v1.2.0

Native GLM ACP v1.2.0

This release adds the safe extensibility roadmap without weakening Native GLM ACP's existing permission, workspace, verification, or secret boundaries.

What’s new

• Conflict-aware checkpoints and /rollback — bounded snapshots are created before workspace mutations. Common secret files are excluded, exact agent-produced hashes are tracked, and rollback stops before writing if a later edit conflicts.
• Bounded context references — @file:, @folder:, @symbol:, and @diff stay inside workspace roots, enforce file/character limits, omit common secret paths, and enter context as untrusted data.
• Declarative policy engine — ordered allow/ask/deny rules cover tools, paths, and bounded command patterns. Invalid policy fails closed, nested workflow steps are evaluated, and policy cannot grant more authority than the active session mode.
• OS-level command sandboxing — optional or required Bubblewrap isolation on Linux exposes system runtimes read-only, mounts only declared workspace roots writable, hides the user home, and supports network isolation.
• Declarative workflows — static acyclic graphs of up to 12 allowlisted tool steps execute in dependency order and stop on failure; arbitrary orchestration code is not supported.
• Worktree-isolated implementation workers — opt-in editing workers use detached locked Git worktrees, require network-disabled OS isolation for commands, return unmerged diffs, and preserve dirty worktrees for review.
• Isolated user profiles — GLM_ACP_PROFILE separates credentials, sessions, telemetry, hooks, MCP config, cron state, checkpoints, worktrees, plugins, and private user memory while default preserves legacy paths.
• Hash-pinned plugin packages — permission-scoped, data-only packages enforce per-file hashes, an installed manifest pin, package bounds, promptware scanning, and rejection of executable content.

Verification

• 436 offline tests passed.
• Ruff passed for the complete runtime and new safety suite.
• pip-audit found no known dependency vulnerabilities.
• Wheel, sdist, and frozen executable builds passed.
• Frozen ACP JSON-RPC initialization passed and advertised version 1.2.0.
• Release CI built and verified Linux x86-64/ARM64, macOS Intel/Apple Silicon, and Windows x86-64 archives with SHA-256 files and provenance attestations.

Full changelog: v1.1.0...v1.2.0