🚀 CodeBuddy Code v2.143.1 Release

📦 Version Information

Component	Version
CodeBuddy Code CLI	v2.143.1
Agent SDK JS	v0.3.251
Agent SDK Python	v0.3.250

✨ New Features

Tool Call Loop Guard

A loop guard has been added to the tool execution chain. When triggered, it lets the user choose whether to continue or stop:

• The same tool is called 40 consecutive times within a single request, regardless of arguments
• An AAB pattern (two calls to the same tool followed by one call to a different tool) repeats for 10 consecutive cycles

Counts are tracked by session and request and do not accumulate across requests. Behavior in CodeBuddy Code CLI remains unchanged. In WorkBuddy, headless runs, background tasks, and child sessions behave as if "continue" were selected: they report the event without interrupting execution. The optional environment variables CBC_LOOP_GUARD_DISABLED / CBC_LOOP_GUARD_CONSECUTIVE_THRESHOLD / CBC_LOOP_GUARD_SEQUENCE_REPEATS have been added to help QA reproduce these scenarios quickly.

Duplicate Package Version Detection in Bundles

The CBC packaging pipeline (main bundle / headless / server) now detects multiple versions of the same package. Reports list upstream import sources in descending byte-size order, making it easier to consolidate versions with aliases. The default behavior is to warn. Set CBC_BUNDLE_DUPLICATE_STRICT=1 to exit with a non-zero status for CI enforcement, or use CBC_BUNDLE_DUPLICATE_ALLOW=pkg1,pkg2 to add exemptions.

🔧 Improvements

• Separate model configuration for the Auto classifier: The safety classifier in auto permission mode now follows the same model precedence as other subagents. If classification fails, the message shows the model actually used and where to configure it.
• Fail-closed behavior for the Auto classifier: If the classifier runs successfully but produces no parseable conclusion, it now consistently fails closed and rejects the action. These rejections count toward the rejection limit; after 3 consecutive rejections, auto mode pauses to prevent the session from becoming stuck.
• On-demand TTL refresh for outbound A2A Agent Cards: Agent Cards are cached for 12 hours by default, configurable through CODEBUDDY_A2A_DISCOVERY_TTL_MS. The first call after expiration triggers a refresh, and concurrent calls share the same request.
• Forward user message events when steer messages are injected: When a message sent through "Send immediately" is actually injected into the model context while the model is running, it is forwarded as a user_message_chunk event. session/steer also returns the active turn's ownerRequestId, allowing subsequent steer calls to target the same turn through expectedRequestId.
• Custom agent model fields in plugins now take effect: Fixed an issue where the model field in agent frontmatter under plugin directories was ignored. Custom models declared by plugin authors are now actually used for subagent execution.
• Streaming replies can be disabled for WeCom bots: Streaming or non-streaming replies can now be selected in TUI /remote-control and on the Web UI remote control page.
• Interactive cards can be disabled for WeCom bots: Template cards can now be disabled in favor of plain-text confirmations. Changes to the default bot's toggle are persisted to instances.json.
• Forward model service error messages: User-facing messages included in model service error responses are now passed through unchanged for display by upper layers.
• Malicious domain filtering for WebSearch: Malicious domains are filtered before search results reach the model or UI. Matches are also recorded in Security Center audits and reported through protection telemetry.

🐛 Bug Fixes

• A2A file download location: URL files returned by outbound A2A are now saved to the current session workspace's outputs/a2a directory.
• ACP session error messages: Fixed an issue where subsequent model errors could occasionally be misclassified as cancellations after interruption recovery.
• WorkBuddy team sessions: Fixed missing request ownership information in tool status updates after inbox wake-up, without affecting child task stream ownership.
• Ordering of batched TaskCreate calls: When the model creates tasks concurrently in the same batch, numeric IDs now follow plan order. TaskCreate calls in a batch execute in model call order, while other tools remain concurrent.
• Missing HTTP status codes in model service errors: Fixed an issue that caused inaccurate structured error classification.
• Restored optional VideoGen generation parameters: Aspect ratio, negative prompts, and audio toggles are available to the model again. When omitted, they default to 16:9, an empty negative prompt, and enabled audio, fixing silent videos generated by default.
• Removed the black vertical line from WeCom streaming replies: The shim now uses full-width spaces / non-breaking spaces, so reply bubbles no longer start against a black line.
• WeCom interactive card options no longer squeezed horizontally: Ask / permission / suggestion prompts now consistently use the official vote_interaction vertical option layout.
• WeCom messages immediately show the sender: When a WeCom user message reaches an open Web UI, the "WeCom · User" label now appears immediately.
• macOS sandbox file approval: Fixed an issue where Brokered Host did not register temporary auto-allow rules with Sandbox Center after creating files, preventing tools such as Git from inadvertently triggering rule approval when cleaning up temporary files.
• Immediate notification when quota is exhausted: HTTP 429 + business code 14019 (no available Token quota) now goes directly to fallback without retrying, surfacing the message immediately instead of after a delay of about 1m40s.
• Sensitive-data detection for image tool results: Base64 payloads are no longer scanned when image tool results are passed as JSON strings, preventing random image bytes from being misidentified as API keys.
• Reuse approval for sensitive matches within the same ToolCall: When sensitive information is matched multiple times, only the first approval dialog is shown. Subsequent matches and tool-result admission silently reuse the user's choice.
• WebUI background tasks and source control: Fixed background tasks being mixed across sessions or failing to recover after a worker restart. Also fixed source control being unable to revert newly created files in nested directories.
• Python shim signature protection: Bytecode caches can no longer be written into packaged application directories, preventing damage to macOS application signatures.
• Allow-by-default fallback when Sandbox Center is unavailable: If startup fails, requests time out, or IPC errors occur, WebFetch, network policy checks, and file guards now fall back to allowing the operation. Deny rules returned normally by Security Center still apply.
• Corrected secure-deletion audit semantics: Secure deletion automatically performed by macOS implicit fallback rules is no longer incorrectly displayed as a file allowlist match.
• Eliminated CBC Web UI packaging warnings: Fixed all 7 groups of Vite/Rollup dynamic import will not move module into another chunk warnings.