v2.5.1

What's Changed

• fix(kiro): drop --legacy-ui, which silently disables every MCP tool by @gutosantos82 in #691
• test: centralize contributor suite selection by @vinhnguyenthanhdn in #687
• fix(sessions): batch the list_sessions terminal read and specify its ownership order (#629) by @tedswinyar in #703
• feat: Add EKS deployment with elastic, task-scoped CAO workers by @jfan9 in #693
• fix(mcp): require workflow tool arguments by @Tethys0 in #702
• fix(status): self-heal a stuck-PROCESSING terminal from a bounded, detector-routed pane capture by @call-me-ram in #712
• feat(cli): add cao agent CLI commands for in-session orchestration (#616) by @anilkmr-a2z in #634
• feat(examples): add workflow lifecycle example by @anilkmr-a2z in #633
• fix(codex): say so when --yolo discards a profile's codexProfile (#707) by @tedswinyar in #723
• build(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /web by @dependabot[bot] in #719
• build(deps-dev): bump postcss-selector-parser from 6.1.2 to 6.1.4 in /web by @dependabot[bot] in #718
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /docusaurus by @dependabot[bot] in #726
• test(tmux): keep another socket bound while asserting the lsof absence by @harshitwandhare in #716
• fix(deps): raise the fast-uri and qs overrides so the Security Scan passes by @harshitwandhare in #730
• feat(ops-mcp): forward env_vars when launching sessions by @chadlatham in #729
• test(examples): avoid duplicate test package names by @ikorfale in #738
• feat(web): Profiles tab -- browse, search, create, edit, clone, delet… by @sujoydc in #692
• fix(terminals): extract the current composer by @atirna in #732
• fix(memory): make the unique key constraint hold for NULL scope_id rows by @atirna in #742
• fix(security): require cao:write for the PTY WebSocket by @Oskii in #748
• fix(memory): stop the memory/learning tools misreporting filesystem faults by @gutosantos82 in #734
• docs: clarify PTY WebSocket authorization by @haofeif in #749
• build(deps): bump @swc/html from 1.15.46 to 1.16.2 in /docusaurus by @dependabot[bot] in #754
• build(deps-dev): bump vitest from 4.1.0 to 4.1.11 in /web by @dependabot[bot] in #758
• build(deps): bump svgo from 3.3.4 to 3.3.5 in /docusaurus by @dependabot[bot] in #759
• build(deps): bump colord from 2.9.3 to 2.10.0 in /docusaurus by @dependabot[bot] in #761
• build(deps): bump joi from 17.13.4 to 17.13.7 in /docusaurus by @dependabot[bot] in #760
• build(deps): bump js-yaml from 4.3.1 to 4.3.2 in /docusaurus by @dependabot[bot] in #762
• fix(security): apply native deny flags for an empty allowlist by @Oskii in #747
• fix(codex): match hollow-bullet spinner glyph so a working turn reads PROCESSING, not IDLE by @mastash3ff in #763
• fix(workflow): distinguish approval-store faults from missing approval by @tarikermis in #751
• feat(ops-mcp): register plugin MCP surfaces on the operations server by @mastash3ff in #767
• feat: add optional you.com search integration by @mouse-value-add in #743
• fix(workflow): validate script step IDs and retain diagnostics by @fanhongy in #768
• fix(security): close all open code-scanning and Dependabot alerts by @gutosantos82 in #771
• blog: An LLM wrote my agent profile. It looked perfect. It was wrong. by @sujoydc in #750

New Contributors

• @jfan9 made their first contribution in #693
• @Tethys0 made their first contribution in #702
• @chadlatham made their first contribution in #729
• @ikorfale made their first contribution in #738
• @Oskii made their first contribution in #748
• @mastash3ff made their first contribution in #763
• @mouse-value-add made their first contribution in #743

Full Changelog: v2.5.0...v2.5.1