v0.7.4 — OpenCode plugin support

agy-staff 0.7.4 — OpenCode plugin support

Changes since 0.7.3

#27 adds native OpenCode V1 plugin installation with seven branded skills: agy-ask, agy-staffer, agy-researcher, agy-reviewer, agy-implementer, agy-jobs, and agy-lead. OpenCode discovers their slash commands directly from the installed skills; users do not need to clone the repository or configure skill paths.

The shared scripts/generate-skills.mjs derives Pi and OpenCode entrypoints from canonical skills/. Target configuration controls output directories, naming, invocation syntax, metadata removal, and the shared compatibility appendix. Canonical workflows, existing Pi output, companion behavior, and prompt templates are unchanged. No additional OpenCode-specific workflow instructions are introduced.

The package includes a small OpenCode loader and all referenced resources. Native Git installation required replacing the prepack hook: its presence triggers nested npm preparation in OpenCode's compiled runtime. Generated content is checked by CI, npm run pack:checked before packing, and prepublishOnly before publishing. Bare npm pack does not check generated-file freshness.

Package, Claude Code, and Codex manifests are aligned at 0.7.4. OpenCode support is limited to V1 (>=1.18.34 <2).

Validation

• The implementation passed all 198 offline tests, including actual npm archive execution and generated-file consistency checks. Ubuntu CI and the generated-skills check passed.
• Real OpenCode 1.18.34 installed npm and Git packages, discovered all seven skills and commands, and retained an unrelated skill. Installation from a public GitHub commit also passed.
• Live tests used OpenCode 1.18.34, Antigravity CLI 1.2.11, and DeepSeek Flash: ask returned the requested response, staffer dispatched and collected a real background job, and implementer fixed a fixture and passed its test without changing the test or unrelated file.
• The live host model was current DeepSeek V4.1 Flash (deepseek-flash). The requested legacy deepseek-v4-flash ID was not available in OpenCode's model catalog; this is not a test of the retired V4 weights.
• Live cancellation, timeout recovery, and permission rejection were not covered by these smoke tests. Windows CI remains separately gated by the repository's existing approval setting.

Installing and upgrading

With Node.js and an authenticated Antigravity CLI available, install this version into OpenCode:

opencode plugin 'agy-staff@git+https://github.com/keli-wen/agy-staff.git#v0.7.4' --global --force

Restart OpenCode, then run /agy-ask reply with OK. OpenCode caches Git package specs; changing the tag or commit selects a new install, while --force replaces the configured entry.

Claude Code and Codex users should update the plugin and restart their host to load the versioned copy. Pi installations pinned to a Git ref can select v0.7.4. See the upgrade instructions.

v0.7.3 — Clearer lead delegation and acceptance defaults

agy-staff 0.7.3 — Clearer lead delegation and acceptance defaults

Changes since 0.7.2

#24 clarifies the default agy:lead workflow across research, implementation, review, and writing. Previously, the host could delegate part of an investigation while continuing substantial investigation itself before the worker returned, leaving users to steer delegation and waiting.

The host now orients enough to frame an assignment, delegates substantive work, waits by default, and assesses the result before following up, taking over, or delivering. Small or already-understood tasks can still be handled directly, and an already-identified independent task can proceed during a wait. Briefs carry relevant context, constraints, settled decisions, and existing authorization.

Acceptance depends on the task: research needs sources and uncertainties; implementation needs actual changes and verification; review needs supported findings and coverage limits, including when no issues are found. The host makes targeted checks, resolves inconsistencies, and assigns focused follow-ups for substantive gaps. Related work stays together, implementation includes necessary verification, and parallel editors still require separate worktrees with shared decisions agreed in advance.

Canonical and generated Pi lead skills and the English and Chinese README descriptions are aligned. Package, Claude Code, and Codex manifests are versioned at 0.7.3. Companion runtime, direct persona behavior, and job lifecycle contracts are unchanged.

Validation

• The offline suite passed 195 tests during implementation. Final skill wording passed the seven Pi packaging tests and generated-skill consistency checks.
• An independent agent exercised six decision scenarios: discussion research, implementation with PR delivery, an unsupported clean review, a one-line typo, an unsettled API shared by two clients, and independent work during a running investigation. Each selected the expected next actions.
• The scenario exercise was a decision simulation. Live end-to-end orchestration across host environments has not been validated by this release.

