v2.5.2

What's Changed

• fix(mcp): enforce a profile's tools allowlist for assign and handoff by @harshitwandhare in #769
• cao fleet and cao worker: operate a remote CAO cluster from the CLI by @guojing1217 in #770
• fix(grok): classify the weekly-limit picker as ERROR instead of stale PROCESSING by @mastash3ff in #764
• fix(status): probe a bursting screen for PROCESSING so a spinner that never goes quiet is not read as idle by @mastash3ff in #766
• fix(ops-mcp): surface provider on launch_session and resolve session names for the ops tools by @mastash3ff in #765
• feat(workflow): replay one step of a recorded run by @anilkmr-a2z in #673
• fix(mcp): honour server.mcp_request_timeout in the mcp_server helper modules by @harshitwandhare in #787
• feat: add optional Serply scholar and news research example by @googio in #790
• blog: a research agent that shows its evidence, via a header-authenticated remote MCP server by @googio in #791
• feat(web): let the UI be served under a path prefix by @guojing1217 in #795
• fix(tmux): launch the server with exit-empty off to survive mass teardown by @klabulan in #599
• build(deps): bump anyio from 4.14.1 to 4.14.2 in /examples/fleet/panel by @dependabot[bot] in #798
• feat(memory): use an Obsidian vault as a canonical CAO knowledge source (#644) by @fanhongy in #674
• fix(mcp): persist handoff results durably to survive transport timeouts by @anilkmr-a2z in #453
• feat(agent-plugins): Agent Plugins 1.0.0 support — client pipeline, CAO-as-plugin packages, MCP delivery (#573) by @plauzy in #584
• test(fifo): feed the liveness fixtures a real raw-stream buffer by @atirna in #800
• feat(kimi): support Kimi Code alongside legacy kimi-cli by @surelykidding in #799
• fix(tmux): survive claude_code's own window rename on launch by @Hequn-Zhang in #805
• fix(mcp): stop appending MCP server refs to an explicit allowedTools by @harshitwandhare in #803
• fix(auth): honor CAO_AUTH_LOCAL_TOKEN standalone (#706), gate six more reads, redact the WebSocket token, fail closed on a null peer by @tedswinyar in #808
• feat(tmux): spawn terminals as panes so a fleet fits one window by @isamu in #793
• feat(tmux): choose how pane mode arranges the fleet by @isamu in #809
• feat(skills): add cao-contributing skill (dev loop + CI gate map + PR discipline) by @plauzy in #448
• fix(mcp): check the caller's allowlist in assign_elastic by @harshitwandhare in #811
• fix(tmux): retry the exit-empty set once when it reaches a dying server by @harshitwandhare in #819
• fix(opencode): match completion markers for agent names with spaces by @harshitwandhare in #816
• ci: pin actions to commit SHAs, use npm ci, install from uv.lock with --frozen by @tedswinyar in #820
• fix(utils): harden the file, path and credential-gate primitives by @tedswinyar in #821
• fix(auth): send the local API bearer only to this node and name the MCP transport explicitly by @tedswinyar in #822
• fix(tool-policy): make the Blocked list mean the same thing on every provider by @tedswinyar in #824
• fix(security): fail closed on unknown agent roles by @Oskii in #746
• test(opencode): cover spaced agent names in reply extraction by @harshitwandhare in #831
• build(deps): bump the github-actions group with 14 updates by @dependabot[bot] in #833
• build(docs): bump webpack-dev-middleware to 7.4.6 for CVE-2026-76844 (unblocks Security Scan on every PR) by @tedswinyar in #839
• fix(sessions): keep launch, teardown and the FIFO inside CAO's own namespace by @tedswinyar in #823
• fix(kiro): write the resolved tool policy into the agent JSON tools, so Kiro enforces it (Kiro: None → Hard at install time) by @tedswinyar in #836
• fix(kiro): recognise the 2.25.0 Credits line so a finished turn reports COMPLETED by @tedswinyar in #837
• build(deps): bump pyjwt from 2.13.0 to 2.14.0 by @dependabot[bot] in #840
• build(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /docusaurus by @dependabot[bot] in #844
• build(deps): bump fast-uri from 3.1.7 to 3.1.8 in /docusaurus by @dependabot[bot] in #843
• fix(workflow): surface run-step refusal kind in ShimHTTPError (#830) by @fanhongy in #842
• feat(tmux): caption each pane with the terminal running in it by @isamu in #835
• fix: recover Grok completion and preserve Kimi failure/tool boundaries by @surelykidding in #841
• fix(auth): send the local bearer from the cao CLI and the Web UI by @tedswinyar in #838
• build(deps): bump urllib3 to 2.8.0 and pyjwt to 2.15.1 for the advisories published 2026-09-30 (unblocks Security Scan on every PR) by @tedswinyar in #848
• feat(kimi): add opt-in bounded native swarm support by @surelykidding in #851
• fix(kiro): extract only the 2.25 reply from TUI chrome by @Harbor404 in #853
• fix(codex): startup-prompt handling that can't live-lock or block the loop (split from #566) by @tedswinyar in #731
• fix(plugins): allowlist git plugin sources by scheme and host, and pin git's transport policy by @tedswinyar in #847
• feat(terminals): record the launch model and whether the provider honored it by @fanhongy in #856
• fix(kimi): avoid overlapping transcript whitespace matching by @haofeif in #859
• ci: add fork-aware CodeQL analysis (#857) by @haofeif in #858
• docs(changelog): credit the researcher who reported #847 by @tedswinyar in #864
• docs: clarify CodeQL scan and merge policy by @haofeif in #868
• fix(install): refuse an install that would silently overwrite another profile's installed artifacts by @tedswinyar in #493
• ci: run CodeQL inside every CI run by @haofeif in #869
• fix: remediate five open CodeQL alerts by @haofeif in #871
• feat(ephemeral): add inert security groundwork for ephemeral agents by @fanhongy in #866
• fix(flow): advance next_run before a scheduled run can fail by @harshitwandhare in #875
• fix(flow): run the schedule script off the event loop by @harshitwandhare in #876
• fix: use UTC for terminal and inbox timestamps by @marko-durasic in #873
• fix(install): preserve flow placeholders on provider override by @fanhongy in #878
• fix(docs): guard braces nesting and update cache semantics by @haofeif in #879
• fix(launch): deliver the initial message via POST /sessions instead of a dropped second request by @tedswinyar in #566
• fix(status_monitor): keep the flap guard across a redelivery (#566 follow-up) by @call-me-ram in #883
• fix(copilot_cli): detect idle on Copilot CLI via the rendered pane by @jystringfellow in #880
• build(deps): bump taiki-e/install-action from 2.87.21 to 2.87.23 in the github-actions group by @dependabot[bot] in #887
• fix(security): enforce full dependency checks and consolidate toolchain fixes by @haofeif in #884

New Contributors

• @googio made their first contribution in #790
• @surelykidding made their first contribution in #799
• @Hequn-Zhang made their first contribution in #805
• @isamu made their first contribution in #793
• @Harbor404 made their first contribution in #853
• @marko-durasic made their first contribution in #873
• @jystringfellow made their first contribution in #880

Full Changelog: v2.5.1...v2.5.2