🔌 Connector & Remote File Transfers

Large operations now use a bounded transfer protocol — Negotiated WebSocket ceilings, checksums, disk spooling, and symmetric transfer state keep oversized operations controlled and cancel them automatically on pause, reset, deletion, or disconnect.
Workspace transfers publish atomically — Streaming uploads write through partial files with size verification and fsync, while downloads return SHA-256 receipts.
Oversized tool results stay out of the socket — Remote Connector tools expose continuation metadata for large content, reject oversized inline artifacts before base64 expansion, and route bulk files through authenticated HTTP transfers.
CLI and Launcher folders appear in Files — Connected hosts expose their folders with host permissions, authenticated transfers, size checks, and checksum verification.
Archives and temporary files have harder boundaries — Centralized transfers add expansion and entry budgets, reject unsafe archive members, and clean up only owned temporary files.

🗂️ Files & Editor

Files and Editor have independent directory trees — Each surface lazily loads its own tree in canvas and modal modes with unified styling and separately configured visibility.
One shared Editor handles text and code — ACE adds syntax highlighting, line numbers, native source search, and Markdown preview, replacing the legacy file-editor modal.
File behavior is configurable in one place — A dedicated settings category covers sorting, view mode, initial tree visibility, remote connections, archives, and separate editing and transfer limits.
Safer defaults cover everyday work — Editing defaults to 10 MiB and transfers to 100 MiB across Files and Editor.
Chat file links resolve more reliably — The shared path-link renderer now recognizes file URLs and download API paths, while selection controls and icon view receive smaller visual refinements.

Native function calls remain native — Context Doctor, assistant history, masking, repeat detection, and live streaming preserve canonical tool calls and their arguments instead of converting them into repaired text.
Bundled tools describe their arguments directly — Fifteen tool implementations now expose non-strict Responses schemas, with policy-filtered guidance retained in native function descriptions.
Codex receives a smaller, more faithful prompt — Responses-only system projection reduces input from roughly 16.4K to 11.3K tokens while preserving native history IDs and encrypted reasoning.
Response reconstruction has one owner — The parser maintains the authoritative output-item store, and Chat Completions skips replay preparation and input conversion it does not use.
Fallback handling is stricter and clearer — Split-thought repair, reasoning-only responses, plain-text fallbacks, and unusable-output limits now select the correct retry path and surface useful warnings.

Prompts expose only usable capabilities — Disabled capabilities stay hidden, while MCP guidance carries policy-filtered qualified names and schemas from the prompt templates.
Developer and researcher profiles are leaner — Their prompts shrink from roughly 2,600 to 750 tokens while shared guidance emphasizes observable success criteria, evidence, reproduction, and source-preserving synthesis.
Profile routing is more compact and predictable — Scoped profiles render one line per ID, and an initial user turn preserves conversation order when no project is selected.
Management guidance is available on demand — A new guide covers projects, chats, profiles, and saved tasks through existing APIs.
Plugin authoring has one supported lifecycle — Creation and management consolidate behind a0-create-plugin and a0-manage-plugin, with hooks.py required for setup, initialization, and uninstall cleanup.

The canvas rail moves with you — A vertical drag handle and keyboard controls reposition it within viewport bounds and remember the chosen location.
Tool-call detail is optional — A new preference controls verbose tool names and arguments, while text-editor actions receive clearer dynamic headings.
Live updates no longer replay stale queues — Catch-up in the measured WebUI benchmark drops from 1.95 seconds to immediate, alongside fixes for context popovers, Browser tab reuse, chat action bars, and context refresh after clearing.
Browser setup now includes Safari — Structured guidance covers Safari and Chromium-family browsers, and initial D-Bus and CUPS waits are capped at one second.
Desktop fits the active canvas — The display no longer falls back to an aspect ratio that crops narrow viewports, and Office installation uses a Python 3.13-compatible Kali snapshot.

Model settings stay in their lane — Chat parameters no longer leak into embedding configurations, Codex OAuth keeps stable cache affinity, and model discovery remains tied to account availability.
Provider accounting survives streams — Chat Completions reports usage with a retry when stream_options is rejected; Codex bridge totals and terminal outcomes are preserved without exposing encrypted reasoning.
Preset editing does less repeated work — Embedding comparisons avoid redundant reads, cutting the reported median save time from 1,171 ms to 52 ms, and stale model-search results are discarded when drafts change.
Parallel terminal work lives until completion — Background commands publish progress without losing streamed child logs, while goal operations remain outside disposable workers.
Core lifecycle edges are safer — Shared event-loop initialization is serialized, self-update tracks rollback stash object IDs, and non-LLM result metadata survives history round trips.

WhatsApp media stays inside its boundary — Media path traversal is blocked and sender or group authorization is checked before downloads begin.
Telegram webhooks require real authentication — HTTP updates are rejected for polling bots, and webhook requests require a matching non-empty secret.
IMAP sender allowlists cannot be bypassed — Strict mailbox parsing now requires exactly one valid From address.

hist_add_ai_response now requires an llm_result; use LLMResult.non_llm() for greetings, intervention progress, and other non-LLM turns. Legacy message-only and positional-ID calls remain compatible through automatic sentinel injection.
thoughts is no longer populated automatically from reasoning when it is absent.
Plugin dependency installation, initialization, and uninstall cleanup must use hooks.py; setup through execute.py is no longer supported.