Upgrading

Update the plugin and restart the host to load the revised skills; Claude Code and Codex keep versioned plugin copies. See the upgrade instructions. Pi installations using a pinned Git ref can select v0.7.3.

v0.7.2 — Windows: workers survive other jobs' cleanup

agy-staff 0.7.2 — Windows: workers survive other jobs' cleanup

Changes since 0.7.1

0.7.1 made the companion run on Windows. This hotfix closes a process-cleanup defect it introduced that could terminate a running background job. Behaviour on macOS and Linux is unchanged; users there need not upgrade.

• #23: a detached worker on Windows keeps its exited dispatcher's PID in ParentProcessId. Windows reuses PIDs quickly, so when another job's agy process (or, for a single job, its own agy or one of agy's tool processes) received that PID, cleanup at that job's end took the worker for a descendant and terminated it. The worker died silently, its result was never stored, and wait reported crashed with a diagnostic hint about sandbox contexts that pointed users at the wrong problem. Two independent tree walks did this: tree() in the stream worker and taskkill /T. Now tree() follows a parent link only when the child was created after its parent (a process cannot be older than its parent; a row born before its recorded parent is an orphan behind a reused PID), PowerShell reports CreationDate in round-trip format so that comparison has 100 ns precision instead of one second, taskkill runs without /T and descendants are terminated individually after passing the identity and birth-order checks, and cleanup never signals its own process. Members that appear between the two cleanup snapshots (a tool agy starts during the grace period) are adopted from a still-live, identity-matched member under the same birth-order rule, closing a gap /T had only partly covered.
• #22: the PowerShell process-table query fetches only the three columns it parses, cleanup skips the grace wait and second query when nothing of the job's tree is left, and the test helpers allow a cold Windows runner more time to start a worker.

Package, Claude Code and Codex manifests are aligned at 0.7.2. Canonical skills and generated Pi skills are unchanged. No CLI flags, exit codes or output formats changed.

Validation

The 0.7.1 release note reported the Windows suite at 0 failures. That was the fifth run of that pull request; the four before it had failed, each on a different test. Measured over the runs since the Windows job was added, the suite passed about half the time, and both pushes to master after 0.7.1 failed. Every failure had the same signature described above; the affected test was whichever job happened to hold the reused PID.

With this fix the Windows suite passed 4 of 4 runs on the final commit of #23 (194 tests, about 4 minutes each), and the pre-existing tests passed in all 8 runs of the branch. The offline suite passed 194/194 on macOS and 8 of 8 Ubuntu CI runs. A regression test drives real processes and real signals through stopExecution: a real detached orphan, a real root with a real child, and one synthetic ParentProcessId in the table, since no kernel lets a test choose the next PID it hands out. With the birth-order check disabled the test fails. Unit tests cover birth-stamp parsing (ISO-8601, WMIC and legacy renderings), stale-link pruning in tree() and the taskkill arguments.

The diagnosis and the fix design were reviewed independently by an agy review job, which confirmed the cause and identified the taskkill /T path; a second review of the final diff found no blocker and produced the adoption follow-up above.

Upgrading

Windows users of 0.7.1 should upgrade. Claude Code and Codex install a copy, so pull the new version in (see upgrading) and restart the harness. Let running jobs finish before upgrading on Windows: a job started by 0.7.1 recorded its worker identity in the old timestamp rendering, and cancel in 0.7.2 refuses to signal a worker whose identity it cannot match.

v0.7.1 — Windows: quiet spawning, cancellable jobs, robust state lock

Changes since 0.7.0

0.7.0 added task orchestration. This release makes the companion usable on Windows, where it had never been run. Behaviour on macOS and Linux is unchanged.

