v2.12

# Agent Zero Release Notes

## Connector & Transport Hardening
- Enforced negotiated WebSocket payload ceilings with a symmetric checksummed transfer protocol for large operations, including bounded transfer state, disk spooling, and automatic cancellation on pause, reset, delete, or disconnect
- Made workspace HTTP file transfers atomic with streaming uploads into partial files, size verification, fsync, and SHA-256 download receipts
- Bounded remote connector tool payloads with explicit continuation metadata for large content, rejecting oversized inline artifacts before base64 expansion and routing bulk files to authenticated HTTP transfers
- Documented connector payload contracts including WebSocket ceilings, transfer state machine, cancellation lifecycle, and remote text limits

## File Browser & Editor
- Added independent, lazily loaded directory trees to Files and Editor in canvas and modal modes with unified styling, lighter panel backgrounds, and flat toolbar controls
- Unified text and code editing in the shared Editor with ACE syntax highlighting, line numbers, native source search, and Markdown preview — removing the legacy file-editor modal
- Added File Browser preferences for sorting, view mode, initial tree visibility, and independent editing and transfer limits
- Exposed connected CLI and Launcher folders in Files with host permissions, authenticated HTTP transfers, size/SHA-256 checks, and atomic publication
- Centralized streamed file transfers and hardened archive operations with expansion and entry budgets, unsafe member rejection, and owned temporary-file cleanup
- Moved File Browser controls into a dedicated Settings category with appearance defaults, remote connections, file limits, and archive limits
- Added configurable editing (10 MiB default) and transfer (100 MiB default) limits shared across Files and Editor
- Fixed file links in chat messages to recognize file URLs and download API paths in the shared path-link renderer
- Polished Files selection toolbar, removed tree tooltips, matched folder icon tint to standard file icons, and hid file sizes in icon view

## Responses API & Native Tool Calls
- Preserved native tool calls through Context Doctor, leaving canonical function calls untouched by text repair
- Stored canonical function-call content through assistant history and masking, with proper repeated-response detection
- Streamed native tool arguments through the existing live display with alias normalization and masking
- Described bundled tool arguments in Responses schemas for 15 tool implementations with non-strict definitions
- Preserved policy-filtered guidance in native Responses function descriptions with A0 envelope-to-argument conversion
- Projected native system instructions only for Responses requests, reducing Codex input from ~16.4K to ~11.3K tokens
- Preserved native Responses history within prepared prompts, retaining original IDs and encrypted reasoning
- Consolidated Responses prompt bookkeeping outside Agent, reducing agent.py additions from 61 to 24 lines
- Made `llm_result` required in `hist_add_ai_response` with `LLMResult.non_llm` sentinel for non-LLM turns
- Kept Responses stream reconstruction inside the parser with one authoritative output-item store
- Skipped unused Chat replay preparation and shared input conversion for Chat Completions

## Context Doctor & Response Handling
- Added split-thoughts repair strategy extracting value selection into a helper with configurable settings
- Handled reasoning-only and plain-text fallback responses with dedicated retry warnings and user notices
- Tightened usable-response detection requiring at least one A0 key with a non-empty value
- Fixed raw-text fallback classification by moving raw thoughts wrapping after repair selection
- Counted `thoughts_fallback` warning toward the unusable-response limit
- Let Responses text reach the core response dispatcher while continuing to repair recognizable tool intent

## Prompt & Profile Improvements
- Hid disabled capabilities from system prompts so policy-filtered tool prompts remain the source of truth
- Moved MCP guidance into prompt templates with policy-filtered qualified names and schemas
- Compacted developer and researcher profile prompts, reducing token counts from ~2,600 to ~750 each
- Strengthened shared problem-solving prompts with observable success criteria, evidence-driven replanning, bug reproduction, and source-preserving synthesis
- Reinforced response tool usage in prompts, explicitly stating plain-text output without a tool call is invalid
- Stripped trailing newlines in `read_prompt` and `parse_prompt` for consistent template handling
- Added initial user turn to preserve AI greeting turn order when no project is selected
- Rendered scoped profile routing catalog as one line per profile ID with delegation context

