v1.27.0

Behavioral compatibility notes

The following merged PRs were labeled release-note-required and are called out explicitly in this release:

• #3561 Expose condenser token threshold settings (@neubig)

What's Changed

• refactor(secrets): seed agent_context.secrets into the registry for all agents; consolidate ACP onto it by @simonrosenberg in #3528
• feat(settings): add app_preferences block to persisted settings by @chuckbutkus in #3539
• feat(prompts): add comments policy to system prompt by @juanmichelini in #3530
• feat(eval): enable inline_image_urls for gemini-3.5-flash by @juanmichelini in #3521
• feat(llm): add minimax-m3 to verified MiniMax models by @kapelame in #3461
• fix(llm): match LiteLLM proxy model_info by litellm_params.model too by @juanmichelini in #3429
• Fix release regressions by @enyst in #3537
• Add dynamic workflow tool by @neubig in #3426
• Expose condenser token threshold settings by @neubig in #3561
• test(ci): detect persisted settings compatibility regressions by @enyst in #3298
• fix(security): pin ACP npx launchers to reviewed versions (closes #3357) by @Sanjays2402 in #3399
• fix: handle malformed tool names with XML tag fragments by @juanmichelini in #2819
• fix(acp): make prompt timeout an inactivity deadline, not a hard cap by @simonrosenberg in #3570
• PLTF-2899: add error_id correlation to unhandled 500 responses by @aivong-openhands in #3518
• PLTF-2899: serialize webhook events with model_dump(mode="json") by @aivong-openhands in #3517
• feat(acp): allowlisted CLI session-blob export/import for native cloud resume (#1126) by @simonrosenberg in #3562
• feat(llm): retry without prompt caching when cached content is below provider minimum by @juanmichelini in #3480
• feat(settings): Expose tool_concurrency_limit (parallel tool calls) in agent settings by @VascoSch92 in #3568
• revert(acp): drop CLI session-blob export/import (#3562) by @simonrosenberg in #3576
• Add nemotron-3-ultra-550b-a55b-or-paid eval model (paid OpenRouter route) by @juanmichelini in #3579
• refactor(settings): nest AppPreferences under new misc_settings container by @chuckbutkus in #3543
• fix(sdk): URL-encode session_api_key in WebSocket query parameter by @Hades32 in #3558
• refactor(tools): reuse shared shell parser in terminal command utilities by @Fieldnote-Echo in #3578
• Clarify required HUMAN placeholders in PR template by @enyst in #3551
• fix(llm): gate Responses reasoning options by model support by @enyst in #3554
• Use reusable issue duplicate checker action by @enyst in #3457
• docs: guide LLM-specific tweaks through model features by @enyst in #3375
• fix(acp): key Claude auth-conflict strip on the OAuth token, not CLAUDE_CONFIG_DIR by @simonrosenberg in #3589
• Release v1.27.0 by @all-hands-bot in #3572

New Contributors

• @kapelame made their first contribution in #3461
• @Sanjays2402 made their first contribution in #3399
• @Hades32 made their first contribution in #3558

Full Changelog: v1.26.0...v1.27.0