v2.5.3

Note: v2.5.1 and v2.5.2 were tagged on GitHub but never published to PyPI, because the package version was not bumped for them. 2.5.3 is the first PyPI release since 2.5.0, so the changes below cover everything since v2.5.0.

What's Changed

• fix(kiro): drop --legacy-ui, which silently disables every MCP tool by @gutosantos82 in #691
• test: centralize contributor suite selection by @vinhnguyenthanhdn in #687
• fix(sessions): batch the list_sessions terminal read and specify its ownership order (#629) by @tedswinyar in #703
• feat: Add EKS deployment with elastic, task-scoped CAO workers by @jfan9 in #693
• fix(mcp): require workflow tool arguments by @Tethys0 in #702
• fix(status): self-heal a stuck-PROCESSING terminal from a bounded, detector-routed pane capture by @call-me-ram in #712
• feat(cli): add cao agent CLI commands for in-session orchestration (#616) by @anilkmr-a2z in #634
• feat(examples): add workflow lifecycle example by @anilkmr-a2z in #633
• fix(codex): say so when --yolo discards a profile's codexProfile (#707) by @tedswinyar in #723
• build(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /web by @dependabot[bot] in #719
• build(deps-dev): bump postcss-selector-parser from 6.1.2 to 6.1.4 in /web by @dependabot[bot] in #718
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /docusaurus by @dependabot[bot] in #726
• test(tmux): keep another socket bound while asserting the lsof absence by @harshitwandhare in #716
• fix(deps): raise the fast-uri and qs overrides so the Security Scan passes by @harshitwandhare in #730
• feat(ops-mcp): forward env_vars when launching sessions by @chadlatham in #729
• test(examples): avoid duplicate test package names by @ikorfale in #738
• feat(web): Profiles tab -- browse, search, create, edit, clone, delet… by @sujoydc in #692
• fix(terminals): extract the current composer by @atirna in #732
• fix(memory): make the unique key constraint hold for NULL scope_id rows by @atirna in #742
• fix(security): require cao:write for the PTY WebSocket by @Oskii in #748
• fix(memory): stop the memory/learning tools misreporting filesystem faults by @gutosantos82 in #734
• docs: clarify PTY WebSocket authorization by @haofeif in #749
• build(deps): bump @swc/html from 1.15.46 to 1.16.2 in /docusaurus by @dependabot[bot] in #754
• build(deps-dev): bump vitest from 4.1.0 to 4.1.11 in /web by @dependabot[bot] in #758
• build(deps): bump svgo from 3.3.4 to 3.3.5 in /docusaurus by @dependabot[bot] in #759
• build(deps): bump colord from 2.9.3 to 2.10.0 in /docusaurus by @dependabot[bot] in #761
• build(deps): bump joi from 17.13.4 to 17.13.7 in /docusaurus by @dependabot[bot] in #760
• build(deps): bump js-yaml from 4.3.1 to 4.3.2 in /docusaurus by @dependabot[bot] in #762
• fix(security): apply native deny flags for an empty allowlist by @Oskii in #747
• fix(codex): match hollow-bullet spinner glyph so a working turn reads PROCESSING, not IDLE by @mastash3ff in #763
• fix(workflow): distinguish approval-store faults from missing approval by @tarikermis in #751
• feat(ops-mcp): register plugin MCP surfaces on the operations server by @mastash3ff in #767
• feat: add optional you.com search integration by @mouse-value-add in #743
• fix(workflow): validate script step IDs and retain diagnostics by @fanhongy in #768
• fix(security): close all open code-scanning and Dependabot alerts by @gutosantos82 in #771
• blog: An LLM wrote my agent profile. It looked perfect. It was wrong. by @sujoydc in #750
• fix(mcp): enforce a profile's tools allowlist for assign and handoff by @harshitwandhare in #769
• cao fleet and cao worker: operate a remote CAO cluster from the CLI by @guojing1217 in #770
• fix(grok): classify the weekly-limit picker as ERROR instead of stale PROCESSING by @mastash3ff in #764
