Release v0.29.0

[emal-avala]

Summary

Release v0.29.0. 25 PRs since v0.28.0, headlined by the in-TUI session picker for /resume (#518) and its cross-project resume work.

Highlights

• In-TUI session picker for /resume (feat(tui): in-TUI session picker for /resume #518) — filterable list instead of an id, read and rebuilt off-thread so a large session no longer freezes input, cancellable mid-load. Project state moves with the resume: permissions, sandbox and bypass policy, hooks, tool visibility, MCP servers, [features] and [notifier]. Work staged against the departing conversation is reported back verbatim rather than run against the arriving one.
• Images mentioned in the prompt are attached (feat: attach images mentioned in the prompt #521), vi editing mode (feat(tui): vi editing mode for the composer #522).
• Persistent and prefix-scoped permission grants (feat(permissions): grants that persist across sessions #507, feat(permissions): prefix-scoped grants #530) — "allow always" survives a restart, scoped per project; a prefix grant covers git status without covering git statusx.
• Quoted destructive commands reach the guard (fix(bash): unquote tokens before the destructive-command scan #506) — tokens are unquoted before the destructive-command scan.
• CI runs on stacked pull requests (ci: run the gate on stacked pull requests #533) — a PR targeting a feature branch previously reported no checks at all rather than failing ones.

Verification (RELEASING.md section 4)

Run locally on this branch:

• cargo check --all-targets
• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test --all-targets — passes except the three bwrap_* sandbox tests, which fail on this host for environment reasons (setting up uid map: Permission denied) and pass in CI
• Cargo.lock diff is only the agent-code and agent-code-lib version lines

Still required before merge:

• GitHub Actions CI
• run-e2e workflow (label added)

After merge

git checkout main && git pull
git tag v0.29.0 && git push origin v0.29.0

Tag push drives release.yml (binaries + crates.io), docker.yml, the npm publish workflow, and the Homebrew tap update. Do not run these manually.

Known follow-ups, filed and deliberately not in this release: #537 (a resume does not restore the provider it was created against), #539 (conversation-scoped state has no single reset seam), #551 (project-root resolution blocks the TUI event loop during a cross-project resume).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc0978882d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Rename the release-prep commit as required

The reviewed commit uses the subject Release v0.29.0, but release-prep commits must use chore(release): prepare vX.Y.Z; rename it to chore(release): prepare v0.29.0 so the release history follows the repository's required convention.

AGENTS.md reference: AGENTS.md:L172-L180

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Replace the Codex commit author with the human author

The reviewed commit records Codex <codex@openai.com> as both author and committer, which adds the explicitly prohibited Codex attribution; recreate the proposed commit under the human author's identity before merging.

AGENTS.md reference: AGENTS.md:L199-L202

Useful? React with 👍 / 👎.

[emal-avala]

Both findings describe a commit that does not exist on this branch. Verified against the raw object rather than a summary:

$ git cat-file commit cc09788
author emal <emal@avala.ai> 1785266693 -0700
committer emal <emal@avala.ai> 1785266693 -0700

chore(release): prepare v0.29.0

"Rename the release-prep commit" — it is already named chore(release): prepare v0.29.0, exactly the convention cited. What reads Release v0.29.0 is the PR title, which RELEASING.md mandates in that form: "Commit messages still use Conventional Commits, but release PR titles do not." The two are different strings by design, and the finding appears to have taken the PR title for the commit subject.

"Replace the Codex commit author" — the commit is authored and committed by emal <emal@avala.ai>. There is no Codex identity on it. git log --format='%B' origin/main..origin/release/v0.29.0 | grep -iE 'co-authored-by|generated with|codex|claude' returns nothing, so there is no trailer either. The branch is a single commit, so there is nowhere else for it to hide.

I am not acting on either. Renaming the commit to the name it already has, or rewriting authorship that is already the human author's, would be changing nothing while implying the rule had been broken.

Worth noting for calibration: this is the first review in this cycle that was wrong on a checkable fact, and both findings were P1. Every previous one — across roughly a dozen rounds on #518 — held up when I checked it against the source, including several where I initially disagreed and turned out to be wrong myself. That track record is why I checked the object rather than assuming, and it is also why I am recording the miss rather than quietly ignoring it.

If there is a real attribution or naming problem I have missed, quote the object and I will fix it immediately.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: cc0978882d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".