• #19: background jobs no longer open console windows and can be canceled. Every spawn/spawnSync in the companion now passes windowsHide: true; the detached worker has no console of its own, so its git and process-inspection children get none either. The repository root is memoized per working directory instead of forking git rev-parse on every 200 ms wait poll and 100 ms cancel check, which was the source of the window storm. Process-tree inspection uses PowerShell Get-CimInstance Win32_Process (with wmic fallback) and termination uses taskkill /PID <pid> /T /F; on POSIX the ps and process-group paths are byte-for-byte the same. cancel on Windows relies on the cancellation marker the worker already polls rather than SIGTERM, which is TerminateProcess there and would orphan the agy tree.
• #18 (contributed by @Shen-18): the job state lock retries EPERM/EBUSY/EACCES when acquiring, reaping, reading and releasing the lock directory. Windows reports those where POSIX reports EEXIST/ENOTEMPTY, so every job previously failed on its first state write. Releasing retries the marker unlink instead of ignoring the error, which had left the process's own marker behind and turned every later lock into a 10 s timeout. Lock timeouts now name the last error code.
• Atomic file replacement (state.json, progress and status files) retries Windows sharing violations, since wait and status read those files every few hundred milliseconds. Reading state.json treats only a missing file as an empty state; any other read error is reported instead of being written back as empty, which could have erased job records.
• #20: CI is split into three jobs. Generated skills consistency (the required check) runs the Pi alignment check; Tests (Ubuntu) runs the suite automatically; Tests (Windows) runs it on windows-latest behind the manual-tests environment, so a maintainer approves each Windows run. A script-file AGY_BIN (the test fake) is launched through Node because Windows has no shebang support. .gitattributes pins LF on checkout.

Package, Claude Code and Codex manifests are aligned at 0.7.1. Canonical skills and generated Pi skills are unchanged. No CLI flags, exit codes or output formats changed.

Validation

The offline suite passed 189/189 on macOS. On the Windows runner, 0.7.0 scored 81 pass / 92 fail in 26 minutes; this release scores 188 pass / 0 fail / 1 skipped (a test that shims POSIX ps) in about 4 minutes. New unit tests cover the windowsHide invariant over the companion sources, repoRoot memoization, process-table parsing for PowerShell and wmic output, taskkill routing, and the lock's EPERM paths, with the platform-specific pieces injected so they run on POSIX hosts. Two intermittent Windows failures seen during iteration (a slow process-table query making cleanup skip the tree, and a rename colliding with a reader) were fixed and did not recur.

Windows support is best effort. The CI job uses the fake agy; no real Windows agy installation was exercised. If agy installs there as an npm-style agy.cmd, Node refuses to spawn it without a shell, and that case is not handled yet. PowerShell output under non-UTF-8 code pages and taskkill behaviour on protected processes are covered by stubs only.

v0.7.0 — Task orchestration with AGY

agy-staff 0.7.0 — Task orchestration with AGY

Adds agy:lead, a task orchestration skill for your agent. Within this workflow, the host delegates substantive work to staffer by default, selects specialist guidance when useful, and reserves ask for testing. The host retains decisions, review, and delivery. Existing persona skills are unchanged.

The jobs guidance covers follow-ups after completion, waiting for useful work, and canceling before an immediate change of direction. Follow-up briefs carry host decisions and account for partial work after interruption. The companion now refuses to continue a conversation whose job is still running, returning the job ID and status without queueing the follow-up, so the orchestrator decides whether to wait or cancel.

Includes the generated Pi lead entrypoint, minimal usage documentation, and a lead badge added to the existing homepage diagram. Controlled real-AGY tests passed for overlapping-turn rejection, explicit resubmission, and cancel-then-continue. Real-model lead quality and lossless recovery after arbitrary interruptions remain unvalidated.

The continuation guard covers background jobs recorded in the current worktree. It does not lock external AGY invocations or other worktrees.

Validation: 173 fake-AGY tests passed, Pi loading passed without model calls, and generated Pi skills are synchronized. All three controlled integration cases passed with real AGY CLI 1.2.0. The merged master commit also passed CI.

Delivered in PR #17, addressing #16.

Full changelog: v0.6.1...v0.7.0

v0.6.1 — Recovery, Workspace Access and Quieter Delegation

agy-staff 0.6.1 — Recovery follow-ups and quieter delegation

Changes since 0.6.0

0.6.0 already introduced streaming observation, continue --job, restart, early conversation persistence and recovery using the original job configuration. This release builds on those mechanisms.

