🚀 CodeBuddy Code v2.168.0 Release

📦 Version Information

Component	Version
CodeBuddy Code CLI	v2.168.0
Agent SDK JS	v0.3.280
Agent SDK Python	v0.3.279

✨ New Features

Mod Tools Can Return Images

Tools registered by mods can now return image content (MCP style), so the model sees the image directly, such as a web page screenshot, instead of receiving only text.

Desktop Agent Browser Primitives

In CodeBuddy Desktop, mods can obtain their own browser lease via desktop.agentBrowser.acquire() and implement browser features themselves using primitives such as views, in-page CDP, mirrored frames / native mounting / webview, a separate cookie partition, encrypted saved login credentials, and native confirmation dialogs. When no mod requests it, Desktop does not create any related resources.

Built-in Mod Approval API

Added GET /api/v1/plugins/mods/source and POST /api/v1/plugins/mods/approve, allowing installers to approve a freshly installed mod by its exact source hash (consistent with cbc plugin add --yes).

🔧 Improvements

• Faster mod startup: Reduced mod startup and reload costs by reusing compilation results, lightweight discovery, and cancelable downloads. Installed mods are loaded only when a view, file, memory topic, or explicit action needs them, and unrelated extensions are no longer restarted.
• Mod entries available earlier: Mods can publish localized workbench and command entries before their code loads. These commands can be bound in the native command shortcut settings, and saved bindings persist after disabling and re-enabling. Added a persistent Notes workbench template that follows the native theme and language.
• More efficient mod resource loading: Images, fonts, and data within a package are loaded independently from code, verified resource bytes are reused, and unused snapshots are safely reclaimed. Approved Web packages and function hooks always use the selected immutable source code, and revocation, corruption, and installation identifier changes remain explicit failures.
• Clearer mod authoring error messages: Entry errors for mod creation, composition, and editing now use localized messages, covering scenarios such as a busy session, a pending question or approval, a missing session, mode switch timeout, and session changes. Diagnostic details are kept after the message, and third-party error content is left as-is.
• Mod collection export and validation: plugin collection can export exact source snapshots of installed Web mods along with their required dependency closure, and validates bundle members' paths, names, versions, and full source hashes, rejecting mismatched members before installation or build to ease reproduction and migration.
• Faster first response in WorkBuddy: The prewarmed process starts outbound AgentCard discovery asynchronously during the activate phase without delaying readiness. The first message waits on the same request only if discovery has not yet completed.

🐛 Bug Fixes

• Monitor no longer runs forever or floods output: Fixed Monitor being able to run indefinitely once started, continuing to wake the model and consume large amounts of tokens after the user left. All Monitors now run for 5 minutes by default and at most 30 minutes (a parameter for running indefinitely is no longer offered). On expiry, the model receives a single notification with the event count and can restart monitoring itself if truly needed. Output is also rate-limited: output within 200ms is merged into one notification, overly long content is truncated, the number of dropped events is reported when events arrive too quickly, and monitoring stops automatically after more than 30 seconds of continuous flooding. Previously, Monitor's full tool description was not registered and the model saw only a placeholder string; the full description now takes effect.
• More complete injection detection coverage (#149039): Increased the input budget for per-turn tool result review, reducing cases in longer tasks where later tool results skip review because the budget is exhausted.
• Web UI no longer floods listener leak warnings (#149564): The task panel reverse proxy no longer accumulates timeout listeners when reusing connections, so MaxListenersExceededWarning no longer appears during long runs.
• ACP subagents can ask you questions (#89387): In WorkBuddy Desktop / Web, subagents launched by workflow agent(), the Agent tool, and fork skills can now use AskUserQuestion normally, instead of silently losing the ability to ask questions.
• Plugin hooks support special paths (#148529): When the user directory contains characters such as backticks or dollar signs, plugin hooks no longer fail to start because the path is interpreted as command syntax.
• Forked sessions keep subagent history: /fork and /branch can now copy sessions containing completed subagent history, preserving the selected main Agent, model, output style, and permissions. Subagent records and tool outputs are copied independently, and the fork can be continued without affecting the original session.
• More reliable Goal: Fixed issues such as continuing to execute after being cleared, async operations overwriting a new goal, state being lost after restart, and finished goals being reactivated. Branched sessions do not inherit the original goal. Evaluation failures no longer falsely report the goal as achieved, and retries are still possible when it is not achieved. Esc can pause a Goal, and the terminal adds pause, resume, and clear hints.
• Sessions no longer lost: Fixed the JSONL file being emptied when session saving and history appending ran concurrently, causing the session to disappear after restart. Fixed the resume list misjudging sessions that still have work records as empty after long sessions or model errors.
• Mod creation no longer waits 15 seconds: Fixed session binding taking too long to establish when entering mod authoring after creating (or clearing) a session, failing only after a full 15 seconds. Issuing multiple creation requests in a row no longer silently drops the later ones; a new creation-mode session is opened for each new request.
• Timers work in browser mods: Fixed browser mods that use regular timers or animation frames (such as games and animation components) reporting setTimeout is unavailable. Timers and animation frames now run normally and are automatically canceled when the mod stops, updates, or the page switches.
• Background task management: Fixed the background task list staying in an old state when process checks were slow, Ctrl+X occasionally failing to stop or delete the same task after a background process's PID was cleaned up or its start time representation changed, and being unable to take over background sessions when the temporary directory path was too long. When the user stops a background task, stopped by you is now clearly shown, and the reason is displayed if stopping fails.
• PR linking and review: PRs can now be linked from structured gh tool output, Jobs details return the PR link and check status, and tasks that completed successfully but still have open PRs move into the pending review group.