Skip to content

v1.3.238

Choose a tag to compare

View all tags
@topcheer topcheer released this 14 Sep 16:20
· 2282 commits to main since this release
v1.3.238
fa41815

ggcode v1.3.238

Highlights

  • See the changelog below for the user-facing updates included in this release.

Compare

Changelog

  • release: v1.3.238
  • fix(acp): wrap transport writer goroutine in safego.Go (#2147 follow-up, release gate)
  • fix(tui): snapshot state read by export/trace/bug-report closures (#2347)
  • fix(tui): converge MCP panel cursor at every server-list swap (#2348)
  • refactor(tui): split handleMCPPanelKey into focused subhandlers (#2335) (#2345)
  • test(tool): zz_issue2327 order assertion asserts the real invariant - legal serial order stops failing (#2341 CI flake) (#2346)
  • fix(config,tool): strip config-managed secrets from child shells (#2284-A)
  • fix(agent): scatter-dup hint asserts only provable facts - drops the consecutiveness adverb and the results-in-context claim (#2343) (#2344)
  • refactor(agentruntime): remove zero-caller SaveSessionMessages (#2340) (#2341)
  • fix(config): a2a.yaml parse failures log instead of vanishing silently (#1515 case E1) (#2342)
  • fix(tui): WeCom bind enable is bind-only - restart failure no longer deletes a pre-existing adapter (#2337 rework) (#2337)
  • fix(config): an empty shell placeholder no longer masks the real keys.env key (#1515 case D) (#2339)
  • fix(config): bootstrap fallback matches host pattern by baseURL (#1515 case C) (#2338)
  • fix(tui): WeCom bind flow auto-enables on the internal sentinel like create does (#2333) (#2336)
  • fix(tui): device-authorization banner renders at natural height, not full panel (#2334)
  • fix(onboard): re-run onboard with A2A checked flips only the flag - existing server config survives (#1515 case B) (#2332)
  • fix(agentruntime): SaveSessionMessages appends only the new tail (#1495) (#2331)
  • fix(auth): introspection endpoint from discovery document instead of URL guessing (#1503) (#2329)
  • fix(config): a2a.yaml override expands ${VAR} like every other config surface (#1515 case A) (#2330)
  • fix(tool): LockWritePath propagates to the whole write-tool family (#2327) (#2328)
  • fix(extract): RTF \uN arms substitute drops only on a successful parse (#1542 case D1) (#2326)
  • fix(agent): drop the unverifiable 'result has not changed' claim from the scatter-dup hint (#1509) (#2321)
  • fix(tui): inspector session loads carry a generation marker - stale results dropped (#2323)
  • fix(tui): IM /cost and /usage take the session lock their local twin takes (#2319) (#2322)
  • fix(session): global byte-exact user dedup + capped checkpoint context path (#2325) (#2325)
  • fix(session): loading collapses retry-duplicated user turns in render AND context rebuild (#2324)
  • fix(tool): per-path write mutex closes the CheckStale-to-rename TOCTOU window in write_file (#2318) (#2320)
  • fix(tui): status-bar and /cost billing normalize subset input tokens (#2315) (#2317)
  • fix(extract,hooks): case C trio - rtf hex blind-skip, svg textPath/anchor, path fields aligned (#1542) (#2316)
  • fix(config): instanceKeysEnv behind an atomic pointer (#2308) (#2314)
  • fix(im): Feishu post extraction unwraps the official payload and picks one language's text (#2309) (#2313)
  • fix(cost): subset-semantics normalization at the Tracker write boundary (#1529) (#2310)
  • fix(tool): truncated range reads stop fabricating a total (#2306) (#2311)
  • fix(stream): srt targets rejected honestly at config time; even-dimension and whitespace gaps closed (#2305) (#2307)
  • fix(provider): Gemini thinking budget derives from the effective budget chain (#2300) (#2304)
  • fix(im): /diff errors stop masquerading as stderr text; empty STT success stands (#1560 cases B+D) (#2302)
  • fix(markdown): normalizeHeading rebuilds WITH the ATX prefix (#2299) (#2301)
  • fix(im): feishu webhook images route through the attachment pipeline (#1550) (#2296)
