v0.189.0

Upgrading

• Security: update now if you install third-party plugins. A plugin's manifest could list public_paths / federation_paths that covered core plugin routes. An installed plugin could then make its own update and enabled routes, and the bundle routes, callable with no credential. Core lifecycle routes are now always gated, overlapping manifest entries are dropped, and bundles, ack and install-deps are reserved plugin ids (#3997).
• Security: the agent's set_config can't point a plugin at a program to run. It now refuses any key whose name includes cmd, command, bin, exe, binary, args or interpreter, and any setting a manifest marks spawns: true. Values nested inside a dict are checked too; before, they bypassed both this check and the secret check. Operators still set these from Settings (#3992).
• /api clients: status codes changed (#3973).
  • POST /api/chat returns a real HTTP error for a failed turn (429 / 502 / 503 / 400 / 500) with an object detail ({code, message, upstream_status, session_id, error_id}) instead of 200. A provider that closed the stream is 502.
  • Missing scheduler jobs and task issues return 404.
  • A goal's max_iterations must be 1–1000; 0 is refused.
  • Subagent batches are capped at 20 tasks, and one task with no prompt fails the whole batch with 422.
  • Task routes return 503 when no task store is configured.
  • /api/subagents/run and /batch model failures (429/502) now carry the same object detail (#3991).
• Legacy checkpoint databases: the periodic reclaim no longer runs a blocking full VACUUM on a DB with auto_vacuum=NONE. The log gives the one-time command instead: stop the server, then PRAGMA auto_vacuum=INCREMENTAL; VACUUM; (#3973).
• Plugins: installing, enabling or disabling a plugin applies live, including its console view and background surfaces. A restart is only needed for env or launch-flag changes, and when a toast says a background surface couldn't be swapped live (#3988, #3990).

Highlights

• See your coding agent work. @claude-code <task>, or the agent delegating to Claude Code, Codex or another ACP coder, now shows the coder's plan, the tool it's running and the file it's touching, its recent tool calls and what it's saying, live on the delegation card. Before, you got a spinner and a clock. Claude Code replies no longer open with the same sentence twice (#3979).
• The same live view for A2A peers. Delegating to another agent that streams (every protoAgent agent does) shows its tool calls and answer as they happen (#3980).
• Brand & Launch archetype (held from the picker). It replaces Social Marketing: a draft-only launch manager for any app. It plans a campaign, records scripted screen captures, renders GIFs, stills and social cards, drafts copy into a linted queue, and tracks every asset to operator approval. It never posts (#3981).
• Smaller agent prompts. A background subagent now sees only the tools its allowlist permits. On a 120-tool agent that's about 42k fewer prompt tokens per call (#3994).

Fixes

• Settings ▸ Model: "Test connection" and the model list probe the lead model's own connection and key. Before, they reported a spurious 401 while chat worked (#3978).
• Fresh installs: the agent card describes protoAgent instead of a template placeholder. Optional document libraries for the default cowork pack no longer warn on first boot (#3976).
• Windows plugin updates: updating a plugin a second time, or uninstalling it after an update, no longer fails with WinError 183. A leftover .bak folder blocked it (#3990).
• Install from URL: the dialog shows the whole git URL (#3982).
• Long /<subagent> runs are no longer cut off by the stall guard while they're still working (#3977).
• Parked-sessions list: one query instead of up to 1,600 table scans (#3972).
• Chat deletion and checkpoint pruning: deleting a chat no longer deletes other chats' checkpoints whose ids differ only by case or a wildcard character (#3973).
• Operator API errors: /api routes no longer leak exception text in 500s (#3973).
• Plugin SDK: sdk.managed_python_exe() (#3992). dispatch_tapped(on_plan=...) streams a coding agent's plan to plugins as it changes (#3995).

Docs

• The README is now a landing page with download, one-command (uvx --from protolabs-agent protoagent serve) and from-source paths (#3975, #3989).
• New network egress page: everything protoAgent calls out to on its own, and how to turn each off (#3976).