v1.7.0a1

What's Changed

• ci: add a minimal CodeQL analysis workflow by @wu-changxing in #777
• feat(host): 新增以受眾分區的 HTTP 路由 by @wu-changxing in #779
• browser: choose the engine from the attested tier, and never withhold one by @wu-changxing in #782
• Replace co ai plan mode with progressive todos by @wu-changxing in #778
• Hard-stop in-flight LLM calls and tools by @wu-changxing in #785
• Add resumable JSON mode to co ai by @wu-changxing in #780
• Add a resumable Claude Code tool by @wu-changxing in #781
• Let co ai delegate work to Codex by @wu-changxing in #783
• Wire Claude Code delegation into co ai by @wu-changxing in #784
• Close the pytest security alert and pin CodeQL by @wu-changxing in #788
• Package co ai as a safe GitHub PR review action by @wu-changxing in #786
• Document the official Claude Code plugin workflow by @wu-changxing in #787
• fix(gmail): parse HTML bodies safely by @wu-changxing in #790
• Keep Claude Code permissions operator-owned by @wu-changxing in #798
• fix(action): keep review sessions transient by @wu-changxing in #803
• Make HTTP route specificity deterministic by @wu-changxing in #801
• fix(auth): share replay protection across workers by @wu-changxing in #805
• security: separate admin access from billing credentials by @wu-changxing in #807
• fix(syno): send the upload sid in the query, and let it survive a stale session by @wu-changxing in #808
• gmail: send attachments, which co outlook could already do by @wu-changxing in #806
• security: enforce Outlook attachment boundaries in the tool core by @wu-changxing in #811
• deploy: print real paths for broken local skills by @wu-changxing in #812
• Add ACP lifecycle mode to co ai by @wu-changxing in #817
• Add structured agent turn outcomes by @wu-changxing in #822
• fix(permissions): fail closed on unknown tools by @wu-changxing in #833
• Stream bounded structured tool output by @wu-changxing in #824
• outlook: save attachments to disk with co outlook download by @wu-changxing in #815
• Stream ordered ACP session updates by @wu-changxing in #825
• feat(acp): persist and resume owned sessions by @wu-changxing in #826
• ACP: bridge generation-scoped tool approvals by @wu-changxing in #829
• feat(acp): enforce session mode authority by @wu-changxing in #830
• test(acp): add official SDK conformance by @wu-changxing in #831
• feat(acp): support authorized stdio MCP tools by @wu-changxing in #835
• feat(acp): align live tool statuses with ACP by @wu-changxing in #836
• Add versioned ACP tool notifications by @wu-changxing in #842
• Stop the project walk at the repository and at $HOME by @wu-changxing in #852
• Keep tests/unit runnable: move the browser test to e2e, cap every test with a timeout by @wu-changxing in #851
• Refuse a token that bills an account this machine is not; keep URLs in read mail by @wu-changxing in #845
• Route the browser agent's key through the account check by @wu-changxing in #854
• Guard ambient API keys at billed boundaries by @wu-changxing in #857
• Make co status report the account in use by @wu-changxing in #859
• Guard send_email with the canonical project account by @wu-changxing in #861
• Guard OAuth refreshes by project account by @wu-changxing in #863
• Diagnose credential account mismatches safely by @wu-changxing in #865
• telegram: send a message from the terminal and from an agent by @wu-changxing in #866
• feat: emit stable ACP agent messages by @wu-changxing in #870
• release: ConnectOnion 1.7.0a1 preview by @wu-changxing in #872

Full Changelog: v1.6.0...v1.7.0a1