  • fix(session): Delete removes the index entry before the file - no permanent ghost row (#2298)
  • fix(im): ensureConnected returns the live client - TOCTOU window closed (#1555) (#2297)
  • fix(config): instance keys.env feeds the resolver map, not the process env (#2293) (#2294)
  • fix(config): explicit instance keys override even at zero - cleared values stop resurrecting (#2284-C) (#2292)
  • fix(config): instance vendor in-place edits survive reload - merge goes instance-wins (#2289) (#2291)
  • fix(markdown): tab-delimited ATX closing sequences strip like space ones (#1644 case 7) (#2290)
  • fix(tool): conflict cap says "at least"; docker-compose prefix whitelisted (#1652 3+4) (#2288)
  • fix(provider,agentruntime): Gemini consumes the sampling override's maxTokens; MIME-less sampling images default to image/png (#2282, #2283) (#2286)
  • fix(a2a,image): mdns stop/lookup share a lock; linux clipboard commands get a deadline (#1568 cases B+C) (#2287)
  • fix(config): keys.env no longer wholesale-exported to the process env (#2284-A phase 1) (#2285)
  • fix(tool): write_file and multi_edit_file flag conflict markers in landed content (#1652 case 2) (#2280)
  • fix(im): Twitch PRIVMSG pacing is per-connection; exit_plan_mode surfaces Detail (#1565 B+C) (#2279)
  • fix(config): legacy a2a registered + removed after migration; zero-value diff suppression dropped (#1519 B+C) (#2281)
  • fix(tui): remove racy a2aEventBuf dead-store mirror write (#2277) (#2278)
  • fix(runfile): port files carry the owner's kernel start time - recycled PIDs no longer ghost (#1624 case C) (#2276)
  • fix(agentruntime): MCP sampling image content converts to ImageBlock (R232 audit item) (#2273)
  • fix(knight): CJK-dominated description sets need near-verbatim to flag duplicate (#1624 case B) (#2275)
  • chore(provider): remove dead StopSequenceSetter (#2271 follow-up) (#2272)
  • fix(provider,agentruntime): MCP sampling temperature reaches the request (#1592-A family, third member) (#2271)
  • fix(session): ID-less fingerprint dedup is adjacent-only, IDs stay global (#1628 case A) (#2270)
  • fix(provider): anthropic buildParams honors the sampling override's stop sequences (#2266) (#2267)
  • fix(stream,plugin): first-frame init re-checks stop; tilde dedup key expands; grpc handoff carries no Error; URL scheme validated (#1631 1-4) (#2264)
  • fix(tool): swarm_task_create validates the assignee; complete guards double-fire (#1705 case 2) (#2265)
  • fix(agent): #2255 review residuals - semicolon segments, per-segment flag binding, multi-git normalization (#2255) (#2263)
  • fix(tool,tui): oversized mime sniff before range branch; restart reason announced; recipe lines not targets; range reader stops at limit (#1698 1+3+4/5/6) (#2262)
  • fix(tui): VerbConsistency parser tolerates comments between case and return (#2259) (#2261)
  • fix(agent): git -C variants reach both destructive detectors; segment-scoped flags; owner-anchored safety signals (#2255) (#2260)
  • fix(agent): nested-loop barrier reaches the two sibling retry scanners (#2250) (#2258)
  • fix(agentruntime): projection switch is replay-then-switch; projBroken reset condition corrected; symbol map budget checkpoints (#1493 cases B+C) (#2257)
  • fix(tool): parseDiffStats registers pure R100 renames (#2233) (#2256)
  • fix(mcp): structuredContent-only servers surface their payload instead of an empty success (#1644 case 6) (#2241)
  • fix(provider,mcp): sampling overrides swap one atomic pointer - reader side race-free (#2248) (#2254)
  • fix(agent): search-invalidation detector revived - whitelist enqueue, bare-path output, anchored keys; dirSignature tail-2 for absolute paths (#1491 A+D) (#2253)
  • fix(agent): causal gate follow-ups - multi-line commands and symmetric-arm ambiguity (#2244) (#2251)
  • fix(cmd): session-lock IO-error branch clears resumeID like the conflict branch (#2245) (#2252)