• fix(status): probe a bursting screen for PROCESSING so a spinner that never goes quiet is not read as idle by @mastash3ff in #766
• fix(ops-mcp): surface provider on launch_session and resolve session names for the ops tools by @mastash3ff in #765
• feat(workflow): replay one step of a recorded run by @anilkmr-a2z in #673
• fix(mcp): honour server.mcp_request_timeout in the mcp_server helper modules by @harshitwandhare in #787
• feat: add optional Serply scholar and news research example by @googio in #790
• blog: a research agent that shows its evidence, via a header-authenticated remote MCP server by @googio in #791
• feat(web): let the UI be served under a path prefix by @guojing1217 in #795
• fix(tmux): launch the server with exit-empty off to survive mass teardown by @klabulan in #599
• build(deps): bump anyio from 4.14.1 to 4.14.2 in /examples/fleet/panel by @dependabot[bot] in #798
• feat(memory): use an Obsidian vault as a canonical CAO knowledge source (#644) by @fanhongy in #674
• fix(mcp): persist handoff results durably to survive transport timeouts by @anilkmr-a2z in #453
• feat(agent-plugins): Agent Plugins 1.0.0 support — client pipeline, CAO-as-plugin packages, MCP delivery (#573) by @plauzy in #584
• test(fifo): feed the liveness fixtures a real raw-stream buffer by @atirna in #800
• feat(kimi): support Kimi Code alongside legacy kimi-cli by @surelykidding in #799
• fix(tmux): survive claude_code's own window rename on launch by @Hequn-Zhang in #805
• fix(mcp): stop appending MCP server refs to an explicit allowedTools by @harshitwandhare in #803
• fix(auth): honor CAO_AUTH_LOCAL_TOKEN standalone (#706), gate six more reads, redact the WebSocket token, fail closed on a null peer by @tedswinyar in #808
• feat(tmux): spawn terminals as panes so a fleet fits one window by @isamu in #793
• feat(tmux): choose how pane mode arranges the fleet by @isamu in #809
• feat(skills): add cao-contributing skill (dev loop + CI gate map + PR discipline) by @plauzy in #448
• fix(mcp): check the caller's allowlist in assign_elastic by @harshitwandhare in #811
• fix(tmux): retry the exit-empty set once when it reaches a dying server by @harshitwandhare in #819
• fix(opencode): match completion markers for agent names with spaces by @harshitwandhare in #816
• ci: pin actions to commit SHAs, use npm ci, install from uv.lock with --frozen by @tedswinyar in #820
• fix(utils): harden the file, path and credential-gate primitives by @tedswinyar in #821
• fix(auth): send the local API bearer only to this node and name the MCP transport explicitly by @tedswinyar in #822
• fix(tool-policy): make the Blocked list mean the same thing on every provider by @tedswinyar in #824
• fix(security): fail closed on unknown agent roles by @Oskii in #746
• test(opencode): cover spaced agent names in reply extraction by @harshitwandhare in #831
• build(deps): bump the github-actions group with 14 updates by @dependabot[bot] in #833
• build(docs): bump webpack-dev-middleware to 7.4.6 for CVE-2026-76844 (unblocks Security Scan on every PR) by @tedswinyar in #839
• fix(sessions): keep launch, teardown and the FIFO inside CAO's own namespace by @tedswinyar in #823
• fix(kiro): write the resolved tool policy into the agent JSON tools, so Kiro enforces it (Kiro: None → Hard at install time) by @tedswinyar in #836
• fix(kiro): recognise the 2.25.0 Credits line so a finished turn reports COMPLETED by @tedswinyar in #837
• build(deps): bump pyjwt from 2.13.0 to 2.14.0 by @dependabot[bot] in #840
• build(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /docusaurus by @dependabot[bot] in #844
• build(deps): bump fast-uri from 3.1.7 to 3.1.8 in /docusaurus by @dependabot[bot] in #843
• fix(workflow): surface run-step refusal kind in ShimHTTPError (#830) by @fanhongy in #842