• #8: recognize AGY's ERROR / timeout waiting for response payload in addition to explicit response-timeout statuses. An empty response at a response deadline or worker hard limit with a known conversation now yields attention (exit 5), with a suggested continuation timeout and an explicit user-confirmation requirement. Failure reports include bounded pre-run/current workspace status. Historical foreground ask configurations are indexed by conversation ID so subsequent calls do not erase them. Nonempty response text is preserved with warnings for the orchestrator to assess; unrelated errors retain their classification. No automatic retry or continuation is introduced.
• #9: foreground and background calls share argument construction and pass --add-dir <repoRoot>, falling back to the launch directory outside Git. This attaches the intended workspace instead of relying on AGY to infer it from the prompt or inherited cwd. Both restricted and unrestricted calls receive it; unrestricted still uses --dangerously-skip-permissions. Continuation and restart retain their original workspace selection.
• #10: optional setup retains broad git/gh grants and adds five deny prefixes (git push, git reset --hard, git clean, gh pr merge, gh release delete) through AGY's native permissions. This addresses the issue with a small deny list instead of maintaining a per-subcommand allowlist. It only configures restricted use; default unrestricted tasks do not depend on setup. Dry run shows both lists, apply backs up and appends missing rules, and existing allow/deny/ask settings are preserved. Malformed settings fail without being overwritten. The deny prefixes prevent common mistakes, not all irreversible actions or alternate command forms; the companion adds no matching engine or new mode.
• Delegation guidance: default to prompt → dispatch → wait for the final result → validate as needed. Observe progress only on an explicit user request; diagnose after failure or a result requiring intervention. Keep necessary host result collection and the persona → jobs division. Remove invitations to inspect progress for routine updates from skills, CLI launch text and bilingual documentation. The wait/observe implementation and output schemas remain intact; a wait soft expiry still returns a snapshot and leaves execution running. Reduced live-session token usage has not been measured.

Package, Claude Code and Codex manifests are aligned at 0.6.1. Canonical skills and generated Pi skills are synchronized. wait, observe, status <id> and result return exit 5 for attention; result retains its historical exit behavior for other terminal states. Existing 0.6.0 terminal records are not migrated.

Validation

The updated offline suite passed 169/169 tests, including native SUCCESS response/diagnostic delivery, bounded stderr collection and existing lifecycle behavior. A new live deadline run returned attention / hard_timeout with no response and no surviving processes. Separately, both current collectors replayed the retained real SUCCESS case, preserving its response and surfacing its native background-cancellation diagnostics without changing the stored status. This replay is not a new authenticated AGY call. All five terminal-delivery tests passed again after the sidecar warning-race adjustment. Generated Pi skills and git diff --check passed.

A real AGY 1.1.27 restricted staffer run read a marker file from a disposable non-Git workspace. This verifies the tested workspace-read path. Offline timeout fixtures cover known response shapes; the subsequent live lifecycle test below exposed an additional native behavior.

Live validation on AGY 1.1.28

An independent Codex agent exercised the real CLI in disposable workspaces using gemini-3.8-flash-low. Unrestricted subdirectory execution and relative reads passed; continuation invoked from the repository root restored the original subdirectory and conversation; non-Git reads passed. A restricted native-file read also succeeded using the existing configuration unchanged; view_file required an absolute path, which AGY resolved from the supplied original working directory. This does not verify deny enforcement. The existing opt-in lifecycle harness passed streaming output, structured review and cancellation, with no observed surviving execution processes.

The deadline case exposed a distinction between invocation and task completion. At the 35-second limit, AGY terminated an unfinished background command but returned a SUCCESS result containing only a launch/wait message. The companion preserves that response as done / exit 0 and now includes bounded diagnostics during collection; the orchestrator judges whether the task needs further work. The recorded native diagnostics were:

root agent idle; waiting for 1 background task(s) (bounded by --print-timeout)
terminating 1 background task(s) on exit

This timeout was intentional: the test requested a 90-second command with a 35-second limit. Background jobs normally default to 60 minutes. The native CLI exited just before the companion's independent hard deadline, so the companion's hard-timeout handler did not fire. The unfinished work must remain visible to the orchestrator; done is not task acceptance and does not mean normal tasks spontaneously time out after 35 seconds. The original #8 report instead describes a 10-minute implement run that retained partial changes and returned ERROR / timeout waiting for response; it does not establish why that task needed more time.

