v0.187.0

Upgrading from v0.186.0

• Chat session ids are validated on every chat entry point (#3951). A caller-supplied session id is now checked the same way on POST /api/chat, the /api/chat/sessions/{id}/… routes, fork's new_session_id, the /api/goals/{id} routes and A2A contextId. An id that is empty, . or .., longer than 255 characters, or contains /, \, %, a control character or one of < > " | ? * is refused: HTTP 422 on REST, JSON-RPC -32602 on A2A (no task is created). Ids the console, Zed, /v1 and A2A clients generate are unaffected, and a blank session_id on /api/chat still mints a new one. If you pass your own session ids, check they fit this shape.
• Goal-driven turns are capped at 50 model rounds by default (#3962). The new goal.max_rounds_per_turn (Settings ▸ Goal mode) applies to goal kickoffs and continuations; 0 means unlimited. model.round_hard_cap still applies if you set it, and the smaller non-zero cap wins. A goal turn that hits the cap ends with a hand-back, and the goal pauses ("⏸ goal paused — round cap reached") instead of re-driving at once; it stays active, and your next message or a watch/schedule fire drives it again. Long goal turns that used to run on will now stop at 50 rounds; raise the value or set it to 0 to keep the old behaviour.
• A goal with a restricted tool scope pauses commands in its session (#3964). While such a goal is active, slash commands, @-mentions, /<workflow>, /<subagent> and skill shortcuts don't run (a one-line notice says commands are paused), and an ACP runtime declines the turn. /goal always works: run /goal clear (or replace the goal) to get commands back.
• No other config changes are required.

Highlights

• Each concurrent turn gets only its own context (#3958, #3960). The per-turn composed context (memory, working state, skills index) and the one-shot toolset notice now travel with each run instead of on shared middleware, so overlapping turns no longer pick up each other's context. After a HITL resume, the turn recomposes its context from its own input (a mid-turn steer counts; guard notes and summaries don't), and each resume compose is recorded in the memory injection log.
• The per-request model override reaches every subagent run (#3959). /<subagent> runs on /api/chat and /v1, /<workflow> steps on every surface, and plugin sdk.run_subagent / sdk.spawn_background calls now honour the request's model, with the same precedence as task: subagent pin > turn override > routing.aux_model > main model. Before, they ran on the default model, and /v1 could answer HTTP 500 when the default was rate-limited.
• Console: questions from ask_human stay answerable.
  • A turn parked on ask_human shows "waiting for you" while the form is up, and the form comes back after a reload; each parked tab resubscribes to its own task (#3961).
  • When a plain message re-parks a waiting question on a new task, that task stays the live turn. /turns now lists turns in creation order and returns live_task_id, and a tab still pointing at the old task follows it to the new one (#3965).
• Goal round cap and goal tool scope. See the upgrade notes above (#3962, #3964). /btw side questions in a goal session also run within the goal's tool scope, and /goal status says when a goal runs with a restricted tool scope.

The full list is in CHANGELOG.md.

What's Changed

• fix(chat): normalize caller-supplied session ids consistently across chat entry points by @mabry1985 in #3951
• fix(subagents): carry the per-request model override into slash, workflow and SDK subagent runs (#3955) by @mabry1985 in #3959
• fix(context): turn-scoped projected context for concurrent turns by @mabry1985 in #3958
• fix(knowledge): a resumed turn's recompose queries with the turn's own input and is injection-logged by @mabry1985 in #3960
• fix(console): a live ask_human park waits for you and survives a reload (#3956) by @mabry1985 in #3961
• feat(goal): cap the model rounds of a goal-driven turn — goal.max_rounds_per_turn (#3957) by @mabry1985 in #3962
• fix(goal): goal-driven turns apply the goal's tool scope before pre-turn dispatch by @mabry1985 in #3964
• fix(chat): a pause re-parked by a plain message stays the live turn (#3963) by @mabry1985 in #3965

Full Changelog: v0.186.0...v0.187.0