Tencent's WeKnora v0.8.0 ships a skill sandbox and auto-Wiki for enterprise RAG

Tencent’s WeKnora hit v0.8.0, and the changelog is worth reading closely. The open-source knowledge platform, published on GitHub, now runs its agent skills in session-persistent sandboxes backed by Docker, E2B, or Cube. The previous local host-process backend is gone. Docker is opt-in. Each tenant gets its own network policy. That is not a feature bullet. It is an admission that autonomous agents executing code inside enterprise infrastructure need a containment boundary that a host process cannot provide.

The rest of the release is equally specific. A tenant skill catalog installs from ClawHub, SkillHub, git, or zip, with per-sandbox snapshots and live progress. Cross-session long-term memory extracts profiles, preferences, facts, tasks, and interests, with a search_memory call and an auto-extract confirmation step. There is an in-process anydoc office parser, an official DeepSeek Harness plugin (@wxg-prc-cpg/dsh-weknora), GitLab and Tencent IMA data sources, LiteLLM support, Exa and Metaso web search, XMind parsing, context compaction, and provider prompt-cache markers. Plus OIDC JWKS verification and optional complex passwords.

The sandbox removal is the real story

Read the v0.8.0 notes again: “Local host-process backend removed; Docker opt-in.” That line deserves more attention than it will get. For most of the past two years, the default way to let an LLM agent run code was to hand it a subprocess on the same machine as the orchestrator. Fast to build. Easy to demo. Catastrophic in production, where a prompt-injected document can tell the agent to read environment variables or write outside its working directory.

WeKnora’s move to per-tenant network policy and session-persistent sandboxes is the enterprise-grade version of that lesson. Session persistence matters because agents that lose their filesystem between turns cannot do real work. Per-tenant network policy matters because a skill installed by one workspace should not be able to reach another workspace’s services. Neither is glamorous. Both are the difference between a demo and a deployment.

The tenant skill catalog is the second half of that story. Installing skills from ClawHub, SkillHub, git, or zip, with per-sandbox snapshots and live progress, is a supply-chain surface. WeKnora is treating it like one, with snapshots and a file browser rather than a fire-and-forget install. Compare that to the broader agent ecosystem, where “just pip install the tool” is still the norm in too many frameworks.

Wiki Mode is the most interesting bet

WeKnora’s Wiki Mode, which went GA back in v0.5.0, now has page revision history with snapshots, line-level diffs, one-click rollback, and in-browser manual editing. The agent distills raw documents into interlinked Markdown pages and builds a knowledge graph over them. Humans can edit the output, and the system tracks who changed what.

That is a different bet than pure RAG. Standard retrieval-augmented generation treats documents as static chunks to be embedded and searched. Wiki Mode treats them as raw material for a synthesized, editable knowledge base that improves over time. The v0.5.2 note that Wiki ingest scales to 40,000-document knowledge bases, with a task queue and dead-letter queue, suggests Tencent has actually run this at size rather than just shipping the feature.

The chunk editing with revision history is the same idea applied one level down. Retrieval chunks become editable, diffable, revertible objects. If a chunk is wrong, you fix it and the system reindexes. That is a meaningful departure from the “embed once, hope forever” pattern that plagues most RAG deployments.

WeKnora is not selling a model. It is selling the plumbing that makes someone else’s model safe enough to point at a company’s document store.

The provider list tells you who this is for

WeKnora integrates with OpenAI, DeepSeek, Qwen, Zhipu, Hunyuan, Gemini, MiniMax, NVIDIA, LiteLLM, and Ollama. That is a deliberately broad list, and it reads as a hedge. Tencent is not betting that Hunyuan wins. It is betting that enterprises will want to swap models without rewriting their retrieval stack, and that a Chinese vendor shipping a self-hostable, model-agnostic platform is a safer procurement choice than a US-hosted SaaS.

The data source list reinforces the point: Feishu wiki, Feishu Drive, GitLab, Tencent IMA, Notion, Yuque, DingTalk Docs, RSS, and more. IM channels include WeCom, Feishu, Slack, and Telegram. Office files parse in-process with anydoc. The whole thing is self-hostable with support for local and private cloud deployment, which the README frames as “complete data sovereignty.”

Data sovereignty is the load-bearing phrase. For a European bank or a Chinese state-owned enterprise, the question is not whether WeKnora’s RAG is better than a hosted alternative. It is whether the documents can leave the building. Tencent is answering no, and shipping enough enterprise surface (four-tier RBAC, per-workspace audit logs, AES-256-GCM credential encryption, OIDC JWKS verification, scoped API keys with a principal model) to make that answer credible.

What this means for builders

Three things stand out.

First, the sandbox is table stakes now. If your agent framework runs skills on the host process, you are behind. WeKnora’s v0.8.0 release is a useful reference for what the minimum viable containment looks like: per-tenant network policy, session persistence, snapshotting, and a catalog that tracks what got installed where.

Second, memory is becoming a first-class subsystem. Cross-session long-term memory with typed extraction (profile, preference, fact, task, interest) and a confirmation step is more structured than the “just stuff it in a vector store” approach most teams ship. The auto-extract-with-confirm pattern is worth copying.

Third, the Wiki Mode bet is the one to watch. If agents can maintain an editable, versioned knowledge base that humans can correct, the value of a document store shifts from retrieval accuracy to curation workflow. That is a harder product to build and a stickier one to sell.

WeKnora is not selling a model. It is selling the plumbing that makes someone else’s model safe enough to point at a company’s document store. The v0.8.0 changelog is a list of the plumbing details that matter, and the fact that a Tencent team shipped them in the open is a useful signal about where enterprise AI is actually heading.

The open question is whether the skill catalog becomes a real ecosystem or a graveyard of half-maintained installs. ClawHub and SkillHub are not yet the npm of agent skills. WeKnora’s snapshotting and file-browsing tools suggest the team knows that, and is building the safety rails before the traffic arrives.