The retained native trajectory explains the launch/wait response: run_command used WaitMsBeforeAsync: 10000, then AGY's tool result instructed the model to announce the background task and end its turn. The model followed that instruction. At expiry, the native CLI canceled step 2; its tool output contains context canceled, and the cancellation notification remains in the conversation's messages/undelivered directory. The emitted stream contains no terminal update for that tool, but ends with SUCCESS. The companion treats response delivery separately from task acceptance: it preserves the native outcome, records native status/exit code in the log, and includes a bounded log tail on stderr for wait/result when warnings exist. It does not infer timeout from prose, unfinished tool events or private trajectory files. The orchestrator assesses the response and artifacts, diagnoses as needed, and decides whether to propose continuation. Internal AGY source was not available, so the exact upstream branch is unconfirmed.

Reproduce the lifecycle case with AGY_REAL_SMOKE=1 AGY_CLI_DISABLE_AUTO_UPDATE=1 node tests/real-agy.integration.mjs in an authenticated, unsandboxed context. The lifecycle assertion checks truthful delivery of any native response and diagnostics, or explicit timeout handling when no response is available. The original attention-only expectation for the native SUCCESS case has been replaced by this invocation-level contract; it does not assert that the 90-second task completed.

Seven additional live calls used the current authenticated HOME in native restricted (request-review) mode. The two baseline commands executed through verified harmless git/gh PATH shims. Each of the five denied commands then produced a native tool ERROR containing Matches user-configured deny rule and never reached the shim. In one positive-control call with the five test denies absent, all five commands produced native DONE events and the expected shim output. The tested commands were git push origin HEAD, git reset --hard HEAD, git clean -fd, gh pr merge 1 and gh release delete disposable-policy-test-061 --yes. Original settings bytes and mode were restored after testing; no credentials were copied and no real remote/GitHub mutations occurred. This validates native enforcement for these spellings, not alternate flags, wrappers or bypass resistance.

Updating your installed plugin

For an existing installation from the GitHub marketplace, refresh the marketplace and update the installed plugin.

Claude Code

claude plugin marketplace update agy-staff
claude plugin update agy@agy-staff

Codex

codex plugin marketplace upgrade agy-staff
codex plugin add agy@agy-staff

Restart Claude Code and Codex after updating so new sessions load the updated plugin. Use claude plugin list or codex plugin list --marketplace agy-staff to verify the installed version.

Pi

pi update --extension git:github.com/keli-wen/agy-staff

Run /reload in Pi after updating.

These commands update Git-backed marketplace installations. A marketplace pointing at a local development directory uses that directory's contents; switch it to the GitHub source to install the published version.

v0.6.0 — Streaming Observation and Recovery

agy-staff 0.6.0 adds streaming observations and explicit recovery for background agent work. Your main agent can delegate a task, check what AGY is doing, and collect the full report when it finishes. The worker continues independently of progress queries and individual waits.

Core design

Persona skills guide the host agent through ordinary shell commands. The companion starts a worker, records AGY's streaming output, and exposes a job ID for waiting, observation, cancellation and recovery. The host controls when the main agent receives a tool result; the worker enforces the execution deadline.

Read the Core design section or the Chinese explanation.

Highlights

• Observe progress without duplicating the report. observe <id> returns bounded JSON with up to five recent tool activities and the latest response text, within an 8 KiB UTF-8 budget. Once a job finishes, observation returns terminal metadata and result pointers. wait and result deliver the full report.
• Wait without interrupting execution. wait <id> --timeout 10m stays silent until completion or soft expiry. An expired wait returns a progress snapshot and leaves the worker running. Observation does not consume a pending wait's output or renew the execution deadline.
• Set an independent execution deadline. Background jobs default to 60 minutes and accept a launch --timeout up to 120 minutes. The selected duration is also passed to AGY. At hard expiry, a complete response already received is delivered with a warning; otherwise the job retains its timeout diagnostics for inspection and recovery.
• Cancel and recover with durable records. Cancellation verifies process identities across locale and timezone changes, cleans up identified execution descendants, and publishes canceled after storing its report. continue --job inherits the selected job's configuration; restart refreshes workspace context. Both create linked jobs with fresh budgets and preserve the original terminal record. Recovery works from any directory in the same worktree and executes in the original working directory.
• Keep job state and diagnostics consistent. Lifecycle writes use locks protected against competing stale-lock reapers. Cleanup handles inherited output pipes and transient process-inspection failures. Warning-free success removes intermediate streams and snapshots after saving the result; exceptional jobs retain them. Canonical skills, generated Pi skills and bilingual documentation describe the same behavior.

