codr v0.8.0

codr 0.8.0

codr 0.8.0 adds confirmed phone-driven worker updates, immediate prepared-media
delivery, ordinary file attachments, and more reliable project setup and
progress completion. These changes follow 0.7.0.

Confirmed updates from your phone

• /update checks stable releases from the pinned maintainer's ngit records and
  downloads checksum-verified bytes from Blossom, without a GitHub fallback.
• A ten-minute, chat-bound confirmation is required before installation. The
  update job replaces only the managed bridge worker, retaining identities,
  chats, queues, accepted deliveries and running native coding sessions.
• Connector, protocol or storage-cohort changes are refused. Failed startup
  restores the previous executable without rewinding routing state. Uncertain
  launches are not automatically retried.

Media delivery without an idle wait

• ZIP archives, documents and other file attachments are downloaded to private
  local files and handed to the agent with their caption, file path and quoted
  original name. They do not require audio transcription. Archives are not
  automatically extracted or executed by the bridge.
• Images download and voice messages transcribe while the agent works. Prepared
  input is handed to the same verified native session without interrupting it or
  waiting for the current task to finish.
• Image preparation stays FIFO, but an older legacy text delivery does not hold
  it up. Outgoing sync-off does not block owner media input. Captions, private
  prepared paths and submission receipts survive worker restarts.
• Image acceptance says Preparing image, rather than implying that a future
  agent task was queued. Blocked native dialogs and changed or unavailable
  sessions still defer delivery safely.

File attachments retain the four-attachment and 25 MiB-per-file limits. Private
copies survive restarts; remote filenames never become destination paths.

Optional Gemini voice transcription

• Paul Eipper (@lkraider) contributed
  scripts/transcribe_gemini.py through ngit for hosts where local transcription
  is too slow or too large. It sends decrypted voice audio to Google's Gemini
  API and returns the transcript through the existing voice-message flow.
• Local Phonon remains the default. Gemini requires an API key file with private
  permissions and an explicit transcribe_command change; setup does not enable
  it, and there is no automatic Google fallback. Google's API terms apply.
• Tests use synthetic audio and mocked HTTP responses. No live Gemini request
  has been verified.

Standalone control chat

• Juraj Bednar (@jooray) contributed an optional
  owner-only codr control chat. Set control_chat = true to create it on worker
  startup. It accepts /new and general commands without an existing agent
  session; ordinary text receives guidance instead of becoming an agent prompt.
• The chat is off by default and uses the existing account. It is excluded from
  session-history checkpoints, session-end detection and automatic renames.
  Uncertain group creation is not retried automatically.

More reliable project setup

• Juraj's command shortcuts accept unambiguous prefixes such as /n, /st
  and /sy. The control chat also accepts bare command words. Ambiguous
  prefixes do not guess, and shortcuts never rewrite prepared voice/file input
  or previously accepted deliveries. /u is ambiguous between /unmute and
  /update; use /un or /up instead.
• At the folder step, ls lists selectable folders under launch_root for
  numbered selection. Listing and launch validation do not follow root,
  ancestor or entry symlinks. Existing one-line workspace names list and
  pick remain valid.
• Reply confirm, yes or y to a current launch preview, or type its
  repository folder name. Expiry, cancellation, replay protection and workspace
  revalidation remain active.
• Fresh panes can finish shell startup before agent.start succeeds. Only an
  explicit pre-input agent_pane_busy refusal retries, every 250 ms for up to
  15 seconds. Other errors and uncertain outcomes do not retry.
• Confirm /new using the repository folder name, not the destination workspace
  label. For parent/repo.v2 inside workspace Main, type repo.v2. The preview
  still shows the workspace separately and rechecks destination renames.
• Keep ten-minute expiry, restart-safe confirmations and 0 cancellation. A
  repository folder named 0 uses explicit /new confirm instead.
• Accept OpenCode's explicit default variant when the selected model omitted
  a variant. Previously, a successfully created session could be marked
  uncertain before its tab or agent started. In-place model changes use the same
  corrected check. Provider, model, explicit variant, session and folder checks
  remain strict; old uncertain launches still require inspection.

