What's Changed
🔒 Security Enhancements
-
Critical: Fixed env variable exposure via command line (#92 fixes #89)
- Modified claude backend to pass environment variables via process environment instead of command-line arguments
- Prevents ANTHROPIC_API_KEY exposure in ps/logs
- Added SetEnv() interface method to commandRunner
- Maintains --setting-sources "" to prevent infinite recursion from skills/commands/agents
- #92
-
Comprehensive security improvements (#90)
- Codex: Changed --dangerously-bypass-approvals-and-sandbox to opt-in (requires CODEX_BYPASS_SANDBOX=true)
- Claude Backend: Made --dangerously-skip-permissions opt-in (respects SkipPermissions field, default: false)
- Added SessionID validation with multi-layer checks and clear error messages
- #90
✨ Features
-
Millisecond-precision timestamps for all log entries (#91 fixes #81)
- Format: [YYYY-MM-DD HH:MM:SS.mmm]
- Enables precise event timing during tail -f monitoring
- #91
-
Improved backend termination and timeout handling (#86)
- Better process cleanup after message completion
- Extended timeout configuration
- #86
🐛 Bug Fixes
- Critical parser fixes and performance optimization (#88)
- Fixed Gemini detection: Changed Delta bool to *bool to detect {"delta":false} correctly
- Fixed Codex detection: Check item.type field instead of item length to prevent Claude event misidentification
- Performance: Moved itemHeader parsing to item.completed case only
- #88
📚 Documentation
- Added INSTALL_DIR customization guide (#90)
- Updated version requirements for all backends (Codex/Claude/Gemini) (#90)
- Added compatibility troubleshooting guide (#90)
- Improved dev workflow documentation (#90)
🔄 Breaking Changes
Codex Behavior
- Old: Always bypassed sandbox by default
- New: Requires CODEX_BYPASS_SANDBOX=true to bypass
- Migration: Set environment variable if automation depends on auto-bypass
Claude Behavior
- Old: Always skipped permissions
- New: Requires SkipPermissions=true flag
- Migration: Add --skip-permissions flag if needed
Resume Mode
- Old: Accepted empty SessionID
- New: Rejects empty SessionID with clear error
- Migration: Ensure SessionID is provided in resume mode
Contributors
Special thanks to:
- SWE-Agent.ai for automated code reviews and fixes
- Claude Sonnet 4.5 for code generation assistance
- Codeagent (Codex) for collaborative development
Full Changelog: v5.2.6...v5.2.7