Compatibility and upgrading

Background execution requires an AGY version that supports stream-json; development smoke tests used AGY 1.1.27. ask remains synchronous and tool-free. Callers should treat observe as a bounded status interface and use wait or result for the complete answer.

The default background execution budget is now 60 minutes, up from 5 minutes for review and 10 minutes for staffer, research and implement. Set --timeout explicitly if you need a shorter limit.

Finish or cancel existing jobs with the currently installed version before upgrading. Older workers may not support the new cancellation request channel. Before continuing or restarting an interrupted task, inspect its retained report and workspace changes; the companion does not automatically retry.

Claude Code and Codex cache plugin copies by version. Update the installed copy, then restart the application to load 0.6.0.

Claude Code

claude plugin marketplace update agy-staff && claude plugin update agy@agy-staff

Codex

codex plugin marketplace upgrade && codex plugin add agy@agy-staff

Pi

pi update --extension git:github.com/keli-wen/agy-staff

Run /reload in Pi after updating.

Validation

The merged release commit passed 159/159 offline tests and generated-Pi consistency checks on Ubuntu with Node 24: release-commit CI. macOS validation also passed 159/159 tests during development.

Earlier development checks covered Pi 0.84.4 integration and real AGY 1.1.27 streaming, structured review, cancellation after tool start and a shortened hard deadline. Those real-AGY smoke tests were not rerun for publication. The detailed validation record includes the measurements and opt-in reproduction command.

Implemented in #14, addressing #13 and the crash-diagnostic and timeout-recovery concerns in #4 and #8.

Full changelog: v0.5.1 → v0.6.0

v0.5.1 — False Crash Guard

agy-staff 0.5.1 — Sandbox Liveness & False Crash Guard

Release date: 2026-09-04.

Highlights

• Avoid false crash reports across harness sandbox boundaries (#11). When wait, status, or result is run from a sandboxed command context while a background worker was launched unsandboxed (e.g. in Codex Desktop or other container/permission environments), the collector process could fail its liveness check (pidAlive=false) because the worker PID is not visible across the sandbox boundary. The companion now recognizes this pattern and outputs an actionable, harness-neutral diagnostic warning:
  The worker pid is not visible from this process. If the job may have been started from a different harness permission or sandbox context, rerun wait/status/result from the same unsandboxed context before treating it as crashed.
• Liveness self-healing. If a collector previously marked a job crashed in state.json due to an inaccessible PID from inside a sandbox, subsequent calls from an unsandboxed context where the worker PID is visible automatically restore the job's status to running (or to done if the worker finished and wrote its result file).
• Clear harness permission documentation. Updated all persona skills (researcher, reviewer, implementer, staffer), jobs, and reference documentation to emphasize that job management commands (wait, status, result, cancel) should run in the same unsandboxed permission context as the background job start.
• Pi agent package synchronization. Maintained alignment across package metadata, generated Pi skills (pi-skills/), and Pi packaging and compatibility checks with plugin manifests.

Upgrading

Both Claude Code and Codex cache the plugin per-version; update and restart the harness so the new version loads:

claude plugin marketplace update agy-staff && claude plugin update agy@agy-staff   # then restart Claude Code

codex plugin marketplace upgrade && codex plugin add agy@agy-staff                 # then restart Codex

For Pi:

pi update --extension git:github.com/keli-wen/agy-staff                             # then /reload

v0.5.0 — Gemini 3.8 Flash

agy-staff 0.5.0 — Gemini 3.8 Flash

Release date: 2026-09-03.

