v0.188.0

Upgrading from v0.187.0

• An explicit model pick that can't be built now fails the turn (#3970). Before, a per-turn pick (/v1 model, the console's model picker, or A2A metadata.model) that couldn't be built logged "could not switch … using default" and ran on the default model. Now the turn fails with a short error naming the pick. /v1 answers 400 (param: model) for an unknown connection, a model id the connection rejects, or a connection that needs setting up, and 503 with Retry-After only for a transient cause such as a network error or a token refresh that couldn't reach the provider. The console also shows a fix-it hint (for example "Run codex login"). An effort-only change (/effort) still degrades softly.
• A model pick applies to its own turn only (#3970). A turn with no pick, including a scheduled or watch fire into a chat, now runs on the default model instead of inheriting the chat's last pick. Choosing "Default" in the console therefore always returns to the default. A goal remembers the pick it was set with (an explicit pick on a later goal turn replaces it), and its turns with no pick of their own use it. If that model can no longer be used, the goal's turns run on the default model and the reply ends with a one-line notice; /goal clear ends the goal.
• PUT /api/scheduler/jobs/{id} is a partial update (#3969). Send only the fields you want to change; an omitted field keeps its current value, so {"schedule": "0 17 * * *"} no longer returns 422. An explicit "timezone": null resets the job to UTC. {} returns 400 nothing to update.
• Failed and cancelled workflow runs end honestly (#3971). A /<workflow> whose output step failed, or whose every step failed, now ends the task FAILED instead of COMPLETED. Its output is kept as the answer (chat, the Activity feed, scheduled reports and background jobs still get it), and the error is one short line naming the failed steps. A run that lost a branch but still produced its output completes with the failed-steps note, as before. A run stopped by an operator or API cancel is recorded as cancelled, and a run stopped by the stall guard as failed, with the stall message as its error. A long step that keeps making progress (model calls and tool rounds) is no longer killed by the 900 s stall guard; a step stuck inside a single call is still ended.
• /api/subagents/run error statuses (#3970). An upstream 429 is now answered as 429 with the provider's Retry-After, and other upstream failures (or an unreachable gateway) as 502, instead of 500.
• No config changes are required.

Highlights

• Scheduler and watch edge cases (#3969). A background job interrupted by a restart now settles its delegation-ledger edge as failed, so the org chart no longer shows it running forever. A malformed schedule (an ISO time outside the datetime range, or a non-string schedule or timezone) returns 400 invalid schedule from the REST routes and a clear error from the schedule tool, instead of 500. Clearing a watch while its verifier is mid-check no longer brings the watch back, and a stale check no longer overwrites a watch re-created under the same id.
• Console task states are classified in one place (#3968). A turn the agent rejected now shows as an error instead of done, and a turn whose state the server reports as unknown settles on the first poll instead of keeping the chat busy for up to 10 minutes. Chats waiting on an ask_human answer or an approval always come back in a fresh browser, even when older than the 50 newest chats; the new GET /api/chat/sessions?parked=true lists them.
• Chat forget, telemetry and goals (#3970).
  • Deleting a chat with "forget" now runs in two phases: its memory is hidden, the chat is retired, then exactly the hidden rows are deleted. A failed retirement loses nothing, and the maintenance sweep settles an interrupted forget.
  • Telemetry rows name the requested model when no call reported one, and /<subagent> and /<workflow> turns now record their model calls and tokens.
  • The "goal paused — round cap reached" note is included in transcript exports.
  • /goal with an unknown verifier type says so and lists the known types.
• Desktop agents keep their note after upgrading (#3967). The one-time Notes migration now also adopts a desktop member's note from ~/.protoagent/notes/<instance>, where the desktop sidecar wrote it before per-instance scoping, so a desktop agent no longer comes up with an empty note. A note in the box-scoped location still takes precedence.

The full list is in CHANGELOG.md.

What's Changed

• fix(notes): adopt a desktop member's pre-scoping note from the home dir by @mabry1985 in #3967
• fix(console): rejected turns fail, GetTask unwrap, parked sessions survive the hydration cap (#3957) by @mabry1985 in #3968
• fix: settle ledger on restart reconcile, ValueError for bad schedules, watch clear race, partial scheduler PUT (#3943) by @mabry1985 in #3969
• fix: #3957 server follow-ups — telemetry model/usage, override + subagent error shapes, /goal type, forget order, pause note in export by @mabry1985 in #3970
• fix(workflows): long steps survive the stall guard; failed/cancelled runs end honestly (#3940) by @mabry1985 in #3971

Full Changelog: v0.187.0...v0.188.0