• feat(tmux): caption each pane with the terminal running in it by @isamu in #835
• fix: recover Grok completion and preserve Kimi failure/tool boundaries by @surelykidding in #841
• fix(auth): send the local bearer from the cao CLI and the Web UI by @tedswinyar in #838
• build(deps): bump urllib3 to 2.8.0 and pyjwt to 2.15.1 for the advisories published 2026-09-30 (unblocks Security Scan on every PR) by @tedswinyar in #848
• feat(kimi): add opt-in bounded native swarm support by @surelykidding in #851
• fix(kiro): extract only the 2.25 reply from TUI chrome by @Harbor404 in #853
• fix(codex): startup-prompt handling that can't live-lock or block the loop (split from #566) by @tedswinyar in #731
• fix(plugins): allowlist git plugin sources by scheme and host, and pin git's transport policy by @tedswinyar in #847
• feat(terminals): record the launch model and whether the provider honored it by @fanhongy in #856
• fix(kimi): avoid overlapping transcript whitespace matching by @haofeif in #859
• ci: add fork-aware CodeQL analysis (#857) by @haofeif in #858
• docs(changelog): credit the researcher who reported #847 by @tedswinyar in #864
• docs: clarify CodeQL scan and merge policy by @haofeif in #868
• fix(install): refuse an install that would silently overwrite another profile's installed artifacts by @tedswinyar in #493
• ci: run CodeQL inside every CI run by @haofeif in #869
• fix: remediate five open CodeQL alerts by @haofeif in #871
• feat(ephemeral): add inert security groundwork for ephemeral agents by @fanhongy in #866
• fix(flow): advance next_run before a scheduled run can fail by @harshitwandhare in #875
• fix(flow): run the schedule script off the event loop by @harshitwandhare in #876
• fix: use UTC for terminal and inbox timestamps by @marko-durasic in #873
• fix(install): preserve flow placeholders on provider override by @fanhongy in #878
• fix(docs): guard braces nesting and update cache semantics by @haofeif in #879
• fix(launch): deliver the initial message via POST /sessions instead of a dropped second request by @tedswinyar in #566
• fix(status_monitor): keep the flap guard across a redelivery (#566 follow-up) by @call-me-ram in #883
• fix(copilot_cli): detect idle on Copilot CLI via the rendered pane by @jystringfellow in #880
• build(deps): bump taiki-e/install-action from 2.87.21 to 2.87.23 in the github-actions group by @dependabot[bot] in #887
• fix(security): enforce full dependency checks and consolidate toolchain fixes by @haofeif in #884
• docs(examples): remove the You.com search example by @haofeif in #893
• feat(ephemeral): create and store ephemeral agents, not yet launchable by @fanhongy in #881
• feat: add optional FXMacroData macro release analyst example by @roberttidball in #891
• feat(examples): add cross-zone robot transport by @haofeif in #892
• feat(ephemeral): claim, bind and release creator-owned ephemeral agents by @fanhongy in #898
• chore: release v2.5.3 by @fanhongy in #899

New Contributors

• @jfan9 made their first contribution in #693
• @Tethys0 made their first contribution in #702
• @chadlatham made their first contribution in #729
• @ikorfale made their first contribution in #738
• @Oskii made their first contribution in #748
• @mastash3ff made their first contribution in #763
• @mouse-value-add made their first contribution in #743
• @googio made their first contribution in #790
• @surelykidding made their first contribution in #799
• @Hequn-Zhang made their first contribution in #805
• @isamu made their first contribution in #793
• @Harbor404 made their first contribution in #853
• @marko-durasic made their first contribution in #873
• @jystringfellow made their first contribution in #880
• @roberttidball made their first contribution in #891

Full Changelog: v2.5.0...v2.5.3