Skip to content

v1.3.232

Choose a tag to compare

View all tags
@topcheer topcheer released this 04 Sep 09:24
· 265 commits to main since this release
v1.3.232
1025d55

v1.3.232

Release date: 2026-09-04

Summary

Quality-focused release: 113 commits since v1.3.231 closing 49 issues
(#1428-#1477) across agent-detector precision, A2A/relay protocol and
security, TUI/desktop stability, and infrastructure.

Agent intelligence & detectors

  • Fixed three permanently-dead detectors (accidental-unwiring family):
    edit-abandon, goal-drift (reset-after-capture), and edit-propagation
    (cleared by any successful tool result).
  • Mid-run interruptions now carry image blocks end to end - IM/webchat
    screenshots arriving mid-run are no longer stripped at the injection
    boundary (agent, IM bridge, TUI, desktop).
  • Mixed tool batches no longer pre-execute reads: [edit X, read X]
    verification batches previously returned pre-edit content and provoked
    duplicate edits.
  • Precision batch: converged workflows spared from drift-recurrence
    warnings; single parallel exploration batches no longer flagged as
    fragmentation; conflict-resolution edits pass the pre-write gate;
    comment-suppressed error blocks exempt; pagination/cached-repeat
    footers no longer misread as degradation.
  • Patch-exhaustion counts calls instead of paths; orphan-file tracking
    skips existing files; export-guard burns its marker only on real
    changes; structural-failure detection requires streak plus density.
  • undo_edit clears read/edit bookkeeping; hub guard retries instead of
    latching disabled on go.work-only workspaces; post-compaction reset
    covers six more per-run counters.
  • Removed dead code: nesting_depth checker, debug sniffer (fc5c4aa
    deliberate-cutoff family), orphaned duplicate-decl file.

A2A / relay

  • Security: share-session refresh enforces renew-token expiry (leaked
    tokens no longer self-renew indefinitely); push callbacks pin the
    dialed IP against the blocklist (DNS rebinding); X-API-Key stripped
    on cross-host redirects; card-declared apiKey headers honored.
  • Correctness: messageIndex dedup merged into one critical section
    (TOCTOU double-create closed); event field taskId aligned with the
    A2A spec; SSE streams no longer hard-cut at 15 minutes.
  • Resilience: model catalog retries with backoff; trace suppression
    window actually fires; dropped_sends visible in periodic stats.

TUI / desktop / IM

  • #1367 config-race family fully cleared: all 22 IM panel config
    writes now leave Cmd goroutines.
  • IM keys validated before persisting (nostr, slack); desktop
    notification storms bounded; quit-path teardown for A2A/ACP/LAN;
    Windows path-escape fixes (symlinks + separators).
  • Model catalog, provider refresh, and wizard flows hardened.

Infrastructure

  • ACP: MCP manager unregisters tools on close (same-named servers in
    later sessions no longer register zero tools); top-level session
    load sets the save dir (no more CWD pollution); closeSession race
    fixed; device-flow expiry defaults applied.
  • Daemon session-lock fails closed; updater rollback guarantees; MCP
    reconnect cooldown loop and manual refresh with content-hash gating.

Verification

Every fix shipped with review, regression tests, and green CI; several
companion tests caught first-version defects post-push and were
corrected immediately (documented per-issue).

Assets 51
Loading