Release v0.18.5

What's Changed

• fix(core): require opt-in for plan mode prompt by @tt-a1i in #5433
• test(core): drop duplicate gitdiff untracked count case by @tt-a1i in #5468
• fix(core): evaluate ignore files named with dot prefixes by @tt-a1i in #5458
• fix(core): enforce shell directory workspace boundary by @tt-a1i in #5454
• fix(core): validate lsp socket ports by @tt-a1i in #5493
• fix(core): parse max output token env strictly by @tt-a1i in #5491
• fix(core): detect providers by hostname by @tt-a1i in #5450
• fix(cli): validate ACP glob max results by @tt-a1i in #5480
• fix(core): allow dot-prefixed plans directories by @tt-a1i in #5460
• fix(extensions): fetch http marketplaces with http client by @tt-a1i in #5452
• fix(cli): parse FORCE_HYPERLINK strictly by @tt-a1i in #5489
• fix(core): parse tool concurrency env strictly by @tt-a1i in #5496
• fix(cli): enforce custom theme home boundary by @tt-a1i in #5456
• fix(dingtalk): skip uppercase webhook reaction targets by @tt-a1i in #5466
• fix(desktop): accept uppercase icon URL schemes by @tt-a1i in #5470
• fix(cli): reject partial session size values by @tt-a1i in #5475
• fix(telegram): clear typing intervals on disconnect by @tt-a1i in #5477
• fix(cli): respect installation path boundaries by @tt-a1i in #5441
• fix: accept uppercase endpoint URL schemes by @tt-a1i in #5443
• fix(core): reject fractional computer-use integer strings by @tt-a1i in #5500
• fix(core): match provider base URL slash variants by @tt-a1i in #5448
• fix(cli): enforce temp path boundaries for at-file by @tt-a1i in #5446
• fix(desktop): preserve uppercase favicon URLs by @tt-a1i in #5463
• fix(desktop): parse NO_PROXY ports strictly by @tt-a1i in #5498
• fix(serve): validate session reaper timeouts by @tt-a1i in #5484
• fix(extensions): handle uppercase npm registry schemes by @tt-a1i in #5437
• fix(core): add missing Token Plan models (qwen3.7-plus, glm-5.2, kimi-k2.7-code) by @huww98 in #5505
• fix(cli): wire ACP model-invocable commands by @tt-a1i in #5504
• fix(cli): reject partial cpu profile durations by @tt-a1i in #5486
• test(desktop): update blocked scheme open-url assertion by @tt-a1i in #5529
• fix(desktop): restore locale parity by @tt-a1i in #5537
• fix(extension): accept uppercase URL schemes in Claude plugin sources by @he-yufeng in #5461
• fix(desktop): parse server ports strictly by @tt-a1i in #5509
• fix(desktop): validate generic oauth token responses by @tt-a1i in #5511
• fix(core): don't treat an empty-parts message as a function call/response by @he-yufeng in #5494
• fix(desktop): allow double dots in bundle filenames by @tt-a1i in #5515
• feat(core): add Requesty provider by @Thibaultjaigu in #5478
• fix(cli): handle truncated remote input files by @tt-a1i in #5473
• test(core): wait for cron lock probe takeover by @tt-a1i in #5535
• perf(core): read current git branch directly from .git instead of spawning git by @wenshao in #5432
• fix(vscode): keep UNC paths absolute by @tt-a1i in #5542
• chore(release): v0.18.4 by @qwen-code-ci-bot in #5464
• feat(ci): on-demand tmux real-user testing for PRs by @yiliang114 in #5203
• test(desktop): align interceptor packaging contract by @tt-a1i in #5531
• fix(desktop): keep sibling paths absolute by @tt-a1i in #5517
• test(desktop): enable feedback flag in permission tests by @tt-a1i in #5533
• fix(cli): allow dotfile paths in Web Shell sendFile by @wenshao in #5541
• fix(cli): allow double dots in update archives by @tt-a1i in #5521
• fix(desktop): separate transform data output lines by @tt-a1i in #5525
• fix(desktop): handle Windows file mentions by @tt-a1i in #5523
• ci(release): trigger CI from release branch pushes by @yiliang114 in #5543
• fix(desktop): consolidate path boundary checks by @tt-a1i in #5545
• fix(desktop): reject fractional transfer sizes by @tt-a1i in #5527
• docs(triage): Add reuse-before-new-code review check by @yiliang114 in #5547
• fix(cli): validate ACP file read windows by @tt-a1i in #5482
• fix(extensions): accept uppercase marketplace source schemes by @tt-a1i in #5435
• Use VS Code theme tokens for companion scrollbar by @interconnectedMe in #5488
• feat(mcp): support MCP resources and reliably surface prompts by @wenshao in #5544

New Contributors

• @Thibaultjaigu made their first contribution in #5478
• @interconnectedMe made their first contribution in #5488

Full Changelog: v0.18.4...v0.18.5