🚀 CodeBuddy Code v2.144.0 Release

📦 Version Information

Component	Version
CodeBuddy Code CLI	v2.144.0
Agent SDK JS	v0.3.252
Agent SDK Python	v0.3.251

✨ New Features

Mixed Outbound A2A and stream-json Mode

--a2a can now be combined with --input-format stream-json: messages from both protocols can alternate on the same stdin and jointly drive a single session. A2A SendMessage / GetTask / CancelTask are supported, with the shared session's tool permission policy applied.

• Fully symmetric session creation: Whichever channel sends the first message creates the session, and the other channel automatically reuses it. The first message can be A2A directly; there is no need to send a stream-json message first
• Automatic session binding: When SendMessage omits contextId, it automatically binds to the session served by the current process and returns the session ID in the response for subsequent requests
• --session-id as contextId: When started with --session-id, that ID can be used as the A2A contextId from process startup
• Using --a2a alone retains its existing exclusive stdio behavior

Interactive Approval for Pending Outbound A2A Tasks

When an outbound A2A task is waiting for approval, the client no longer treats "(N pending approval)" as ordinary progress and polls until timeout. Instead, it opens an actionable approval card through ACP elicitation/create and passes the approval token to the host for out-of-band approval:

• After approval, polling continues while the task resumes on its own
• If approval is denied or unanswered, polling stops and the remote task is canceled
• If the task has already reached a terminal state when cancellation occurs (for example, the user approved it directly through WeCom or another channel), the task's actual state is reported instead of "canceled"

Outbound A2A Multi-turn Conversations Persist Across Restarts

The A2A protocol uses contextId to group multiple calls belonging to the same conversation. Previously, this association existed only in process memory and was lost after exiting the CLI and continuing with --resume. It is now recorded on the session, persisted with it, and restored automatically when the session resumes:

• Each remote Agent maps to exactly one remote conversation, distinguished by "discovery source + Agent," so conversations do not become mixed
• Associations remain valid for 24 hours by default, measured from the last use, so continuously active conversations do not expire midway. Configure this with CODEBUDDY_A2A_CONTEXT_TTL_MS

A2A GetTask Progress Snapshots

While the --a2a callee is running, it writes reasoning, tool calls, and partial responses to Task.artifacts. Callers can retrieve a complete progress snapshot by polling with GetTask, without using SendMessageStream. Overly long tool inputs and outputs are automatically truncated.

TUI Main Agent Mode

The terminal now includes an entry point for Main Agent modes. In a blank session, use /mode to switch between cli / ptc / minimal / create (and custom agents with mainAgent: true):

• The startup header shows the current mode; when the input is empty and switching is still allowed, it displays /mode to switch
• Mode selection is remembered automatically and reused on the next startup or new session; it is locked after the conversation begins
• Standard / PTC / Minimal / Creator use different color schemes, and custom agents have their own colors
• When the Main Agent is switched in Web UI / ACP, the TUI header in the same process refreshes immediately

🔧 Improvements

• TUI --agent takes precedence over remembered mode: Starting with --agent (including custom agents with mainAgent: true) now takes precedence over the previously remembered mode and is no longer overwritten. /mode to switch is no longer shown incorrectly during an active turn. Minimal mode's tool-constraint footnote remains inside the system reminder and no longer leaks into user bubbles.
• Session skills and custom commands included in the model's list: Fixed session-profile skills being unavailable in /server multi-session mode. Skills and custom commands (~/.codebuddy/commands) now take effect per session and appear in the model-visible list.
• Agent tool controls: Tools can now be enabled or disabled by product Tool, required Tool, MCP Server, MCP Tool, and custom MCP configuration. During execution, explicit WorkBuddy Security Center denial information is returned.
• WorkBuddy platform directory protection: Sessions allow Agents to read platform-owned data, but ask the user before modifying or deleting databases, session history, recovery data, authorization state, or internal indexes. Long-term memory, Connector, and Agent task directories remain writable.
• Correlatable Hook events: UserPromptSubmit events now include generation_id, which remains stable within a conversation turn and can be correlated with Stop and other events.

🐛 Bug Fixes

• /server startup crash: Fixed an issue that always caused start() in /server artifacts to crash (versions 2.141.0–2.143.0 were affected).
• Outbound A2A served-side failure: Fixed an issue where A2A tools never appeared in the model's tool surface under library-form /server.
• agent-view attach hangs and input failure: Attaching to or moving a large session to the background no longer freezes the terminal. Also fixed all keyboard input becoming unresponsive after a successful attach on Windows.
• TUI input fixes: Pressing Enter after pasting @xxx without a trailing space now sends normally. In multiline input, Ctrl+A / Ctrl+E correctly move to the start or end of the current logical line.
• Streaming tool argument parsing: Fixed malformed keys and blank command rendering caused by long commands arriving in streamed chunks.
• Session attribution for image/video generation: Added missing session and identity association headers to image and video generation requests so the server can attribute them correctly for billing, auditing, and telemetry. VideoGen now supports Kling V3 parameters (5-second duration, 720P/1080P, aspect ratio, and audio generation).
• Plugin marketplace resilience: If a marketplace archive declares a plugin but does not include it, installation skips the missing plugin and continues with the rest instead of letting one plugin break the entire marketplace. Installation is still rejected if too many plugins are missing.
• Empty task continuation: Fixed messages triggering an empty continuation after they had already been processed, which could cause extra model requests or service errors.
• Worktree exit: The exit menu now reports the result after keeping or deleting a worktree. User workspaces are no longer deleted incorrectly when attached as existing workspaces.
• Sensitive credential confirmation: WorkBuddy credentials encrypted silently no longer trigger repeated sensitive credential confirmations when they continue to be sent to trusted tools after a worker replacement.
• Background task reliability: Broker IPC now includes surge protection, waiting for capacity to recover when execution exceeds the limit instead of rejecting immediately.
• Real-time Multitask progress: Web / WorkBuddy can now display tool calls, results, and final responses from background workers dispatched by the coordinator in real time. After a worker finishes, the host receives a new conversation-turn notification.
• Reporting completeness: CLI reporting events now include all W3C baggage entries, and the buddyId / buddyName common parameters passed by WorkBuddy are reported correctly.