Upgrade notes
Upgrading is one way. This release runs two new data migrations, v027 (per-session sandbox agent stores) and v028 (archived sessions frozen at a live status), taking the data schema from 26 to 28. Older builds refuse to start on a version 28 profile, so there is no downgrade to 1.15.x short of restoring a backup. Back up your app directory (~/.agent-of-empires, or ~/.config/agent-of-empires on Linux) first if you may want to roll back.
The v027 store move is cheap where the filesystem can clone a file, which covers APFS, btrfs and XFS: seconds, and close to no extra disk however large the store is. Everywhere else, ext4 included, the bytes are copied, so budget one full copy of the shared store for each sandboxed session that has to move. Stop your sandboxed sessions before upgrading so it finishes in one pass. A session whose container is still running is skipped and keeps using the shared store, and the reminder returns on every launch until that session is stopped and started again.
--auth=passphrase --behind-proxy can no longer be driven from the TUI structured view. #3849 closed a bypass in that mode: proxied traffic arrives over a loopback socket, so an upstream that does not forward the client IP handed every visitor the same-host carve-out and the full API with no credential. Loopback callers now meet the wall there, and the TUI carries a bearer token with no passphrase exchange to fall back on, so it cannot attach at all. Use --auth=token on daemons you also drive from the local TUI. Same-host use without --behind-proxy is unchanged.
Note: these upgrade notes were drafted by Claude Opus 5 via back-and-forth with @njbrake. The reasoning and decisions are his; the prose is Claude's.
1.16.0 - 2026-09-10
Bug Fixes
- session: Resolve a custom agent's built-in before capture and resume in #3715 by @njbrake (
598387a) - acp: Reject out-of-range ACP wakeup delays without panicking in #3720 by @njbrake (
4de70f6) - acp: Keep snake_case identifiers in plan titles in #3725 by @njbrake (
6e22805) - tui: Reject preview drag start below rendered content in #3726 by @njbrake (
16576ad) - plugin: Check session ownership before prompt disposition in #3728 by @njbrake (
e6a8a9b) - serve: Clear rotated tokens on the configured grace period in #3722 by @njbrake (
1a4ec65) - tests: Isolate host state the live harness's suffix rule misses in #3719 by @njbrake (
5ef1add) - server: Stop background drains recreating a deleted session's prompt lock in #3724 by @njbrake (
7082dd2) - serve: Arm the shutdown deadline before reaping plugin workers in #3721 by @njbrake (
9d3f505) - hooks: Read sandbox trust files through one O_NOFOLLOW descriptor in #3723 by @njbrake (
2fcbba1) - Honor CLAUDE_CONFIG_DIR for Claude MCP config in #3699 by @staccDOTsol (
1e1ef1e) - acp: Cap rate-limit auto-resume redeliveries in #3693 by @atirna (
df59182) - sandbox: Harden repo-scoped sandbox config in #3679 by @unbrice (
52abbdf) - acp: Classify aoe-agent task calls as think and drop AOE_AGENT's false claude claims in #3533 by @Seluj78 (
92d9a50) - tmux: Prevent detach hint truncation in #3727 by @stable-release (
7e7e8b3) - sandbox: Quote container terminal workdir, harden shell resolution in #3732 by @jerome-benoit (
7b1f2fd) - tmux: Refresh @aoe_title when a session is renamed in #3744 by @njbrake (
0609e47) - session: Require authoritative native resume identity in #3678 by @jerome-benoit (
b2569c7) - Unbreak the macOS build and repair two failing checks in #3750 by @njbrake (
74d87e6) - session: Open anchored stores through symlinked ancestors on macOS in #3755 by @njbrake (
0ab3f81) - Complete client context review follow-ups in #3748 by @jerome-benoit (
44aa3a8) - status: Stop reading the background-shell count as agent activity in #3753 by @njbrake (
12af81f) - sandbox: Reclaim named ignore volumes stranded by a worktree move in #3754 by @njbrake (
f85619a) - migrations: Sandbox-store migration review follow-ups (#3763-#3769) in #3774 by @njbrake (
8876585) - tests: Stop HOME-reading tests racing the suite's HOME writers in #3760 by @njbrake (
89f931d) - acp: Answer option-list permission requests with the picked option in #3779 by @njbrake (
e7bf8ba) - web: Stop Android IMEs from re-sending a word they retroactively compose in #3751 by @njbrake (
59aec66) - tui: Open links in the preview in #3749 by @njbrake (
07c5af9) - vt: Three review follow-ups on the VT grid live view (#3770-#3772) in #3778 by @njbrake (