## Canvas & UI
- Made the canvas rail movable and customizable with a vertical drag handle, keyboard support, viewport bounds, and remembered position
- Added a "Show verbose tool calls" preference gating tool name and args display in the message stream
- Added `text_editor` custom message handler with dynamic action+path headings
- Themed dark checkboxes with light checkmarks and centered Memory Dashboard selection controls
- Polished surface modal headers to a shared 48px height with centered controls
- Refreshed context indicator after clearing chat
- Showed LiteLLM and Secrets settings by default without collapsible wrappers
- Avoided replaying queued WebUI updates — live benchmark showed catch-up reduced from 1.95s to immediate
- Fixed context window popover staying within bounds on short labels
- Fixed Browser tab switching stuck in loading state when reusing the same viewer URL
- Fixed branch button injection skipping markdown-wrapped action bars
- Clarified required Agent Editor instructions with validation errors and tooltip cleanup

## Browser & Desktop
- Added Safari setup to Browser settings with structured setup guidance for Safari and Chromium-family browsers
- Sped up Browser and Desktop startup by limiting initial D-Bus and CUPS waits to one second
- Fitted Desktop display to the active canvas, removing the aspect-ratio fallback that cropped narrow viewports
- Fixed Desktop and Office package installation using the Python 3.13-compatible Kali snapshot
- Preserved the shared browser cleanup thread across context resets

## Model & Provider Management
- Prevented chat parameters from leaking into embedding configurations
- Preserved Codex OAuth prompt cache affinity with stable session/thread IDs and bounded default cache keys
- Kept OAuth model discovery tied to account availability without replacing empty catalogs with generic registry models
- Reported provider usage for streamed Chat Completions turns with automatic retry when `stream_options` is rejected
- Kept encrypted Chat reasoning out of readable output by filtering provider encrypted-reasoning markers
- Preserved Codex Chat bridge usage and terminal outcomes with token count translation
- Reported invalid model parameter JSON before saving with editor context identifying the preset and slot
- Avoided repeated preset reads during embedding comparisons — median save time reduced from 1,171ms to 52ms
- Discarded model search results for changed drafts and queries
- Set tested Codex client version (0.153.3) by default for model discovery without CLI

## Skills & Plugins
- Added an on-demand guide for managing projects, chats, profiles, and saved tasks through existing APIs
- Consolidated plugin authoring behind `a0-create-plugin` and lifecycle management behind `a0-manage-plugin`
- Required `hooks.py` for plugin setup and cleanup in authoring guidance
- Hid remote skill discovery until the A0 CLI connects
- Fixed trailing commas in six JSON skill examples and rewrote 23 skill descriptions for catalog preview
- Validated skill examples and sharpened descriptions with regression checks

## Parallel Execution & Terminal
- Kept parallel terminal jobs alive until their commands finish, publishing progress through job results
- Kept goal operations out of disposable parallel workers with shared validation across dispatch paths
- Preserved streamed child log content in parallel jobs so user-visible output is never replaced

## Security Fixes
- **WhatsApp**: Fixed media path traversal and enforced pre-download sender/group authorization
- **Telegram**: Fixed webhook authentication bypass — reject HTTP updates for polling bots and require matching nonempty webhook secret
- **IMAP**: Fixed sender whitelist bypass with strict mailbox parsing requiring exactly one valid From address

## Infrastructure & Stability
- Optimized scoped tool policy resolution reusing one fresh policy snapshot across batches
- Unified embedding calls behind a single batch entry point removing duplicate transport logic
- Serialized shared event-loop initialization to prevent concurrent first-use from stranding tasks
- Preserved rollback stash identity during self-update by tracking Git object IDs
- Preserved non-LLM mode when reloading result metadata through dictionary and history round trips
- Restored legacy assistant history call compatibility accepting message-only and positional ID calls
- Shared editor log presentation across local and remote tools
- Kept the rate limiter demo out of test collection
- Used 4-space indented tree in workdir extras for token-compact agent-facing output
- Routed nudge as system message and minified message templates
- Simplified WhatsApp pairing to one QR-code action with sequential polling
- Updated Launcher README links to v1.7
- Ignored `.venv` in generated gitignore templates

## Breaking Changes
- `hist_add_ai_response` now requires an `llm_result` parameter — use `LLMResult.non_llm()` for non-LLM turns (greeting, intervention progress). Legacy message-only and positional ID calls remain supported via automatic sentinel injection.
- `thoughts` is no longer auto-populated from `reasoning` when absent (reasoning-to-thoughts revert).
- Plugin authoring now requires `hooks.py` for dependency installation, initialization, and uninstall cleanup — `execute.py` setup patterns are no longer supported.