session-peer v1.1.0

v1.1.0

Release source: 8ca77cf31254c8287a2593fe484bb30a7dba2727, dated 2026-10-09. PR #261 and feature PRs #283–#290 were merged through normal protections, followed by version/documentation preparation #291 and the test-only asynchronous diagnostics correction #293. This release does not include fleet installation or Control/Relay operational deployment.

Changes

• #242 / #283: opt-in sp shell aliases for Bash/zsh and PowerShell 5.1 preserve arguments, stdin and exit codes through the canonical session-peer command. Passive assets ship in wheel/sdist; existing aliases, functions and executables are refused, including PowerShell's default alias. No profile/PATH edits, automatic activation or Python/TypeScript dispatcher. Standalone installations require separately reviewed assets.
• #268 / #284: fail closed on inherited CODEX_SQLITE_HOME or inspected root sqlite_home before discovery, queue submission or wake. This is a bounded storage-layout guard, not relocated-database support or proof of every effective Codex configuration.
• #232 / #285: external message bodies are quoted and origin/reply claims marked unverified. Paired receiver identity means the authenticated device key, not a person or model. Framing is not a universal prompt-injection defense; its overhead counts toward limits and chars reports the framed text.
• #180 / #286: optional Claude targetGeneration discovery and --target-generation bind an original process/endpoint and recheck the connected peer before writing. Stale targets refuse before effect. Codex, Antigravity and paired-device generation guarantees remain unsupported; unsupported mode never upgrades on writer restart.
• #183 / #287: optional --ssh-identity reports connection host-key evidence; --require-ssh-host-key pins that actual connection before authentication or remote execution. POSIX ordinary Ed25519/RSA/ECDSA keys are supported; host certificates and security-key types are not. A host key is not agent identity, session generation or ACK.
• #238 / #288: cooperative wake depth/origin propagation and bounded per-target activation rates supplement existing wake guards. Filtered/lost environment can start a new origin, and shared MCP startup environment is not per-call context. Native wake remains restricted to the previously validated Codex 0.154.0 path.
• #211 / #289: session-peer setup offers read-only local/SSH/Relay inventory and explicitly approved actions. Default inspection creates no keys/database; manager guidance never auto-installs. Existing policy is not broadened, original enrollment intent is durable, and readiness probes send no messages. Foreground receiver setup does not install a service.
• #181 / #290: experimental opt-in handoff adds durable sender fencing, bounded stdin/process handling and receipt-only status/wait/ACK operations. Local POSIX Claude supports the validated original-generation receipt path; local Codex and one-destination POSIX source-streamed SSH support correlation-only submission with observation/ACK unsupported. Required delivered/acknowledged waits refuse before effect on unsupported channels. Remote receipts, Windows, paired handoff, multi-host opt-in, body-free Codex observation and full restore acceptance remain separate gates.
• #292 / #293: isolate admission diagnostics tests from unrelated asynchronous listener callbacks. Product logging and rate limits are unchanged; the exact log-count and safety assertions remain enforced.

Compatibility and safety boundaries

Core requires Python 3.9+, MCP 3.10+, and Unix/WSL Relay 3.11+. Ordinary opt-out results retain their native optional fields; posted, queued and submitted do not prove consumption. Unknown results never authorize automatic resend. Experimental waits use a per-destination 30-second default, integer 1–60-second budget and 5-second cleanup reserve; status and receipt operations submit no native message. Receipt authority proves token possession, not model identity; the recipient's native history may retain delegated authority.

Final framing counts toward Codex/paired 32 KiB, paired application JSON 64 KiB (including JSON escaping), worker 256 KiB and queued-record 1 MiB bounds. Ordinary SSH retains the 90,000-character and 131,071-byte command guards. A valid complete native response may survive transport failure; incomplete or oversized protocol output remains uncertain.

The bundled skill stays 0.3.2, with minimum/full runtime compatibility 0.9.1/1.0.1. Companion skill PR #30 is separate and unreleased: merge, release and exact snapshot synchronization are prerequisites for its updated guidance, not part of this package release. #180, #181 and #268 retain their explicitly unsupported acceptance gates.

Validation limits

Local combined candidate validation covered owned fixtures and isolated installations, not new live agent/SSH/Relay acceptance. Historical 20/21 ACK evidence and open #161 are unchanged; they do not validate 1.1.0. Keep remaining platform/capability gaps visible. Existing asynchronous Relay fixture teardown diagnostics are a separate known limitation, not claimed fixed by #293.

Package publication does not include operational deployment. Human PyPI environment review, fleet installation and Control/Relay deployment are separate steps requiring their existing approvals. No service restart or new availability claim is established by this release.

One known Low-severity Dependabot alert, GHSA-r374-rxx8-8654, concerns the development-only Paramiko dependency in the SSH test requirements and has no listed patched version. It is not a shipped runtime dependency; successful runtime audits are not a claim of zero repository vulnerabilities.