1fbd652) - tmux: Advertise the key that returns to aoe after an attach in #3736 by @BTForIT (
311e3b8) - Add scroll to model dropdown when option list overflows in #3747 by @Istar-Eldritch (
5bf4c31) - sandbox: Prepare hook directory before container launch in #3785 by @clefru (
82a9822) - session: Never surface archived rows as Waiting in #3786 by @BTForIT (
9f3999f) - session: Configurable session-id poller budget with repair backoff in #3787 by @BTForIT (
c8ea633) - status: Detect running turns across all omp composer shapes in #3808 by @larkinwc (
af6dd49) - Stop auto-minting stray profiles from -p; sink default last in #3681 by @BTForIT (
99e93bf) - Restore the lib-test build and make load-Err fixtures root-safe in #3815 by @njbrake (
5673763) - migrations: Scope sandbox-copy progress counters to each move in #3813 by @njbrake (
196bfad) - sandbox: Diagnose legacy mounts under declared agent config in #3789 by @jerome-benoit (
f4375d9) - tests: Repair the ACP test fixtures behind #3790 and #3811 in #3814 by @njbrake (
9707df7) - Honor Codex hooks feature opt-out in #3781 by @jerome-benoit (
4f083ed) - Get main green on the sun_path and capture-lease regressions in #3823 by @njbrake (
b4098e0) - migrations: Stop the v027 store move expanding and re-flushing everything in #3821 by @njbrake (
791ee3b) - tmux: Prevent unread vt pipe replay after reseed in #3759 by @atirna (
bf875fe) - acp: Give each runner generation one lifecycle owner in #3758 by @njbrake (
e012f15) - tui: Refresh storage during live send in #3782 by @jerome-benoit (
2c9b81f) - sandbox: Reclaim per-session agent stores that no session owns in #3820 by @njbrake (
8f0cece) - sandbox: Keep the store through any purge that gets rolled back in #3825 by @njbrake (
3f9e33a) - tests: Measure the live cursor against the prompt the agent just drew in #3826 by @njbrake (
366a53d) - vt: Map the seeded cursor onto the grid the capture actually filled in #3831 by @njbrake (
df7e816) - sandbox: Share one Claude credential file across sandboxes in #3834 by @njbrake (
c5bcfd0) - web: Keep terminal selection through streamed frames and bracket toolbar pastes in #3830 by @njbrake (
111c148) - tests: Release the ready-marker pane causally, not on a sleep in #3829 by @njbrake (
2e31f0a) - vt: Serialize concurrent resize declarations and pin the reseed link ordering in #3827 by @njbrake (
7d965cf) - acp: Stop a cancel overtaking the prompt it is meant to stop by @njbrake (
7c61c14) - acp: Order the plugin turn path behind its submission guard too in #3844 by @njbrake (
0b351c0) - pi: Keep a Pi conversation when its transcript is gone in #3833 by @njbrake (
0bd6dd5) - sandbox: Place the mountpoint the shared credential file mounts over in #3846 by @njbrake (
a9220ac) - server: Hold the passphrase wall against unforwarded proxied requests in #3849 by @njbrake (
b8e5c11) - web: Hold the painted frame while a terminal selection is live in #3847 by @njbrake (
02398dd) - tmux: Keep pipe-pane input off tmux that crashes on a dead pane in #3792 by @hairbui76 (
d1c254e) - sandbox: Keep the host and sandbox Claude credential chains apart in #3858 by @njbrake (
dd355b8) - sandbox: Stop a blanked credential from wedging every sandbox in #3866 by @njbrake (
5687bbd)
Features
- tui: Configure new session open mode in #3542 by @athal7 (
a5bdb7b) - server,tui: Expose context resume availability in #3647 by @jerome-benoit (
471afe1) - sandbox: Add container run-policy settings (#3581) in #3623 by @unbrice (
7da0c5a) - migrations: Show progress and a way to defer the sandbox store move in #3757 by @njbrake (
12ee61f) - web: Render the agent live view from the VT grid with whole frames and row patches in #3762 by @njbrake (
eb0f382) - acp: Runner terminates the ACP protocol and the relay socket is retired (#1054 Phase C) in #3538 by @Seluj78 (
d97cd4d) - web: Reuse the searchable project picker for extra repos in #3791 by @cwrau (
6f3ebe8)
Performance
- build: Cut dev-profile debug info to shrink target dirs in #3729 by @njbrake (
06b2732) - migrations: Move a sandbox store when its session starts, not on every boot in #3761 by @njbrake (
376db9f)
New Contributors
- @larkinwc made their first contribution in #3808
- @clefru made their first contribution in #3785
- @Istar-Eldritch made their first contribution in #3747
- @unbrice made their first contribution in #3623
- @stable-release made their first contribution in #3727
- @staccDOTsol made their first contribution in #3699
Full Changelog: v1.15.3...v1.16.0