  • fix(provider): stop_sequences escape the temperature guard in buildParams (#2246) (#2249)
  • fix(agent,cmd): reversibility git gates match ownership bigrams; CleanupOldJournals wired at startup (#1490 D+E) (#2247)
  • fix(provider,mcp): sampling stopSequences reach the request body (#2239) (#2243)
  • fix(agent): quality metrics use uncapped error counter; retry evidence stops at nested loops (#1490 A+C) (#2242)
  • fix(i18n): qq entry disabled state translated in all 8 non-en/zh catalogs (#1733 case 2) (#2240)
  • fix(tool): cmd_snippet read-modify-write under one lock, surfaced persist errors, tag-truncation note (#1644 cases 3+5+6) (#2236)
  • fix(tui): wecom create-bot rolls back all three start-failure points (#2232) (#2238)
  • fix(tui,cmd): session lock IO errors get their own message; port file follows mid-run session switches (#1487 cases D+E) (#2237)
  • fix(tui): extpane log writes capped at 5MB with in-place truncation (#1722 cases 2+3) (#2235)
  • fix(agent): causal gate reads the job's real command via snapshot header (#2218 case B) (#2234)
  • fix(mcp): sampling gate - kill switch + rate/concurrency caps (#1484 case D) (#2231)
  • fix(provider,mcp): relay the real stop reason through ChatResponse - MCP sampling stops guessing (#1484 case C) (#2229)
  • fix(tool): command gate - disaster rules gain quotedInert, continuations joined (#1648 cases 2+3) (#2228)
  • fix(tui): pcConnectionStatus i18n covers error/raw/default sites (#2224) (#2227)
  • fix(agent): causal attribution suffix tier gets the ambiguity probe (#2218 case A) (#2230)
  • fix(agent): range-nil guard collection unwraps parenthesized chains and single guards (#1677-1a, sa-179 third audit) (#2225)
  • fix(report): Overview cards double-counted Input/Output/Cache (#2221 case A) (#2226)
  • fix(tui): tg create-bot validates token form and rolls back failed starts (#2215) (#2223)
  • fix(tool): parseDiffStats registers binary, deleted, and mode-only files (#1650 case 1) (#2222)
  • fix(agent): range-nil composite guards collect all qualifying leaves (#1677-1a follow-up, sa-174) (#2220)
  • fix(agent): range-nil detector descends composite conditions with polarity (#1677 case 1a) (#2219)
  • fix(tool): ask_user schema doc matches the real default, *_with_freeform aliases set the flag (#1677 cases 4a+4b) (#2217)
  • fix(tui): Muted branch in feishu/wecom/whatsapp details (#2211) (#2216)
  • fix(tui): mattermost ghost QR hint removed, pc ghost g hint removed, pc status i18n wired (#1731) (#2214)
  • fix(knight): scheduler trust gates route through the trustCanWrite whitelist (#1644 case 2) (#2213)
  • fix(report): turnJSON carries llmCalls for the three LLM Calls cards, zero-TTFT excluded from AvgTTFT, exactly-once scan send (#1537) (#2212)
  • fix(tui): follow-view two remaining display defects (#1761 cases 2+3) (#2210)
  • fix(tui): nil-config escalation gate fails closed on the TUI remote path (#2185 follow-up) (#2208)
  • fix(tui): impersonate apply only resets version on a real preset switch (#2202) (#2207)
  • fix(i18n): French catalog spelling - 9 typo classes in 14 lines (#1727 case 2) (#2204)
  • fix(im): daemon bridge mirrors the remote dangerous commands gate - shell passthrough and SwitchMode escalation (#2205) (#2206)
  • fix(im): opt-in gate for remote dangerous commands - /mode escalation and shell passthrough (#2185) (#2203)
  • fix(tui): wechat terminal QR statuses surface instead of silent stop (#1792 case 1) (#2201)
  • fix(tui): positional create-echo masking for the 10 remaining IM panels (#2178) (#2199)
  • fix(util): bound FileLock acquisition - no more indefinite hang on a busy holder (#1834 case 2) (#2198)
  • fix(tui): impersonate versionInput syncs at the apply point, not on cursor moves (#1737 case 2) (#2200)
  • fix(knight,plugin): mixed-CJK correction fallback; grpc retire after ListTools (#1825, #1804) (#2197)
  • fix(webrtc,scripts): stale-DataChannel guards; shrink guard runs before the write (#2193, #2194) (#2196)