Highlights

• Upstream announcement. Google: Gemini 3.8 Flash and 3.8 Flash Cyber.
• Gemini 3.8 Flash default update. All persona defaults and the flash alias / --effort shorthand move from Gemini 3.7 Flash to Gemini 3.8 Flash, preserving the effort tier of every persona:
  • ask: gemini-3.8-flash-low (low effort, ~3s tool-free Q&A)
  • staffer: gemini-3.8-flash-medium (medium effort, general-purpose delegation)
  • reviewer: gemini-3.8-flash-medium (medium effort, code and plan reviews)
  • researcher: gemini-3.8-flash-high (high effort, deep research with sources)
  • implementer: gemini-3.8-flash-high (high effort, working-tree implementation)
• No silent fallback on unsupported models. When the installed agy does not support Gemini 3.8 Flash, the companion never silently downgrades or retries with an older model. It fails fast and actionable, querying agy models to report:
  1. The requested model
  2. Which models are available in the installed agy catalog
  3. The best same-effort compatible recommendation (e.g. --model gemini-3.7-flash-high)
  4. Notice that updating agy is preferred to use the latest default model
• Preserved discovery errors and non-misclassification. If agy models discovery itself fails, the original error is preserved alongside advice to run agy models. Auth, quota, network, and unrelated errors are never misclassified as unsupported model errors.
• Synchronized visual assets. Badge asset assets/badges/model-gemini-3-8-flash.svg generated via scripts/gen_badges.py, and assets/design.svg / assets/design.png updated to reflect Gemini 3.8 Flash.

Upgrading

Both harnesses install a copy — pull 0.5.0 in yourself, then restart the harness so the skills load:

claude plugin marketplace update agy-staff && claude plugin update agy@agy-staff   # then restart Claude Code

codex plugin marketplace upgrade && codex plugin add agy@agy-staff                 # then restart Codex

v0.4.5 — Opaque Task Text

agy-staff 0.4.5 — Opaque Task Text

Release date: 2026-08-30.

Highlights

• Flag-like text inside a task is finally safe. A prompt mentioning git diff --check used to die with agy-staff error: unknown flag --check. The companion tokenized task text twice: the shell had already split argv, then tokenize() re-split any entry containing whitespace and the flag parser scanned every resulting token. Now argv is parsed once, exactly as the shell delivered it — no argument is re-split, no quotes are interpreted, and no byte of a task value is inspected. --check, --json, --timeout, an unknown --whatever inside a task are prompt content and reach agy verbatim (#3).
• Task text has three explicit sources, and exactly one per call: --prompt <text>, --prompt-file <path>, or --stdin. --prompt-file and --stdin contents were never scanned and still are not.
• Value flags reject a value that is not one. A missing value, an empty value, or a flag-shaped value is now an error. --model "" no longer falls back to the default silently, and ask --prompt --json is caught as a forgotten value rather than dispatched as an empty prompt.

Breaking changes

Positional task text is removed, and so is one-big-string flag parsing. Both failure modes are loud and name the replacement — nothing degrades silently.

0.4.4	0.4.5
ask "question", review "Review PR #730"	ask --prompt "question", review --prompt "Review PR #730"
review "--restricted Review PR #730" (flags packed into one quoted string)	review --restricted --prompt "Review PR #730"

A positional argument on a run command — including the empty string that --prompt "$Q" "$EXTRA" produces when $EXTRA is unset — exits with positional task text was removed; pass the task with --prompt <text>, --prompt-file <path>, or --stdin. There is no deprecation window and no -- sentinel: -- is just an unknown flag. A --prompt value that starts with -- is still accepted when it is a real sentence (it contains whitespace), so ask --prompt "--check means what?" works.

This is a change to the companion CLI, not to how you invoke the personas. /agy:ask reply with OK is unchanged: you still type your question as plain text after the slash command, and the skill composes the --prompt call for you.

Management commands (status, wait, result, cancel, setup) are untouched — their positional arguments are ids and values, and wait <id> --timeout 30s behaves exactly as before. Full table with notes: REFERENCE.md → Migration from 0.4.4.

Verification

• Added black-box coverage for the task-source contract: opaque flag-like prompts in a foreground ask and a background review, the same through --prompt-file and --stdin, byte-exact prompt fidelity through quotes/newlines/double spaces, both source-conflict pairs, the removed positional path (a plain word and an empty string), packed one-big-string arguments, -- having no special meaning, the value-flag guards, and a management-command regression (wait <id> --timeout, status, setup --restrict).
• Full suite: 110 tests, 0 failures.

Upgrading

Both harnesses install a copy — pull 0.4.5 in yourself, then restart the harness so the skills load:

claude plugin marketplace update agy-staff && claude plugin update agy@agy-staff   # then restart Claude Code

codex plugin marketplace upgrade && codex plugin add agy@agy-staff                 # then restart Codex

If you drive the companion CLI directly from scripts or your own tooling, move task text to --prompt before upgrading.