v0.210.0

protoAgent v0.210.0

A fix release, driven by the agents' own friction logs. Parallel tool calls on Codex keep their arguments again, and registering a project no longer takes away the agent's own workspace. ACP background delegations get fresh sessions and report honest failures. Auth checks are hardened for Starlette 1.9, which current Docker and desktop builds already install.

Upgrade notes

• Empty ACP replies now fail. A background delegate_to to a coding agent that ends its turn with no text is now recorded as failed (ok: false). Before, it was a silent "(replied with nothing)" success. The error names the stop reason, the tool-call count and a short stderr tail. (#4371)
• Background delegations start a fresh ACP session. Independent background jobs no longer inherit a pooled, days-old transcript. Explicit resumes and the board's fix-round continuations still resume. (#4319)
• Stricter public paths. Only the console tree and the exact public files skip authentication. A path that only starts with /app, /healthz or /manifest.json (e.g. /apple) now needs a credential. Nothing was exposed before this change. (#4365)
• Installer. scripts/install.sh passes the token to Docker as -e A2A_AUTH_TOKEN, read from your environment. When no token is set, the variable is left out instead of passed empty. (#4315)

Security

• Device-scope ceiling on Starlette 1.9 (#4367). Starlette 1.9 keeps an encoded ?/# in request.url.path instead of cutting the path there. That let a device-scoped credential's …/install%3Fx slip past the check that refuses device credentials. The check now handles both spellings itself, on every Starlette version.
• Auth decides on the path the router dispatches (#4372). url.path silently drops a decoded tab/CR/LF, so a path like /api/plugins/<id>/ho%09ok/x could match a plugin's public prefix while the plugin's catch-all route ran without auth. Public, federation and signed-media admits must now hold on both url.path and the routed path. No core route was reachable this way.

Fixed

• Codex parallel tool calls keep their arguments (#4368). On openai-codex, every call in a batched turn reached its tool as {}, because the backend sends the arguments only on the done events. Agents logged this as their own mistake for days.
• Registering a project keeps the writable workspace (#4369). Registering even a read-only reference checkout used to drop the implicit workspace project. On desktop it couldn't be registered again.
• ACP timeouts carry evidence (#4319). They now report the session, the transcript path when known, the last tool activity, any pending permission, edited paths and stderr, so finished work isn't lost behind a bare "timed out".
• save_file_artifact accepts an absolute path with project (#4326) when the path is inside that project. A path outside it is refused with a message naming the root.
• A tool row no longer spins forever beside background delegations (#4300).
• The installer works against token-protected instances (#4315). It sends the bearer on readiness and setup requests, and a 401/403 now reports an auth error instead of a timeout.
• Workflow eval cases reach the workflows plugin again (#4310).
• Device pairing hardening (#4366). Concurrent updates no longer lose a device or spuriously revoke a phone.

Plugins released alongside

• campaign-plugin v0.7.0: the producer can load skills, campaign_view crops at 100 %, and asset notes are readable (campaign_asset).
• design-system-plugin v0.14.0: theme_contrast accepts rgb()/hsl()/oklch() and other browser colours, and the designer and critic subagents get read tools.

What's Changed

• fix(auth): public paths match the /app/ tree and exact files, not bare prefixes by @mabry1985 in #4365
• fix(devices): lock every registry write, close the verify race, cover the claim and device routes by @mabry1985 in #4366
• fix(evals): workflow eval cases use the workflows plugin route (#4310) by @mabry1985 in #4373
• fix(chat): a tool row settles when a background delegation split its step (#4300) by @mabry1985 in #4374
• fix(codex): parallel-batched tool calls keep their arguments (#4368) by @mabry1985 in #4376
• feat: Fail empty ACP delegation replies with bounded diagnostics (#4371) by @mabry1985 in #4375
• feat: Keep implicit writable workspace after registering a reference project (#4369) by @mabry1985 in #4378
• fix(install): send the operator bearer on setup requests; report 401/403 as auth (#4315) by @mabry1985 in #4377
• fix(auth): device-scope ceiling holds on encoded ?/# paths under Starlette 1.9 (#4367) by @mabry1985 in #4372
• fix(artifact): save_file_artifact accepts an absolute path inside the named project (#4326) by @mabry1985 in #4379
• feat: Fresh independent ACP background sessions; preserve explicit resumes (#4319 slice 1) by @mabry1985 in #4380
• feat: ACP timeout evidence: session, last tool, permission and changed-file summary (#4319 slice 2) by @mabry1985 in #4381

Full Changelog: v0.209.0...v0.210.0