  • fix(util): signal-0 EPERM means alive on Unix (#2190) (#2195)
  • fix(cmd): maskedAdapterExtra recurses nested maps (#2191) (#2192)
  • fix(webui,cmd,util): webui masks the key family and nested Extra; colon-SGR strips (#2188, #1834) (#2189)
  • refactor(secretfield): single source for the secret-field-name heuristic (#2180) (#2187)
  • fix(agent): ghost detector lists annotated; coverage/scopeNarrow same-cmd dedup (#1821) (#2186)
  • fix(tui,agent): masked slack/signal create echoes; causal skips URL captures (#2178, #2179) (#2184)
  • fix(tui): mask the add-new-field echo; ctrl+e refreshes the completion (#2177, #2182) (#2183)
  • fix(tui): serialize ensureCurrentWorkspaceIMManager on the imEnsure guard (#2175) (#2181)
  • fix(tui): QQ share fails loudly on oversized workspace names; provider panel masks API-key echoes (#2172, #2173) (#2176)
  • fix(tui,agent): masked echo in the IM edit-input view; Windows paths in causal error-file attribution (#2169, #2171) (#2174)
  • fix(tool,tui,config): DNS-level SSRF guard on the proxy path; "key" in the secret-masking pattern (#2165, #2167) (#2170)
  • fix(agent): case-safe Job ID extraction; causal error-file regex covers the claimed toolchains (#2098, #2099) (#2168)
  • fix(tui): mask secret env values in the IM adapter edit panel (#2158) (#2166)
  • fix(agent): exploration-frag counts before the clear; cross-file-impact scope discrimination for methods and keys (#2100, #2103) (#2163)
  • fix(config,tui): lock the IM adapter map end-to-end — Cmd-goroutine reads raced Update-loop writes (#2152) (#2156)
  • fix(tool,config): extract family depth/anchor residues; RemoveVendor key purge (#2159, #2161) (#2162)
  • fix(config): keep the two vendor-key env var names in lockstep (#2105) (#2160)
  • fix(config): instance-scope partial reset actually deletes the key (#2106) (#2155)
  • fix(config,cmd): lone-quote startup panic guard; systemPrompt under the existing mutex (#2104, #2102) (#2154)
  • fix(tool): capture the full container in extractTaggedBlock - inner same-name blocks were dropped (#2151)
  • fix(tui): /sessions lists only the current workspace's sessions by default
  • fix(tui): padPanelLine is ANSI-aware - stop clobbering lipgloss SGR sequences
  • fix(agent): split compound commands on '&' so cd-composites reach the real command (#2122)
  • feat(prompt): route 3+ read-only analyses to code_execution
  • fix(permission): exit_plan_mode restores the user's own previous mode without an Ask gate, reversing #551-D
  • fix(agent): use POSIX-guaranteed true in the cd-compound preflight test (#2122)
  • fix(agent): verify preflight strips env/cd prefixes; just/task fall through on no matching recipe (#2122, #2123)
  • fix(tui): guard the mention completion against a missing '@'; refresh it after readline shortcuts (#2149)
  • fix(tool): align the spam exemption with filter semantics; same-name closing tags in web_fetch extraction (#2146)
  • fix(acp): deliver write outcomes through the outbound ack; never park on sendMu; actually drain in CloseWriter (#2147, #2148)
  • fix(swarm): close the SpawnTeammate ghost window and the late-idle results resurrection (#2121)
  • fix(acp): stop the outbound writer goroutine in CloseWriter - drain-then-exit
  • fix(acp): keep the transport mutex off the write path - outbound queue with droppable notifications (#2109)
  • fix(swarm): wait for runner done channels outside the manager lock in DeleteTeam (#2120)
  • fix(im): implement Feishu's Encrypt Key callback decryption (#2110)
  • fix(tool): return the MultiFileEditContent JSON shape from multi_file_write (#2145)
  • fix(lsp): reject acquire after shutdown; give the exit notification its own deadline (#2144)
  • fix(agent): give the integrity loop dry-run and per-file-outcome awareness (#2143)
  • fix(tool,lanchat): refuse coin-flip delivery on the archive team|role fallback (#2142)
  • fix(im): gate inbound messages on effective content, not empty text (#2140)
