v1.115.0

This release fixes permission pattern parsing for colon-containing values, adds provider-level compaction model defaults, resolves agent-switch slash commands over HTTP, and includes several bug fixes and refactors.

What's New

• Adds X-Cagent-Compacting: 1 HTTP header on session-compaction LLM calls to allow gateway-side policies to distinguish compaction calls from regular chat completions
• Adds support for provider-level compaction_model default, so agents sharing a provider no longer need to repeat the setting individually
• Adds an optional description field to model config entries for human-readable annotations
• Resolves agent-switch slash commands in RunSession for HTTP/REST clients, enabling mid-session agent switches without requiring the two-segment route

Bug Fixes

• Fixes permission pattern parsing where colons in argument values (e.g. URLs or Windows drive paths) caused patterns to be silently truncated, resulting in deny rules never firing
• Fixes A2A tool silently succeeding when a sub-agent stream returns empty; also resolves cross-platform test instability on Windows
• Fixes compaction_model references not being resolved during first_available reachability checks and environment preflight
• Fixes model description not being preserved across first_available resolution and shorthand marshalling
• Fixes agent-switch pre-switch command resolution and rolls back partial switches on failure
• Fixes TUI history-search input not being restyled when a live theme change occurs, leaving stale styling after switching themes
• Fixes GatewayHTTPOptions panicking when model options are nil
• Reverts a WorkingDir containment check that broke callers running docker-agent as a long-lived daemon pointing sessions at arbitrary paths

Technical Changes

• Fixes log-injection (CodeQL go/log-injection) in pkg/telemetry/client.go by replacing string concatenation with structured key-value logging
• Sanitizes string arguments to close remaining log-injection taint paths and closes unbarriered passthrough in sanitizeLogArgs
• Refactors permission pattern parsing to use strings.Cut and then a regexp-based approach replacing the hand-rolled colon scanner
• Moves Desktop proxy HTTP transport to a new leaf package pkg/desktop/transport
• Moves Vertex AI support to anthropic/vertex subpackage to reduce transitive dependencies for library consumers

---

What's Changed

• docs: update CHANGELOG.md for v1.114.0 by @docker-read-write[bot] in #3775
• feat: add X-Cagent-Compacting header for session-compaction LLM calls by @dgageot in #3777
• refactor: trim transitive dependencies for library consumers by @dgageot in #3778
• chore: bump direct Go dependencies by @dgageot in #3776
• docs: update docs for config v14 and Mermaid state diagram directions by @aheritier in #3779
• fix(codeql): go/log-injection in pkg/telemetry/client.go:24 by @ronan-thibaut-glitch in #3755
• chore: bump github.com/anthropics/anthropic-sdk-go from v1.58.0 to v1.58.1 by @dgageot in #3781
• fix(permissions): keep colons in argument values from truncating patterns by @parveshsaini in #3767
• feat(config): add description attribute to models by @dgageot in #3783
• feat: support provider-level compaction_model default by @dgageot in #3785
• fix: A2A response error handling and cross-platform test stability by @Piyush0049 in #3745
• fix(tui): restyle history-search input on live theme change by @aheritier in #3786
• feat(server): resolve agent-switch slash commands in RunSession by @trungutt in #3782
• Revert "fix(codeql): go/path-injection in pkg/server/session_manager.go:542" (#3758) by @trungutt in #3788

Full Changelog: v1.114.0...v1.115.0