v1.3.204

v1.3.204

Security Fixes

• Plan mode state mutation (#76): browser and mobile_device removed from read-only tool list. These tools can execute JS, click, type, and install/uninstall apps — they now require confirmation in Plan mode and Supervised mode.
• Auto mode sandbox bypass (#77, Critical): file_ops and batch_replace now get sandbox enforcement in Auto mode. Previously both tools bypassed sandbox checks entirely, allowing arbitrary file deletion/modification outside the workspace.
• file_ops move destination (#79): extractFilePaths() now extracts the destination field alongside source for file_ops operations. Move operations with destinations outside the sandbox are now correctly denied.

Fixes

• A2A API key env expansion (#78): A2A.Auth.APIKey (singular) now correctly environment-expanded alongside APIKeys (plural). Users using ${ENV_VAR} in a2a.auth.api_key no longer get the literal string.
• Session file deletion on transient I/O (#70): pruneInvalidIndexEntries no longer deletes session files on transient I/O errors (network filesystem, permission, lock). Files are skipped instead of permanently removed.
• Checkpoint context loss for >24h sessions (#71): Checkpoint summary search now uses postCPEntries (all messages) instead of allMessages (24h-windowed). Long-running sessions no longer lose compacted context.
• A2A memory leak (#72): Abandoned input-required tasks now cleaned up after 2 hours. Previously leaked memory and cancel funcs indefinitely.
• A2A SSE timeout JSON-RPC compliance (#73): SSE timeout now sent as JSON-RPC Error field (code -32001) instead of result-wrapped string. Clients can properly detect timeouts.
• knowledge_graph tag data loss (#74): Tags preserved on node update when not provided, matching the existing Status pattern.
• multi_edit_file empty path (#75): file_path validated before sandbox check, returning clear "missing required parameter" error instead of confusing OS error.
• MCP Close() cleanup order (#39): Corrected OAuth handler cleanup order; added regression test.
• 49 agent detector and business-logic bugs (#31-#69): Fixed false positives, false negatives, and logic errors across security checks, agent integrity detectors, desktop bugs, and provider behavior.