  • fix(lsp): tear down LSP sessions on app exit with the shutdown/exit handshake
  • fix(tool,im): reject leading-dash tag names in git_tag delete; defer-cancel runOnce's sync child (#2139)
  • fix(agent): mirror write-time gofmt in the multi-file integrity loop; CRLF branch in the edit simulation (#2138)
  • fix(tool): mark prefix-scan hits seen only after the ambiguity determination (#2137)
  • fix(im): give interactive button IDs ownership so stale cards cannot answer successor questions (#2134)
  • fix(lanchat): copy peer values under the lock; guard the last unguarded NewRequest (#2135)
  • fix(tool,im): reject leading-dash tag names in git_tag create; drop stale OlmMachine on Load failure (#2133)
  • fix(agent): collapse plural line refs in integrity normalization; run checks on real drift, not the raw argument (#2132)
  • fix(tool): treat bare directory names as dir-like in git_add's sensitive-file gate (#2131)
  • fix(provider): guard outputTokens against zeroed duplicate message_delta usage (#2129)
  • fix(lanchat): capture store/role/team under the hub lock for post-Unlock use (#2128)
  • fix(im): self-cancel matrix sync when Close lands in the setup window; drop bare approval tokens in the stale-reply window (#2127)
  • fix(im,matrix): open the crypto store with the linked sqlite driver, not the absent sqlite3 (#2126)
  • fix(agent): keep count suffixes through integrity normalization; symmetric trim in blast radius (#2125)
  • fix(subagent): reject Spawn after Shutdown; reclaim never-started Pending entries (#2119)
  • fix(swarm): count panic rollbacks against the #1295 task retry cap (#2118)
  • fix(provider): cap tiered context-probe spend at 1.5M billed tokens (#2116)
  • fix(provider): anchor thinking-error detection to real rejection phrases and 4xx status (#2115)
  • fix(lanchat): guard sendReceipt's NewRequest error; FIFO-bound the receipts map (#2114)
  • fix(im,twitch): bound IRC writes with a deadline; close the Close/dial TOCTOU window (#2113)
  • fix(im): suppress reply-shaped text after an approval/ask_user expires (#2111)
  • fix(im,matrix): reset the didFirstSync gate on M_UNKNOWN_POS self-heal (#2112)
  • fix(tool): browser profile-GC re-validates map adoption before RemoveAll (#2091 review)
  • fix(tool): stop the browser profile-GC goroutine on Close; re-validate profile across the getSession lock gap (#2096)
  • fix(desktop): complete the notification rollback contract on all platforms; bound runWinToast (#2095)
  • fix(im,stt): bound STT audio at 100MB, not the 20MB image ceiling (#2055)
  • fix(config): gate bare TAGS detection on the assigned value naming goolm (#2054)
  • fix(webrtc): stop tearing down the DataChannel on transient ICE Disconnected (#1854)
  • fix(im,matrix): scope the Olm crypto db per user, like the sync-token store (#1851 follow-up)
  • fix(vcs): judge jj IsClean via diff summary, not version-drifting prose (#1853)
  • fix(im,matrix): restart sync on M_UNKNOWN_POS instead of same-token retry; scope sync-token store per user (#1851)
  • fix(tunnel): #1182 test brokers leak textFlushLoop; knob restore is a data race
  • fix(mcp,acp,util): actually normalize sse transport to http; log malformed resource drops; map PAC HTTPS directive to https (#1848)
  • fix(util,config): distrust MSYS-style HOME on Windows; never build root-absolute config paths from an empty home (#1837)
  • fix(tunnel): waitReady discards DataChannel-ready after Stop (#1830 follow-up)
  • fix(update): roll back half-applied Unix self-update targets; stop CJK path truncation in Windows elevate quoting (#1832)
  • fix(tunnel): de-flake P2P upgrade retry after ctx expiry; clear negotiating flag in handler and Stop (#1830)
  • test(desktop): package TestMain isolates HOME for the #2033 real-home guard
  • test(webrtc): pin disconnect callback exactly-once contract (#1827)
  • fix(install,webrtc): preserve $PATH on installer re-run; fire P2P disconnect exactly once (#1827)
Assets 51
Loading