Custom text replies to OpenCode questions

• For a supported OpenCode V2 question that allows a custom answer, type the
  answer directly, such as v6.6.6, or use /answer TEXT. Exact listed numbers
  and labels still select an option. Combined text such as 1 v6.6.6 is sent
  literally as a custom answer, not interpreted as two separate actions.
• Custom replies use the authenticated, request-bound form API. The bridge
  rechecks the native session, current form and question code before sending,
  and persists submission intent first. No model prompt or terminal keystrokes
  carry the custom text; uncertain replies are not automatically repeated.
• Changed questions require the current card's code. Custom text is limited to
  4000 UTF-8 bytes and complete owner text messages; prepared media is not
  automatically treated as a custom answer. Legacy questions, forms without
  custom answers, multi-select and multi-question dialogs retain terminal-only
  custom entry.

One progress bubble, completed in place

• Follow-ups, media acceptance and blocked-to-working transitions do not append
  extra standalone working notices. The active editable bubble carries status
  and checklist updates, then becomes done; final answers remain separate.
• Failed completion edits keep their known targets and retry without blocking
  final replies. Mute/resume and restart retain both the target and completion
  evidence, including a final recorded before runtime reports idle.
• Early idle alone does not finish progress. A lost initial acknowledgement with
  no known message target is retained for inspection instead of replaying a send
  that could create a duplicate; local status reports unresolved_progress.
• New chats say Connected to <chat name>. followed by
  Type /help from anywhere to view commands. The obsolete bracketed terminal
  title and longer Pat introduction are removed from the welcome.

Reliable handoff and retained chats

• Juraj's repeated-message attribution matches identical confirmed phone
  receipts to fresh transcript echoes by count. Unmatched extra input remains
  ambiguous and still mutes forwarding.
• Delivered blocked notices do not repeat after mute/wake. Cancelled notices
  that never reached a confirmed send can announce on wake. Muted polling does
  not consume their announcement, and editable progress keeps its known target.
• An unexpected new native session on a terminal with a retained chat pauses
  the new connection before creating another group. The original chat, history
  and accepted deliveries remain intact. Local confirm-session-change checks
  the current terminal and native identity before approving a separate chat.
  Returning to the original native session reconnects its existing chat.
• README guidance covers the control chat and White Noise intelligent folders.
  Existing screenshots remain unchanged.

The bridge guard does not patch OpenCode itself. The separately installed local
OpenCode session-recovery build is not part of codr's release assets.

Contributors and prior work

The new 0.8.0 changes were implemented by Tom Dwyer
(@tidley), Paul Eipper
(@lkraider), who contributed the optional Gemini
transcriber through ngit, and Juraj Bednar
(@jooray), who contributed the standalone control
chat, command shortcuts, folder listing, confirmation replies, safe launch
retries, input attribution, blocked-notice deduplication and README guidance
through GitHub PRs #7 and
#8–#15.
Tom added the session-replacement safeguard and the review-driven integration
regressions and fixes. Original contributor commits are preserved.
This release also builds on the 0.7.0
contributions of Paul Eipper (@lkraider)
through ngit and Juraj Bednar (@jooray) through
GitHub. Their original contributions and credit remain in the
0.7.0 release notes; those
earlier contributions are not presented as newly authored 0.8.0 changes.

Verification and release limits

Local verification covers the Rust and Python suites, strict clippy, and
independent read-only reviews, including the attachment and custom-answer fixes.
No real self-update has been exercised; updater scheduling and rollback tests use
fixtures. Local verification does not substitute for the required four-platform
release checks.

Existing 0.7.0 binaries cannot be relabelled as 0.8.0. A public 0.8.0 release must
be built from its reviewed, versioned source and pass the platform and connector
gates. The connector remains in the existing MDK 0.14 cohort; this release does
not authorize storage migration. Published notes and credits must be identical
on GitHub and the verified ngit/Blossom mirror.