on Discord, X and LinkedIn